Bug 1834512 (CVE-2020-10740) - CVE-2020-10740 wildfly: unsafe deserialization in Wildfly Enterprise Java Beans
Summary: CVE-2020-10740 wildfly: unsafe deserialization in Wildfly Enterprise Java Beans
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-10740
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1842967
Blocks: 1817194
TreeView+ depends on / blocked
 
Reported: 2020-05-11 20:14 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-04-22 15:50 UTC (History)
79 users (show)

Fixed In Version: Wildfly 20.0.0.Final
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Wildfly. A remote deserialization attack is possible in the Enterprise Application Beans (EJB) due to lack of validation/filtering capabilities in wildfly. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availablity.
Clone Of:
Environment:
Last Closed: 2020-07-24 01:27:37 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:3141 0 None None None 2020-07-23 20:32:22 UTC
Red Hat Product Errata RHSA-2020:3142 0 None None None 2020-07-23 20:36:16 UTC
Red Hat Product Errata RHSA-2020:3143 0 None None None 2020-07-23 20:20:47 UTC
Red Hat Product Errata RHSA-2020:3144 0 None None None 2020-07-23 20:21:07 UTC
Red Hat Product Errata RHSA-2020:3461 0 None None None 2020-08-17 13:28:55 UTC
Red Hat Product Errata RHSA-2020:3462 0 None None None 2020-08-17 13:31:06 UTC
Red Hat Product Errata RHSA-2020:3463 0 None None None 2020-08-17 13:34:38 UTC
Red Hat Product Errata RHSA-2020:3464 0 None None None 2020-08-17 13:26:36 UTC
Red Hat Product Errata RHSA-2020:3501 0 None None None 2020-08-18 16:35:45 UTC
Red Hat Product Errata RHSA-2020:3539 0 None None None 2020-09-02 09:48:00 UTC
Red Hat Product Errata RHSA-2020:3585 0 None None None 2020-08-31 15:41:24 UTC
Red Hat Product Errata RHSA-2020:3637 0 None None None 2020-09-07 12:57:06 UTC
Red Hat Product Errata RHSA-2020:3638 0 None None None 2020-09-07 13:03:15 UTC
Red Hat Product Errata RHSA-2020:3639 0 None None None 2020-09-07 13:00:02 UTC
Red Hat Product Errata RHSA-2020:3642 0 None None None 2020-09-07 13:08:15 UTC
Red Hat Product Errata RHSA-2020:5568 0 None None None 2020-12-16 12:13:53 UTC

Description Guilherme de Almeida Suckevicz 2020-05-11 20:14:24 UTC 
It was found a flaw in Wildfly where the lack of input validation/filtering capabilities applications running on the application server using it's JNDI or EJB features are left vulnerable to deserialization attacks.
Comment 11 Guilherme de Almeida Suckevicz 2020-06-02 13:03:37 UTC 
Acknowledgments:

Name: Moritz Bechler (SySS GmbH)
Comment 12 Guilherme de Almeida Suckevicz 2020-06-02 13:11:40 UTC 
Created wildfly tracking bugs for this issue:

Affects: fedora-all [bug 1842967]
Comment 17 errata-xmlrpc 2020-07-23 20:20:43 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2020:3143 https://access.redhat.com/errata/RHSA-2020:3143
Comment 18 errata-xmlrpc 2020-07-23 20:21:03 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2020:3144 https://access.redhat.com/errata/RHSA-2020:3144
Comment 19 errata-xmlrpc 2020-07-23 20:32:18 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6
  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8

Via RHSA-2020:3141 https://access.redhat.com/errata/RHSA-2020:3141
Comment 20 errata-xmlrpc 2020-07-23 20:35:58 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8

Via RHSA-2020:3142 https://access.redhat.com/errata/RHSA-2020:3142
Comment 21 Product Security DevOps Team 2020-07-24 01:27:37 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-10740
Comment 22 Product Security DevOps Team 2020-07-24 07:27:38 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-10740
Comment 23 Jonathan Christison 2020-08-12 12:16:47 UTC 
Marking Red Hat Jboss Fuse 6 and Red Hat Fuse 7 as having a low impact, in both instances a vulnerable artifact is distributed with the maven repository but it is not used.
Comment 24 Jonathan Christison 2020-08-12 13:00:52 UTC 
This vulnerability is out of security support scope for the following products:
 * Red Hat JBoss Fuse 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
Comment 25 errata-xmlrpc 2020-08-17 13:26:32 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2020:3464 https://access.redhat.com/errata/RHSA-2020:3464
Comment 26 errata-xmlrpc 2020-08-17 13:28:51 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6

Via RHSA-2020:3461 https://access.redhat.com/errata/RHSA-2020:3461
Comment 27 errata-xmlrpc 2020-08-17 13:31:02 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7

Via RHSA-2020:3462 https://access.redhat.com/errata/RHSA-2020:3462
Comment 28 errata-xmlrpc 2020-08-17 13:34:35 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8

Via RHSA-2020:3463 https://access.redhat.com/errata/RHSA-2020:3463
Comment 29 errata-xmlrpc 2020-08-18 16:35:42 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.4.2

Via RHSA-2020:3501 https://access.redhat.com/errata/RHSA-2020:3501
Comment 31 Chess Hazlett 2020-08-26 17:51:20 UTC 
Mitigation:

There is currently no known mitigation for this issue.
Comment 33 errata-xmlrpc 2020-08-31 15:41:19 UTC 
This issue has been addressed in the following products:

  EAP-CD 20 Tech Preview

Via RHSA-2020:3585 https://access.redhat.com/errata/RHSA-2020:3585
Comment 34 errata-xmlrpc 2020-09-02 09:47:55 UTC 
This issue has been addressed in the following products:

  Red Hat Openshift Application Runtimes

Via RHSA-2020:3539 https://access.redhat.com/errata/RHSA-2020:3539
Comment 35 errata-xmlrpc 2020-09-07 12:56:59 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

Via RHSA-2020:3637 https://access.redhat.com/errata/RHSA-2020:3637
Comment 36 errata-xmlrpc 2020-09-07 12:59:55 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8

Via RHSA-2020:3639 https://access.redhat.com/errata/RHSA-2020:3639
Comment 37 errata-xmlrpc 2020-09-07 13:03:08 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

Via RHSA-2020:3638 https://access.redhat.com/errata/RHSA-2020:3638
Comment 38 errata-xmlrpc 2020-09-07 13:08:09 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2020:3642 https://access.redhat.com/errata/RHSA-2020:3642
Comment 39 errata-xmlrpc 2020-12-16 12:13:49 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse 7.8.0

Via RHSA-2020:5568 https://access.redhat.com/errata/RHSA-2020:5568
Note You need to log in before you can comment on or make changes to this bug.