CVE-2019-3894 - wildfly: wrong SecurityIdentity for EE concurrency threads that are reused

Back Back to CVE browser

HIGH

wildfly: wrong SecurityIdentity for EE concurrency threads that are reused

Published May 3, 2019

8.8

HIGH

CVSS 3.1

EPSS 1.48%

Description

It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run the thread as. These threads do not necessarily terminate if the keep alive time has not expired. This could allow a shared thread to use the wrong security identity when executing.

Affected products

Vendor Red Hat Product Wildfly Default
n/a
- Version
  affects from 11 to 16
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Red Hat

Wildfly

n/a

Version	Status	Constraints
affects from 11 to 16	affected	-

Red Hat JBoss EAP 7.2

wildfly

Fixed · RHSA-2019:1106
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-activemq-artemis-0:2.6.3-5.redhat_00020.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-apache-commons-lang-0:3.8.0-1.redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-apache-cxf-0:3.2.7-1.redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-apache-cxf-xjc-utils-0:3.2.3-2.redhat_00002.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-artemis-native-0:2.6.3-15.redhat_00020.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-byte-buddy-0:1.9.5-1.redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-dom4j-0:2.1.1-2.redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-elytron-web-0:1.2.4-1.Final_redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-hibernate-0:5.3.9-2.Final_redhat_00002.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-httpcomponents-asyncclient-0:4.1.4-1.redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-infinispan-0:9.3.6-1.Final_redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-ironjacamar-0:1.4.15-1.Final_redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-jackson-annotations-0:2.9.8-2.redhat_00004.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-jackson-core-0:2.9.8-2.redhat_00004.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-jackson-databind-0:2.9.8-2.redhat_00004.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-jackson-jaxrs-providers-0:2.9.8-2.redhat_00004.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-jackson-modules-base-0:2.9.8-1.redhat_00004.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-jackson-modules-java8-0:2.9.8-1.redhat_00004.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-jberet-0:1.3.2-1.Final_redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-jboss-ejb-client-0:4.0.15-1.Final_redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-jboss-el-api_3.0_spec-0:1.0.13-2.Final_redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-jboss-genericjms-0:2.0.1-2.Final_redhat_00002.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-jboss-logmanager-0:2.1.7-3.Final_redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-jboss-remoting-jmx-0:3.0.1-1.Final_redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-jboss-security-negotiation-0:3.0.5-2.Final_redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-jboss-server-migration-0:1.3.0-7.Final_redhat_00004.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-narayana-0:5.9.1-1.Final_redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-picketlink-bindings-0:2.5.5-16.SP12_redhat_4.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-picketlink-federation-0:2.5.5-16.SP12_redhat_4.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-resteasy-0:3.6.1-4.SP3_redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-sun-istack-commons-0:3.0.7-2.redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-undertow-0:2.0.19-1.Final_redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-undertow-jastow-0:2.0.7-2.Final_redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-wildfly-0:7.2.1-6.GA_redhat_00004.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-wildfly-elytron-0:1.6.2-1.Final_redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-wildfly-elytron-tool-0:1.4.1-1.Final_redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-wildfly-http-client-0:1.0.13-1.Final_redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-wildfly-transaction-client-0:1.1.3-1.Final_redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

eap7-yasson-0:1.0.2-1.redhat_00001.1.el6eap

Fixed · RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-activemq-artemis-0:2.6.3-5.redhat_00020.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-apache-commons-lang-0:3.8.0-1.redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-apache-cxf-0:3.2.7-1.redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-apache-cxf-xjc-utils-0:3.2.3-2.redhat_00002.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-artemis-native-0:2.6.3-15.redhat_00020.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-byte-buddy-0:1.9.5-1.redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-dom4j-0:2.1.1-2.redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-elytron-web-0:1.2.4-1.Final_redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-hibernate-0:5.3.9-2.Final_redhat_00002.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-httpcomponents-asyncclient-0:4.1.4-1.redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-infinispan-0:9.3.6-1.Final_redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-ironjacamar-0:1.4.15-1.Final_redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-jackson-annotations-0:2.9.8-2.redhat_00004.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-jackson-core-0:2.9.8-2.redhat_00004.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-jackson-databind-0:2.9.8-2.redhat_00004.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-jackson-jaxrs-providers-0:2.9.8-2.redhat_00004.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-jackson-modules-base-0:2.9.8-1.redhat_00004.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-jackson-modules-java8-0:2.9.8-1.redhat_00004.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-jberet-0:1.3.2-1.Final_redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-jboss-ejb-client-0:4.0.15-1.Final_redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-jboss-el-api_3.0_spec-0:1.0.13-2.Final_redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-jboss-genericjms-0:2.0.1-2.Final_redhat_00002.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-jboss-logmanager-0:2.1.7-3.Final_redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-jboss-remoting-jmx-0:3.0.1-1.Final_redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-jboss-security-negotiation-0:3.0.5-2.Final_redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-jboss-server-migration-0:1.3.0-7.Final_redhat_00004.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-narayana-0:5.9.1-1.Final_redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-picketlink-bindings-0:2.5.5-16.SP12_redhat_4.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-picketlink-federation-0:2.5.5-16.SP12_redhat_4.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-resteasy-0:3.6.1-4.SP3_redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-sun-istack-commons-0:3.0.7-2.redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-undertow-0:2.0.19-1.Final_redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-undertow-jastow-0:2.0.7-2.Final_redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-wildfly-0:7.2.1-6.GA_redhat_00004.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-wildfly-elytron-0:1.6.2-1.Final_redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-wildfly-elytron-tool-0:1.4.1-1.Final_redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-wildfly-http-client-0:1.0.13-1.Final_redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-wildfly-transaction-client-0:1.1.3-1.Final_redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

