Bug 1165170 (CVE-2014-7849)
Summary: | CVE-2014-7849 JBoss AS/WildFly Domain Management: Limited RBAC authorization bypass | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Arun Babu Neelicattu <aneelica> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | anmiller, asantos, bdawidow, brian.stansberry, cdewolf, chazlett, dandread, darran.lofthouse, epp-bugs, fnasser, grocha, huwang, jawilson, jdg-bugs, jpallich, kejohnso, lgao, mweiler, myarboro, pgier, pskopek, pslavice, rhq-maint, rsvoboda, security-response-team, spinder, theute, ttarrant, vtunka, weli |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: |
It was discovered that the Role Based Access Control (RBAC) implementation did not sufficiently verify all authorization conditions that are required by the Maintainer role to perform certain administrative actions. An authenticated user with the Maintainer role could use this flaw to add, modify, or undefine a limited set of attributes and their values, which otherwise cannot be written to.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2019-06-08 02:36:21 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1165171, 1165172, 1165186 | ||
Bug Blocks: | 1155350, 1164637, 1217043 |
Description
Arun Babu Neelicattu
2014-11-18 13:43:05 UTC
Acknowledgements: This issue was discovered by Darran Lofthouse of the Red Hat JBoss Enterprise Application Platform Team. Statement: This issue did not affect the versions of Red Hat JBoss Enterprise Application Platform before 6.2.0 as they did not include support for role-based access control (RBAC). This issue has been addressed in the following products: JBoss Enterprise Application Platform 6.3.3 Via RHSA-2015:0215 https://rhn.redhat.com/errata/RHSA-2015-0215.html This issue has been addressed in the following products: JBEAP 6.3.z for RHEL 6 Via RHSA-2015:0217 https://rhn.redhat.com/errata/RHSA-2015-0217.html This issue has been addressed in the following products: JBEAP 6.3.z for RHEL 5 Via RHSA-2015:0216 https://rhn.redhat.com/errata/RHSA-2015-0216.html This issue has been addressed in the following products: JBEAP 6.3.z for RHEL 7 Via RHSA-2015:0218 https://rhn.redhat.com/errata/RHSA-2015-0218.html This issue has been addressed in the following products: Via RHSA-2015:0920 https://rhn.redhat.com/errata/RHSA-2015-0920.html |