Bug 1976052 (CVE-2021-3644) - CVE-2021-3644 wildfly-core: Invalid Sensitivity Classification of Vault Expression
Summary: CVE-2021-3644 wildfly-core: Invalid Sensitivity Classification of Vault Expre...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-3644
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1932515
TreeView+ depends on / blocked
 
Reported: 2021-06-25 04:49 UTC by Ted Jongseok Won
Modified: 2024-02-06 04:50 UTC (History)
70 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly retrieve the item which was stored in the vault. The highest threat from this vulnerability is data confidentiality and integrity.
Clone Of:
Environment:
Last Closed: 2021-09-09 00:21:36 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:3466 0 None None None 2021-09-08 14:07:00 UTC
Red Hat Product Errata RHSA-2021:3467 0 None None None 2021-09-08 14:09:21 UTC
Red Hat Product Errata RHSA-2021:3468 0 None None None 2021-09-08 14:04:57 UTC
Red Hat Product Errata RHSA-2021:3471 0 None None None 2021-09-08 13:06:13 UTC
Red Hat Product Errata RHSA-2021:3516 0 None None None 2021-09-13 17:34:27 UTC
Red Hat Product Errata RHSA-2021:3534 0 None None None 2021-09-14 12:38:05 UTC
Red Hat Product Errata RHSA-2021:3656 0 None None None 2021-09-23 16:16:06 UTC
Red Hat Product Errata RHSA-2021:3658 0 None None None 2021-09-23 16:24:35 UTC
Red Hat Product Errata RHSA-2021:3660 0 None None None 2021-09-23 16:30:24 UTC
Red Hat Product Errata RHSA-2022:5532 0 None None None 2022-07-07 14:20:34 UTC
Red Hat Product Errata RHSA-2022:5903 0 None None None 2022-08-04 04:46:47 UTC

Description Ted Jongseok Won 2021-06-25 04:49:15 UTC 
A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly retrieve the item which was stored in the vault. The highest threat from this vulnerability is data confidentiality and integrity.
Comment 5 Ted Jongseok Won 2021-07-15 01:57:45 UTC 
This vulnerability is out of security support scope for the following products:
 * Red Hat Enterprise Application Platform 6
 * Red Hat JBoss Operations Network 3
 * Red Hat Data Grid 7
 * Red Hat JBoss Data Virtualization 6
 * Red Hat JBoss Fuse 6
 * Red Hat JBoss Fuse Service Works 6
 
Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
Comment 13 errata-xmlrpc 2021-09-08 13:06:09 UTC 
This issue has been addressed in the following products:

  EAP 7.3.9 release

Via RHSA-2021:3471 https://access.redhat.com/errata/RHSA-2021:3471
Comment 14 errata-xmlrpc 2021-09-08 14:04:54 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8

Via RHSA-2021:3468 https://access.redhat.com/errata/RHSA-2021:3468
Comment 15 errata-xmlrpc 2021-09-08 14:06:57 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6

Via RHSA-2021:3466 https://access.redhat.com/errata/RHSA-2021:3466
Comment 16 errata-xmlrpc 2021-09-08 14:09:17 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7

Via RHSA-2021:3467 https://access.redhat.com/errata/RHSA-2021:3467
Comment 17 Product Security DevOps Team 2021-09-09 00:21:36 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3644
Comment 18 errata-xmlrpc 2021-09-13 17:34:24 UTC 
This issue has been addressed in the following products:

  Red Hat EAP-XP 2.0.0 via EAP 7.3.x base

Via RHSA-2021:3516 https://access.redhat.com/errata/RHSA-2021:3516
Comment 19 errata-xmlrpc 2021-09-14 12:38:00 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.4.9

Via RHSA-2021:3534 https://access.redhat.com/errata/RHSA-2021:3534
Comment 20 errata-xmlrpc 2021-09-23 16:16:02 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2021:3656 https://access.redhat.com/errata/RHSA-2021:3656
Comment 21 errata-xmlrpc 2021-09-23 16:24:32 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2021:3658 https://access.redhat.com/errata/RHSA-2021:3658
Comment 22 errata-xmlrpc 2021-09-23 16:30:20 UTC 
This issue has been addressed in the following products:

  EAP 7.4.1 release

Via RHSA-2021:3660 https://access.redhat.com/errata/RHSA-2021:3660
Comment 23 errata-xmlrpc 2022-07-07 14:20:31 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse 7.11

Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532
Comment 24 errata-xmlrpc 2022-08-04 04:46:43 UTC 
This issue has been addressed in the following products:

  RHPAM 7.13.0 async

Via RHSA-2022:5903 https://access.redhat.com/errata/RHSA-2022:5903
Note You need to log in before you can comment on or make changes to this bug.