Bug 1834512 (CVE-2020-10740)

Summary: CVE-2020-10740 wildfly: unsafe deserialization in Wildfly Enterprise Java Beans
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aboyko, aileenc, akoufoud, alazarot, almorale, anstephe, aschwart, asoldano, atangrin, avibelli, bbaranow, bgeorges, bmaxwell, boliveir, brian.stansberry, cdewolf, chazlett, darran.lofthouse, dhanak, dingyichen, dkreling, dosoudil, drieden, drosa, etirelli, extras-orphan, fjuma, fnasser, ggaughan, gmalinko, gvarsami, ibek, istudens, ivassile, iweiss, janstey, jason.greene, jawilson, jbalunas, jboss-set, jcoleman, jochrist, jolee, jpallich, jperkins, jrokos, jschatte, jstastny, jwon, kconner, krathod, kverlaen, kwills, ldimaggi, lef, lgao, loleary, lthon, mnovotny, mosmerov, mposolda, msochure, msvehla, mszynkie, nwallace, paradhya, pdelbell, pdrozd, pesilva, pgallagh, pjindal, pmackay, psotirop, puntogil, rguimara, rrajasek, rruss, rstancel, rstepani, rsvoboda, rsynek, rwagner, sausingh, sdaley, security-response-team, smaestri, spinder, ssilvert, sthorger, tcunning, theute, tkirby, tom.jenkinson, vhalbert, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Wildfly 20.0.0.Final Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Wildfly. A remote deserialization attack is possible in the Enterprise Application Beans (EJB) due to lack of validation/filtering capabilities in wildfly. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availablity.
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-07-24 01:27:37 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1842967    
Bug Blocks: 1817194    

Description Guilherme de Almeida Suckevicz 2020-05-11 20:14:24 UTC
It was found a flaw in Wildfly where the lack of input validation/filtering capabilities applications running on the application server using it's JNDI or EJB features are left vulnerable to deserialization attacks.

Comment 11 Guilherme de Almeida Suckevicz 2020-06-02 13:03:37 UTC
Acknowledgments:

Name: Moritz Bechler (SySS GmbH)

Comment 12 Guilherme de Almeida Suckevicz 2020-06-02 13:11:40 UTC
Created wildfly tracking bugs for this issue:

Affects: fedora-all [bug 1842967]

Comment 17 errata-xmlrpc 2020-07-23 20:20:43 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2020:3143 https://access.redhat.com/errata/RHSA-2020:3143

Comment 18 errata-xmlrpc 2020-07-23 20:21:03 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2020:3144 https://access.redhat.com/errata/RHSA-2020:3144

Comment 19 errata-xmlrpc 2020-07-23 20:32:18 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6
  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8

Via RHSA-2020:3141 https://access.redhat.com/errata/RHSA-2020:3141

Comment 20 errata-xmlrpc 2020-07-23 20:35:58 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8

Via RHSA-2020:3142 https://access.redhat.com/errata/RHSA-2020:3142

Comment 21 Product Security DevOps Team 2020-07-24 01:27:37 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-10740

Comment 22 Product Security DevOps Team 2020-07-24 07:27:38 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-10740

Comment 23 Jonathan Christison 2020-08-12 12:16:47 UTC
Marking Red Hat Jboss Fuse 6 and Red Hat Fuse 7 as having a low impact, in both instances a vulnerable artifact is distributed with the maven repository but it is not used.

Comment 24 Jonathan Christison 2020-08-12 13:00:52 UTC
This vulnerability is out of security support scope for the following products:
 * Red Hat JBoss Fuse 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.

Comment 25 errata-xmlrpc 2020-08-17 13:26:32 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2020:3464 https://access.redhat.com/errata/RHSA-2020:3464

Comment 26 errata-xmlrpc 2020-08-17 13:28:51 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6

Via RHSA-2020:3461 https://access.redhat.com/errata/RHSA-2020:3461

Comment 27 errata-xmlrpc 2020-08-17 13:31:02 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7

Via RHSA-2020:3462 https://access.redhat.com/errata/RHSA-2020:3462

Comment 28 errata-xmlrpc 2020-08-17 13:34:35 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8

Via RHSA-2020:3463 https://access.redhat.com/errata/RHSA-2020:3463

Comment 29 errata-xmlrpc 2020-08-18 16:35:42 UTC
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.4.2

Via RHSA-2020:3501 https://access.redhat.com/errata/RHSA-2020:3501

Comment 31 Chess Hazlett 2020-08-26 17:51:20 UTC
Mitigation:

There is currently no known mitigation for this issue.

Comment 33 errata-xmlrpc 2020-08-31 15:41:19 UTC
This issue has been addressed in the following products:

  EAP-CD 20 Tech Preview

Via RHSA-2020:3585 https://access.redhat.com/errata/RHSA-2020:3585

Comment 34 errata-xmlrpc 2020-09-02 09:47:55 UTC
This issue has been addressed in the following products:

  Red Hat Openshift Application Runtimes

Via RHSA-2020:3539 https://access.redhat.com/errata/RHSA-2020:3539

Comment 35 errata-xmlrpc 2020-09-07 12:56:59 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

Via RHSA-2020:3637 https://access.redhat.com/errata/RHSA-2020:3637

Comment 36 errata-xmlrpc 2020-09-07 12:59:55 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8

Via RHSA-2020:3639 https://access.redhat.com/errata/RHSA-2020:3639

Comment 37 errata-xmlrpc 2020-09-07 13:03:08 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

Via RHSA-2020:3638 https://access.redhat.com/errata/RHSA-2020:3638

Comment 38 errata-xmlrpc 2020-09-07 13:08:09 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2020:3642 https://access.redhat.com/errata/RHSA-2020:3642

Comment 39 errata-xmlrpc 2020-12-16 12:13:49 UTC
This issue has been addressed in the following products:

  Red Hat Fuse 7.8.0

Via RHSA-2020:5568 https://access.redhat.com/errata/RHSA-2020:5568

Comment 41 errata-xmlrpc 2025-06-25 00:19:07 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

Via RHSA-2025:9582 https://access.redhat.com/errata/RHSA-2025:9582