Every CVE Search/ Get API key

CVE-2022-0866

This is a concurrency issue that can result in the wrong caller principal being returned from the...

5.3 MediumFix available

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.90%Unchanged since May 11, 2022
90%50%10%1%

What each source reports

NVD Score used 5.3

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.

Record
CVE-2022-0866
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
CVE List No score

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.

Record
CVE-2022-0866
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2022-15908 No score

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.

Record
EUVD-2022-15908
Updated
2026-11-03
GitHub AdvisoriesGHSA-pjxg-p9c7-7c3v 5.3

This is a concurrency issue that can result in the wrong caller principal being returned from the...

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.

Record
GHSA-pjxg-p9c7-7c3v
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
OSVRHSA-2022:4918 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 7

Record
RHSA-2022:4918
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:4919 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 8

Record
RHSA-2022:4919
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVRHSA-2022:6782 9.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.5.3 security update on RHEL 7

Record
RHSA-2022:6782
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:6783 9.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.5.3 security update on RHEL 8

Record
RHSA-2022:6783
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:7409 9.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 7

Record
RHSA-2022:7409
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:7410 9.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 8

Record
RHSA-2022:7410
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:7411 9.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 9

Record
RHSA-2022:7411
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBIT-wildfly-2022-0866 No score

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.

Record
BIT-wildfly-2022-0866
Updated
2026-11-02
OSV No score

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.

