Bug 1976052 (CVE-2021-3644) - CVE-2021-3644 wildfly-core: Invalid Sensitivity Classification of Vault Expression
Summary: CVE-2021-3644 wildfly-core: Invalid Sensitivity Classification of Vault Expre...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-3644
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1932515
TreeView+ depends on / blocked
 
Reported: 2021-06-25 04:49 UTC by Ted Jongseok Won
Modified: 2021-09-23 16:30 UTC (History)
70 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly retrieve the item which was stored in the vault. The highest threat from this vulnerability is data confidentiality and integrity.
Clone Of:
Environment:
Last Closed: 2021-09-09 00:21:36 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:3466 0 None None None 2021-09-08 14:07:00 UTC
Red Hat Product Errata RHSA-2021:3467 0 None None None 2021-09-08 14:09:21 UTC
Red Hat Product Errata RHSA-2021:3468 0 None None None 2021-09-08 14:04:57 UTC
Red Hat Product Errata RHSA-2021:3471 0 None None None 2021-09-08 13:06:13 UTC
Red Hat Product Errata RHSA-2021:3516 0 None None None 2021-09-13 17:34:27 UTC
Red Hat Product Errata RHSA-2021:3534 0 None None None 2021-09-14 12:38:05 UTC
Red Hat Product Errata RHSA-2021:3656 0 None None None 2021-09-23 16:16:06 UTC
Red Hat Product Errata RHSA-2021:3658 0 None None None 2021-09-23 16:24:35 UTC
Red Hat Product Errata RHSA-2021:3660 0 None None None 2021-09-23 16:30:24 UTC

Description Ted Jongseok Won 2021-06-25 04:49:15 UTC
A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly retrieve the item which was stored in the vault. The highest threat from this vulnerability is data confidentiality and integrity.

Comment 5 Ted Jongseok Won 2021-07-15 01:57:45 UTC
This vulnerability is out of security support scope for the following products:
 * Red Hat Enterprise Application Platform 6
 * Red Hat JBoss Operations Network 3
 * Red Hat Data Grid 7
 * Red Hat JBoss Data Virtualization 6
 * Red Hat JBoss Fuse 6
 * Red Hat JBoss Fuse Service Works 6
 
Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.

Comment 13 errata-xmlrpc 2021-09-08 13:06:09 UTC
This issue has been addressed in the following products:

  EAP 7.3.9 release

Via RHSA-2021:3471 https://access.redhat.com/errata/RHSA-2021:3471

Comment 14 errata-xmlrpc 2021-09-08 14:04:54 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8

Via RHSA-2021:3468 https://access.redhat.com/errata/RHSA-2021:3468

Comment 15 errata-xmlrpc 2021-09-08 14:06:57 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6

Via RHSA-2021:3466 https://access.redhat.com/errata/RHSA-2021:3466

Comment 16 errata-xmlrpc 2021-09-08 14:09:17 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7

Via RHSA-2021:3467 https://access.redhat.com/errata/RHSA-2021:3467

Comment 17 Product Security DevOps Team 2021-09-09 00:21:36 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3644

Comment 18 errata-xmlrpc 2021-09-13 17:34:24 UTC
This issue has been addressed in the following products:

  Red Hat EAP-XP 2.0.0 via EAP 7.3.x base

Via RHSA-2021:3516 https://access.redhat.com/errata/RHSA-2021:3516

Comment 19 errata-xmlrpc 2021-09-14 12:38:00 UTC
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.4.9

Via RHSA-2021:3534 https://access.redhat.com/errata/RHSA-2021:3534

Comment 20 errata-xmlrpc 2021-09-23 16:16:02 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2021:3656 https://access.redhat.com/errata/RHSA-2021:3656

Comment 21 errata-xmlrpc 2021-09-23 16:24:32 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2021:3658 https://access.redhat.com/errata/RHSA-2021:3658

Comment 22 errata-xmlrpc 2021-09-23 16:30:20 UTC
This issue has been addressed in the following products:

  EAP 7.4.1 release

Via RHSA-2021:3660 https://access.redhat.com/errata/RHSA-2021:3660


Note You need to log in before you can comment on or make changes to this bug.