5.4
Medium
CVE-2019-3894 It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a…
Description
It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run the thread as. These threads do not necessarily terminate if the keep alive time has not expired. This could allow a shared thread to use the wrong security identity when executing.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| wildfly | Versions not published |
Other CVEs of wildfly
The 5 CVEs of wildfly →
CVE-2020-14297
A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction…
6.5
Medium
CVE-2020-14307
A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where…
6.5
Medium
CVE-2019-14887
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly…
7.4
High
CVE-2019-3805
A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d…
5.5
Medium