Record
CVE-2022-0866
Weakness
CWE-863
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wildfly
Bitnami
 11.0.0 up to 26.1.1
26.1.1
eap7-jackson-databind
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:2.12.6.1-1.redhat_00003.1.el7eap
0:2.12.6.1-1.redhat_00003.1.el7eap
eap7-netty
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-all
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-buffer
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec-dns
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec-haproxy
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec-http
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec-http2
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
Show 124 moreShow less
Affected packages
PackageAffectedFixed
eap7-netty-codec-memcache
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec-mqtt
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec-redis
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec-smtp
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec-socks
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec-stomp
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-codec-xml
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-common
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-handler
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-handler-proxy
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-resolver
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-resolver-dns
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-resolver-dns-classes-macos
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-transport
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-transport-classes-epoll
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-transport-classes-kqueue
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-transport-native-unix-common
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-transport-rxtx
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-transport-sctp
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-netty-transport-udt
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el7eap
0:4.1.72-4.Final_redhat_00001.1.el7eap
eap7-h2database
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:1.4.197-2.redhat_00004.1.el7eap
0:1.4.197-2.redhat_00004.1.el7eap
eap7-jboss-xnio-base
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:3.8.7-1.SP1_redhat_00001.1.el7eap
0:3.8.7-1.SP1_redhat_00001.1.el7eap
eap7-wildfly-http-client
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:1.1.11-1.SP1_redhat_00001.1.el7eap
0:1.1.11-1.SP1_redhat_00001.1.el7eap
eap7-wildfly-http-client-common
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:1.1.11-1.SP1_redhat_00001.1.el7eap
0:1.1.11-1.SP1_redhat_00001.1.el7eap
eap7-wildfly-http-ejb-client
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:1.1.11-1.SP1_redhat_00001.1.el7eap
0:1.1.11-1.SP1_redhat_00001.1.el7eap
eap7-wildfly-http-naming-client
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:1.1.11-1.SP1_redhat_00001.1.el7eap
0:1.1.11-1.SP1_redhat_00001.1.el7eap
eap7-wildfly-http-transaction-client
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:1.1.11-1.SP1_redhat_00001.1.el7eap
0:1.1.11-1.SP1_redhat_00001.1.el7eap
eap7-wildfly
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:7.4.5-3.GA_redhat_00001.1.el7eap
0:7.4.5-3.GA_redhat_00001.1.el7eap
eap7-wildfly-java-jdk11
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:7.4.5-3.GA_redhat_00001.1.el7eap
0:7.4.5-3.GA_redhat_00001.1.el7eap
eap7-wildfly-java-jdk8
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:7.4.5-3.GA_redhat_00001.1.el7eap
0:7.4.5-3.GA_redhat_00001.1.el7eap
eap7-wildfly-javadocs
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:7.4.5-3.GA_redhat_00001.1.el7eap
0:7.4.5-3.GA_redhat_00001.1.el7eap
eap7-wildfly-modules
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:7.4.5-3.GA_redhat_00001.1.el7eap
0:7.4.5-3.GA_redhat_00001.1.el7eap
eap7-undertow
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:2.2.17-2.SP4_redhat_00001.1.el7eap
0:2.2.17-2.SP4_redhat_00001.1.el7eap
eap7-xerces-j2
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:2.12.0-3.SP04_redhat_00001.1.el7eap
0:2.12.0-3.SP04_redhat_00001.1.el7eap
eap7-activemq-artemis
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-cli
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-commons
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-core-client
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-dto
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-hornetq-protocol
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-hqclient-protocol
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-jdbc-store
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-jms-client
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-jms-server
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-journal
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-ra
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-selector
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-server
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-service-extensions
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-activemq-artemis-tools
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el7eap
0:2.16.0-9.redhat_00042.1.el7eap
eap7-hal-console
Red Hat:jboss_enterprise_application_platform:7.4::el7
From an advisory covering 14 CVEs
 before 0:3.3.12-1.Final_redhat_00001.1.el7eap
0:3.3.12-1.Final_redhat_00001.1.el7eap
eap7-jackson-databind
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:2.12.6.1-1.redhat_00003.1.el8eap
0:2.12.6.1-1.redhat_00003.1.el8eap
eap7-netty
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-all
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-buffer
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-dns
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-haproxy
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-http
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-http2
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-memcache
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-mqtt
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-redis
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-smtp
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-socks
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-stomp
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-codec-xml
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-common
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-handler
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-handler-proxy
