CVE-2019-3894

It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run the thread as. These threads do not necessarily terminate if the keep alive time has not expired. This could allow a shared thread to use the wrong security identity when executing.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "last_affected": "7.0.0"
                }
            ],
            "vendor_product": "redhat:jboss_enterprise_application_platform"
        }
    ]
}

References

Affected packages

Git / github.com/wildfly/wildfly

Affected ranges

Type

GIT

Repo

https://github.com/wildfly/wildfly

Events

Introduced

4fd7bffaf2ee73201910684f2674aa1bced7fe81

Last affected

54c3af2a8dfed3621826094ec07ff861a6425107

Database specific

{
    "cpe": "cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "11.0.0"
        },
        {
            "last_affected": "16.0.0"
        }
    ]
}

Affected versions

11.*

11.0.0.Final

12.*

12.0.0.Beta1

12.0.0.CR1

12.0.0.Final

13.*

13.0.0.Beta1

14.*

14.0.0.Beta1

14.0.0.Beta2

14.0.0.Final

15.*

15.0.0.Beta1

15.0.0.Final

16.*

16.0.0.Beta1

16.0.0.Final

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-3894.json"