eap7-yasson-0:1.0.2-1.redhat_00001.1.el7eap

Fixed · RHSA-2019:1108
Red Hat Single Sign-On 7.3.1 zip

n/a

Fixed · RHSA-2019:1140

Product	Package	State	Advisory
Red Hat JBoss EAP 7.2	wildfly	Fixed	RHSA-2019:1106
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-activemq-artemis-0:2.6.3-5.redhat_00020.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-apache-commons-lang-0:3.8.0-1.redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-apache-cxf-0:3.2.7-1.redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-apache-cxf-xjc-utils-0:3.2.3-2.redhat_00002.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-artemis-native-0:2.6.3-15.redhat_00020.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-byte-buddy-0:1.9.5-1.redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-dom4j-0:2.1.1-2.redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-elytron-web-0:1.2.4-1.Final_redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-hibernate-0:5.3.9-2.Final_redhat_00002.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-httpcomponents-asyncclient-0:4.1.4-1.redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-infinispan-0:9.3.6-1.Final_redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-ironjacamar-0:1.4.15-1.Final_redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-jackson-annotations-0:2.9.8-2.redhat_00004.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-jackson-core-0:2.9.8-2.redhat_00004.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-jackson-databind-0:2.9.8-2.redhat_00004.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-jackson-jaxrs-providers-0:2.9.8-2.redhat_00004.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-jackson-modules-base-0:2.9.8-1.redhat_00004.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-jackson-modules-java8-0:2.9.8-1.redhat_00004.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-jberet-0:1.3.2-1.Final_redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-jboss-ejb-client-0:4.0.15-1.Final_redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-jboss-el-api_3.0_spec-0:1.0.13-2.Final_redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-jboss-genericjms-0:2.0.1-2.Final_redhat_00002.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-jboss-logmanager-0:2.1.7-3.Final_redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-jboss-remoting-jmx-0:3.0.1-1.Final_redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-jboss-security-negotiation-0:3.0.5-2.Final_redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-jboss-server-migration-0:1.3.0-7.Final_redhat_00004.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-narayana-0:5.9.1-1.Final_redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-picketlink-bindings-0:2.5.5-16.SP12_redhat_4.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-picketlink-federation-0:2.5.5-16.SP12_redhat_4.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-resteasy-0:3.6.1-4.SP3_redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-sun-istack-commons-0:3.0.7-2.redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-undertow-0:2.0.19-1.Final_redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-undertow-jastow-0:2.0.7-2.Final_redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-wildfly-0:7.2.1-6.GA_redhat_00004.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-wildfly-elytron-0:1.6.2-1.Final_redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-wildfly-elytron-tool-0:1.4.1-1.Final_redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-wildfly-http-client-0:1.0.13-1.Final_redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-wildfly-transaction-client-0:1.1.3-1.Final_redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6	eap7-yasson-0:1.0.2-1.redhat_00001.1.el6eap	Fixed	RHSA-2019:1107
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-activemq-artemis-0:2.6.3-5.redhat_00020.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-apache-commons-lang-0:3.8.0-1.redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-apache-cxf-0:3.2.7-1.redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-apache-cxf-xjc-utils-0:3.2.3-2.redhat_00002.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-artemis-native-0:2.6.3-15.redhat_00020.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-byte-buddy-0:1.9.5-1.redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-dom4j-0:2.1.1-2.redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-elytron-web-0:1.2.4-1.Final_redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-hibernate-0:5.3.9-2.Final_redhat_00002.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-httpcomponents-asyncclient-0:4.1.4-1.redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-infinispan-0:9.3.6-1.Final_redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-ironjacamar-0:1.4.15-1.Final_redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-jackson-annotations-0:2.9.8-2.redhat_00004.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-jackson-core-0:2.9.8-2.redhat_00004.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-jackson-databind-0:2.9.8-2.redhat_00004.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-jackson-jaxrs-providers-0:2.9.8-2.redhat_00004.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-jackson-modules-base-0:2.9.8-1.redhat_00004.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-jackson-modules-java8-0:2.9.8-1.redhat_00004.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-jberet-0:1.3.2-1.Final_redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-jboss-ejb-client-0:4.0.15-1.Final_redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-jboss-el-api_3.0_spec-0:1.0.13-2.Final_redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-jboss-genericjms-0:2.0.1-2.Final_redhat_00002.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-jboss-logmanager-0:2.1.7-3.Final_redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-jboss-remoting-jmx-0:3.0.1-1.Final_redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-jboss-security-negotiation-0:3.0.5-2.Final_redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-jboss-server-migration-0:1.3.0-7.Final_redhat_00004.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-narayana-0:5.9.1-1.Final_redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-picketlink-bindings-0:2.5.5-16.SP12_redhat_4.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-picketlink-federation-0:2.5.5-16.SP12_redhat_4.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-resteasy-0:3.6.1-4.SP3_redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-sun-istack-commons-0:3.0.7-2.redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-undertow-0:2.0.19-1.Final_redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-undertow-jastow-0:2.0.7-2.Final_redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-wildfly-0:7.2.1-6.GA_redhat_00004.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-wildfly-elytron-0:1.6.2-1.Final_redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-wildfly-elytron-tool-0:1.4.1-1.Final_redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-wildfly-http-client-0:1.0.13-1.Final_redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-wildfly-transaction-client-0:1.1.3-1.Final_redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7	eap7-yasson-0:1.0.2-1.redhat_00001.1.el7eap	Fixed	RHSA-2019:1108
Red Hat Single Sign-On 7.3.1 zip	n/a	Fixed	RHSA-2019:1140

Remediation

No remediation recorded yet.

Metrics

1.48% 0.01481

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.01481

Score over time

2021-2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Table of values (15 key points)

Flat stretches are collapsed. Showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	1.48% (0.01481)	73.04th	v5 (v2026.06.15)
Jun 15, 2026	1.51% (0.01509)	71.01th	v5 (v2026.06.15)
Mar 17, 2025	1.23% (0.01229)	77.78th	v4 (v2025.03.14)
Dec 17, 2024	0.42% (0.00424)	73.98th	v3 (v2023.03.01)
Apr 26, 2024	0.64% (0.00636)	78.88th	v3 (v2023.03.01)
Feb 8, 2024	0.44% (0.00441)	74.11th	v3 (v2023.03.01)
Sep 3, 2023	0.44% (0.00441)	71.67th	v3 (v2023.03.01)
Mar 7, 2023	0.33% (0.00328)	66.28th	v3 (v2023.03.01)
Mar 6, 2023	1.03% (0.01034)	41.69th	v2 (v2022.01.01)
Apr 1, 2022	1.03% (0.01034)	37.91th	v2 (v2022.01.01)
Feb 4, 2022	11.57% (0.11569)	88.81th	v2 (v2022.01.01)
Feb 3, 2022	6.21% (0.06208)	81.93th	v1
Jan 6, 2022	6.21% (0.06208)	81.75th	v1
Jan 5, 2022	1.45% (0.01454)	72.86th	v5 (v2026.06.15)
Apr 14, 2021	1.45% (0.01454)	0.00th	v1

Weaknesses (1)

CWE-358

References (10)

https://access.redhat.com/errata/RHSA-2019:1106
vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/errata/RHSA-2019:1107
vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/errata/RHSA-2019:1108
vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/errata/RHSA-2019:1140
vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/security/cve/CVE-2019-3894
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1682108
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3894
x_refsource_CONFIRMIssue TrackingVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-3894
https://security.netapp.com/advisory/ntap-20190517-0004/
x_refsource_CONFIRMThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-3894

Link	Providers	Tags
https://access.redhat.com/errata/RHSA-2019:1106		vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/errata/RHSA-2019:1107		vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/errata/RHSA-2019:1108		vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/errata/RHSA-2019:1140		vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/security/cve/CVE-2019-3894		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1682108		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3894		x_refsource_CONFIRMIssue TrackingVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-3894
https://security.netapp.com/advisory/ntap-20190517-0004/		x_refsource_CONFIRMThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-3894

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner redhat

Published May 3, 2019

Updated Aug 4, 2024

Reserved Jan 3, 2019

Link CVE-2019-3894

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-3894

Red Hat

Severity Moderate

Public date Apr 30, 2019

Links CVE-2019-3894 - Bugzilla