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-resolver
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-resolver-dns
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-resolver-dns-classes-macos
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-transport
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-transport-classes-epoll
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-transport-classes-kqueue
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-transport-native-unix-common
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-transport-rxtx
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-transport-sctp
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-netty-transport-udt
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:4.1.72-4.Final_redhat_00001.1.el8eap
0:4.1.72-4.Final_redhat_00001.1.el8eap
eap7-h2database
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:1.4.197-2.redhat_00004.1.el8eap
0:1.4.197-2.redhat_00004.1.el8eap
eap7-jboss-xnio-base
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:3.8.7-1.SP1_redhat_00001.1.el8eap
0:3.8.7-1.SP1_redhat_00001.1.el8eap
eap7-wildfly-http-client
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:1.1.11-1.SP1_redhat_00001.1.el8eap
0:1.1.11-1.SP1_redhat_00001.1.el8eap
eap7-wildfly-http-client-common
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:1.1.11-1.SP1_redhat_00001.1.el8eap
0:1.1.11-1.SP1_redhat_00001.1.el8eap
eap7-wildfly-http-ejb-client
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:1.1.11-1.SP1_redhat_00001.1.el8eap
0:1.1.11-1.SP1_redhat_00001.1.el8eap
eap7-wildfly-http-naming-client
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:1.1.11-1.SP1_redhat_00001.1.el8eap
0:1.1.11-1.SP1_redhat_00001.1.el8eap
eap7-wildfly-http-transaction-client
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:1.1.11-1.SP1_redhat_00001.1.el8eap
0:1.1.11-1.SP1_redhat_00001.1.el8eap
eap7-wildfly
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:7.4.5-3.GA_redhat_00001.1.el8eap
0:7.4.5-3.GA_redhat_00001.1.el8eap
eap7-wildfly-javadocs
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:7.4.5-3.GA_redhat_00001.1.el8eap
0:7.4.5-3.GA_redhat_00001.1.el8eap
eap7-wildfly-modules
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:7.4.5-3.GA_redhat_00001.1.el8eap
0:7.4.5-3.GA_redhat_00001.1.el8eap
eap7-undertow
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:2.2.17-2.SP4_redhat_00001.1.el8eap
0:2.2.17-2.SP4_redhat_00001.1.el8eap
eap7-xerces-j2
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:2.12.0-3.SP04_redhat_00001.1.el8eap
0:2.12.0-3.SP04_redhat_00001.1.el8eap
eap7-activemq-artemis
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-cli
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-commons
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-core-client
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-dto
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-hornetq-protocol
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-hqclient-protocol
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-jdbc-store
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-jms-client
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-jms-server
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-journal
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-ra
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-selector
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-server
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-service-extensions
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-activemq-artemis-tools
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:2.16.0-9.redhat_00042.1.el8eap
0:2.16.0-9.redhat_00042.1.el8eap
eap7-hal-console
Red Hat:jboss_enterprise_application_platform:7.4::el8
From an advisory covering 14 CVEs
 before 0:3.3.12-1.Final_redhat_00001.1.el8eap
0:3.3.12-1.Final_redhat_00001.1.el8eap
rh-sso7-keycloak
Red Hat:red_hat_single_sign_on:7.5::el7
From an advisory covering 8 CVEs
 before 0:15.0.8-1.redhat_00001.1.el7sso
0:15.0.8-1.redhat_00001.1.el7sso
rh-sso7-keycloak-server
Red Hat:red_hat_single_sign_on:7.5::el7
From an advisory covering 8 CVEs
 before 0:15.0.8-1.redhat_00001.1.el7sso
0:15.0.8-1.redhat_00001.1.el7sso
rh-sso7-keycloak
Red Hat:red_hat_single_sign_on:7.5::el8
From an advisory covering 8 CVEs
 before 0:15.0.8-1.redhat_00001.1.el8sso
0:15.0.8-1.redhat_00001.1.el8sso
rh-sso7-keycloak-server
Red Hat:red_hat_single_sign_on:7.5::el8
From an advisory covering 8 CVEs
 before 0:15.0.8-1.redhat_00001.1.el8sso
0:15.0.8-1.redhat_00001.1.el8sso
rh-sso7-keycloak
Red Hat:red_hat_single_sign_on:7.6::el7
From an advisory covering 11 CVEs
 before 0:18.0.3-1.redhat_00001.1.el7sso
0:18.0.3-1.redhat_00001.1.el7sso
rh-sso7-keycloak-server
Red Hat:red_hat_single_sign_on:7.6::el7
From an advisory covering 11 CVEs
 before 0:18.0.3-1.redhat_00001.1.el7sso
0:18.0.3-1.redhat_00001.1.el7sso
rh-sso7-keycloak
Red Hat:red_hat_single_sign_on:7.6::el8
From an advisory covering 11 CVEs
 before 0:18.0.3-1.redhat_00001.1.el8sso
0:18.0.3-1.redhat_00001.1.el8sso
rh-sso7-keycloak-server
Red Hat:red_hat_single_sign_on:7.6::el8
From an advisory covering 11 CVEs
 before 0:18.0.3-1.redhat_00001.1.el8sso
0:18.0.3-1.redhat_00001.1.el8sso
rh-sso7
Red Hat:red_hat_single_sign_on:7.6::el9
From an advisory covering 11 CVEs
 before 0:1-5.el9sso
0:1-5.el9sso
rh-sso7-javapackages-filesystem
Red Hat:red_hat_single_sign_on:7.6::el9
From an advisory covering 11 CVEs
 before 0:6.0.0-7.el9sso
0:6.0.0-7.el9sso
rh-sso7-javapackages-tools
Red Hat:red_hat_single_sign_on:7.6::el9
From an advisory covering 11 CVEs
 before 0:6.0.0-7.el9sso
0:6.0.0-7.el9sso
rh-sso7-keycloak
Red Hat:red_hat_single_sign_on:7.6::el9
From an advisory covering 11 CVEs
 before 0:18.0.3-1.redhat_00001.1.el9sso
0:18.0.3-1.redhat_00001.1.el9sso
rh-sso7-keycloak-server
Red Hat:red_hat_single_sign_on:7.6::el9
From an advisory covering 11 CVEs
 before 0:18.0.3-1.redhat_00001.1.el9sso
0:18.0.3-1.redhat_00001.1.el9sso
rh-sso7-python3-javapackages
Red Hat:red_hat_single_sign_on:7.6::el9
From an advisory covering 11 CVEs
 before 0:6.0.0-7.el9sso
0:6.0.0-7.el9sso
rh-sso7-runtime
Red Hat:red_hat_single_sign_on:7.6::el9
From an advisory covering 11 CVEs
 before 0:1-5.el9sso
0:1-5.el9sso

History

History
RecordedChangedSources
affected, facts
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-0866 is a medium vulnerability (CVSS 5.3) in Red Hat Wildfly, published May 10, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.90%, the 59th percentile. Fixed in wildfly 26.1.1.

References

Show 115 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open