A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across concurrent threads when using EE Security with WildFly Elytron which can lead to the possibility of being handled using the identity from another request.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2059 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.2.8 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.2.7, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.2.8 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * cxf: reflected XSS in the services listing page (CVE-2019-17573)

    * smallrye-config: SmallRye: SecuritySupport class is incorrectly public and contains a static method to     access the current threads context class loader (CVE-2020-1729)

    * jackson-databind: XML external entity similar to CVE-2016-3720 (CVE-2019-10172)

    * wildfly: Soteria: security identity corruption across concurrent threads (CVE-2020-1732)

    * undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745)

    * cryptacular: excessive memory allocation during a decode operation (CVE-2020-7226)

    * cxf-core: cxf: OpenId Connect token service does not properly validate the clientId (CVE-2019-12423)

    * undertow: servletPath in normalized incorrectly leading to dangerous application mapping which could     result in security bypass (CVE-2020-1757)

    * wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security     Domain (CVE-2020-1719)

    * undertow: invalid HTTP request with large chunk size (CVE-2020-10719)

    * undertow: Memory exhaustion issue in HttpReadListener via Expect:
    100-continue header (CVE-2020-10705)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2060 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.2.8 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.2.7, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.2.8 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * cxf: reflected XSS in the services listing page (CVE-2019-17573)

    * smallrye-config: SmallRye: SecuritySupport class is incorrectly public and contains a static method to     access the current threads context class loader (CVE-2020-1729)

    * jackson-databind: XML external entity similar to CVE-2016-3720 (CVE-2019-10172)

    * wildfly: Soteria: security identity corruption across concurrent threads (CVE-2020-1732)

    * undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745)

    * cryptacular: excessive memory allocation during a decode operation (CVE-2020-7226)

    * cxf-core: cxf: OpenId Connect token service does not properly validate the clientId (CVE-2019-12423)

    * undertow: servletPath in normalized incorrectly leading to dangerous application mapping which could     result in security bypass (CVE-2020-1757)

    * wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security     Domain (CVE-2020-1719)

    * undertow: invalid HTTP request with large chunk size (CVE-2020-10719)

    * undertow: Memory exhaustion issue in HttpReadListener via Expect:
    100-continue header (CVE-2020-10705)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2058 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.2.8 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.2.7, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.2.8 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * cxf: reflected XSS in the services listing page (CVE-2019-17573)

    * smallrye-config: SmallRye: SecuritySupport class is incorrectly public and contains a static method to     access the current threads context class loader (CVE-2020-1729)

    * jackson-databind: XML external entity similar to CVE-2016-3720 (CVE-2019-10172)

    * wildfly: Soteria: security identity corruption across concurrent threads (CVE-2020-1732)

    * undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745)

    * cryptacular: excessive memory allocation during a decode operation (CVE-2020-7226)

    * cxf-core: cxf: OpenId Connect token service does not properly validate the clientId (CVE-2019-12423)

    * undertow: servletPath in normalized incorrectly leading to dangerous application mapping which could     result in security bypass (CVE-2020-1757)

    * wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security     Domain (CVE-2020-1719)

    * undertow: invalid HTTP request with large chunk size (CVE-2020-10719)

    * undertow: Memory exhaustion issue in HttpReadListener via Expect: 100-continue header (CVE-2020-10705)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
136498	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 7 (RHSA-2020:2059)	Nessus	Red Hat Local Security Checks	critical
136495	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 8 (RHSA-2020:2060)	Nessus	Red Hat Local Security Checks	critical
136494	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 6 (RHSA-2020:2058)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2020-1732

medium

Tenable Plugins

critical

critical

critical