Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.21 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

org.wildfly.core:wildfly-server: Wildfly improper RBAC permission

A flaw was found in the Wildfly Server Role Based Access Control RBAC provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor ro...

CVE-2024-12369 vulnerabilities

Vulnerabilities for packages: wildfly...

GHSA-5565-3C98-G6JC vulnerabilities

Vulnerabilities for packages: wildfly...

CVE-2024-12369 vulnerabilities

Vulnerabilities for packages: wildfly...

GHSA-5565-3C98-G6JC vulnerabilities

Vulnerabilities for packages: wildfly...

io.hawt:hawtio-wildfly (=2.17.7), io.kokuwa.keycloak:keycloak-event-metrics (>=0.1.0 <=1.0.0) +133 more potentially affected by CVE-2024-12369 via org.wildfly.security:wildfly-elytron-http-oidc (>=1.17.0.Final <=2.2.8.Final)

org.wildfly.security:wildfly-elytron-http-oidc MAVEN version =1.17.0.Final, =0.1.0, =9.4.45.v20220203, =9.4.45.v20220203, =9.4.45.v20220203, =10.0.8, =12.0.1, =12.0.1, =12.0.1, =10.0.10, =13.0.0.CR1, =3.1.0.Final, =3.1.1.Alpha1 - org.jboss.resteasy.spring:galleon-feature-pack-layers-metadata-test...

de.gedoplan:baselibs-wildfly (=36.0.1_02), org.eclipse.jetty.documentation:code-examples (>=10.0.22 <=11.0.25) +18 more potentially affected by CVE-2024-12369 via org.wildfly.security:wildfly-elytron-http-oidc (>=2.3.0.Final <=2.6.1.Final)

org.wildfly.security:wildfly-elytron-http-oidc MAVEN version =2.3.0.Final, =10.0.22, =10.0.21, =10.0.21, =10.0.21, =10.0.21, =10.0.21, =26.0.0, =26.0.0, =26.0.0, =2.3.0.Final, =2.6.10.Final - org.wildfly.transaction:wildfly-transaction-client =3.0.5.Final and more Source cves: CVE-2024-12369 Sour...

br.eti.clairton:ds-test (>=1.0.1 <=1.2.1), br.unb.erlangms:ems_java (=1.0.8.8) +394 more potentially affected by CVE-2024-12369 via org.wildfly.security:wildfly-elytron (>=1.17.0.Final <=2.2.7.Final)

org.wildfly.security:wildfly-elytron MAVEN version =1.17.0.Final, =1.0.1, =1.6.10, =1.6.10, =2020.10.30-4240, =2020.10.30-4240, =6.2.0, =0.1.0, =1.0.1, =6.3.0, =0.2.10-wildfly15, =0.2.10-wildfly15, =0.2, =0.3...

de.gedoplan:baselibs-wildfly (=36.0.1_02), org.eclipse.jetty.documentation:code-examples (>=10.0.22 <=11.0.25) +16 more potentially affected by CVE-2024-12369 via org.wildfly.security:wildfly-elytron (>=2.3.0.Final <=2.6.0.Final)

org.wildfly.security:wildfly-elytron MAVEN version =2.3.0.Final, =10.0.22, =10.0.21, =10.0.21, =10.0.21, =10.0.21, =10.0.21, =26.0.0, =26.0.0, =26.0.0, =2.1.0.Final, =2.1.4.Final and more Source cves: CVE-2024-12369 Source advisory: OSV:GHSA-5565-3C98-G6JC...

GHSA-5565-3C98-G6JC WildFly Elytron OpenID Connect Client ExtensionOIDC authorization code injection attack

Impact A vulnerability was found in OIDC-Client. When using the elytron-oidc-client subsystem with WildFly, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is...

WildFly Elytron OpenID Connect Client ExtensionOIDC authorization code injection attack

Impact A vulnerability was found in OIDC-Client. When using the elytron-oidc-client subsystem with WildFly, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is...

CVE-2025-2240 vulnerabilities

Vulnerabilities for packages: apicurio-registry, wildfly...

GHSA-GFH6-3PQW-X2J4 vulnerabilities

Vulnerabilities for packages: apicurio-registry, wildfly...

GHSA-GFH6-3PQW-X2J4 vulnerabilities

Vulnerabilities for packages: apicurio-registry, wildfly...

CVE-2025-2240 vulnerabilities

Vulnerabilities for packages: apicurio-registry, wildfly...

Brute-force Attack

org.wildfly.core, wildfly-elytron-integration is vulnerable to Brute-force Attack. The vulnerability is due to the lack of rate limiting on failed authentication attempts via CLI, allows attackers to perform multiple failed authentication attempts within a short time frame due to the lack of rate...

com.antonyudin.wildfly.security:ay-securityrealm-ejb (=1.0), org.jboss.as:hal-testsuite-basic (=0.0.6) +13 more potentially affected by CVE-2025-23368 via org.wildfly.core:wildfly-elytron-integration (>=10.0.0.Beta1 <=9.0.2.Final)

org.wildfly.core:wildfly-elytron-integration MAVEN version =10.0.0.Beta1, =5.0.0.Alpha6, =3.0.0.Beta17, =5.0.0.Alpha6, =3.0.0.Beta17, =13.0.0.Beta1, =5.0.0.Alpha6, =3.0.0.Beta22, =25.0.0.Final, =25.0.0.Final, =25.0.0.Final, =27.0.0.Alpha2, =27.0.0.Final, =27.0.1.Final Source cves: CVE-2025-23368...

Brute Force

Overview Affected versions of this package are vulnerable to Brute Force due to insufficient security measures in the authentication mechanism. An attacker can exploit this flaw to perform brute force attacks by repeatedly attempting to authenticate within a short time frame. Note: The...

GHSA-3JXR-23PH-C89G Duplicate Advisory: Wildfly Elytron integration susceptible to brute force attacks via CLI

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qhp6-6p8p-2rqh. This link is maintained to preserve external references. Original Description A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent...