{"id":"CVE-2022-0866","aliases":["BIT-wildfly-2022-0866","EUVD-2022-15908","GHSA-pjxg-p9c7-7c3v","RHSA-2022:4918","RHSA-2022:4919","RHSA-2022:6782","RHSA-2022:6783","RHSA-2022:7409","RHSA-2022:7410","RHSA-2022:7411"],"status":"published","title":"This is a concurrency issue that can result in the wrong caller principal being returned from the...","description":"This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00902,"percentile":0.59995,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2022-05-10T20:20:35Z","modified":"2026-10-28T02:30:55Z","fixes":[{"ecosystem":"Bitnami","package":"wildfly","fixed_in":["26.1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"wildfly","ranges":[{"type":"SEMVER","events":[{"introduced":"11.0.0"},{"fixed":"26.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.6.1-1.redhat_00003.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-resolver-dns-classes-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-transport-classes-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-transport-rxtx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-netty-transport-udt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-h2database","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.197-2.redhat_00004.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-jboss-xnio-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.7-1.SP1_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-wildfly-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.11-1.SP1_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-wildfly-http-client-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.11-1.SP1_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-wildfly-http-ejb-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.11-1.SP1_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-wildfly-http-naming-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.11-1.SP1_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-wildfly-http-transaction-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.11-1.SP1_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.5-3.GA_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.5-3.GA_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-wildfly-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.5-3.GA_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-wildfly-javadocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.5-3.GA_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.5-3.GA_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.17-2.SP4_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-xerces-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.0-3.SP04_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-activemq-artemis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-activemq-artemis-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-activemq-artemis-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-activemq-artemis-core-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-activemq-artemis-dto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-activemq-artemis-hornetq-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-activemq-artemis-hqclient-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-activemq-artemis-jdbc-store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-activemq-artemis-jms-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-activemq-artemis-jms-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-activemq-artemis-journal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-activemq-artemis-ra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-activemq-artemis-selector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-activemq-artemis-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-activemq-artemis-service-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-activemq-artemis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-hal-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.12-1.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.6.1-1.redhat_00003.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-resolver-dns-classes-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-transport-classes-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-transport-rxtx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-netty-transport-udt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.72-4.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-h2database","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.197-2.redhat_00004.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-jboss-xnio-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.7-1.SP1_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-wildfly-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.11-1.SP1_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-wildfly-http-client-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.11-1.SP1_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-wildfly-http-ejb-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.11-1.SP1_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-wildfly-http-naming-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.11-1.SP1_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-wildfly-http-transaction-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.11-1.SP1_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.5-3.GA_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-wildfly-javadocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.5-3.GA_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.5-3.GA_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.17-2.SP4_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-xerces-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.0-3.SP04_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-activemq-artemis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-activemq-artemis-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-activemq-artemis-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-activemq-artemis-core-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-activemq-artemis-dto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-activemq-artemis-hornetq-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-activemq-artemis-hqclient-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-activemq-artemis-jdbc-store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-activemq-artemis-jms-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-activemq-artemis-jms-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-activemq-artemis-journal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-activemq-artemis-ra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-activemq-artemis-selector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-activemq-artemis-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-activemq-artemis-service-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-activemq-artemis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-9.redhat_00042.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-hal-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.12-1.Final_redhat_00001.1.el8eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.5::el7","package":"rh-sso7-keycloak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.0.8-1.redhat_00001.1.el7sso"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.5::el7","package":"rh-sso7-keycloak-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.0.8-1.redhat_00001.1.el7sso"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.5::el8","package":"rh-sso7-keycloak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.0.8-1.redhat_00001.1.el8sso"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.5::el8","package":"rh-sso7-keycloak-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.0.8-1.redhat_00001.1.el8sso"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el7","package":"rh-sso7-keycloak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.3-1.redhat_00001.1.el7sso"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el7","package":"rh-sso7-keycloak-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.3-1.redhat_00001.1.el7sso"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el8","package":"rh-sso7-keycloak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.3-1.redhat_00001.1.el8sso"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el8","package":"rh-sso7-keycloak-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.3-1.redhat_00001.1.el8sso"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el9","package":"rh-sso7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-5.el9sso"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el9","package":"rh-sso7-javapackages-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.0-7.el9sso"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el9","package":"rh-sso7-javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.0-7.el9sso"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el9","package":"rh-sso7-keycloak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.3-1.redhat_00001.1.el9sso"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el9","package":"rh-sso7-keycloak-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.3-1.redhat_00001.1.el9sso"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el9","package":"rh-sso7-python3-javapackages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.0-7.el9sso"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el9","package":"rh-sso7-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-5.el9sso"}]}],"bundled":11}],"products":[{"vendor":"red hat","product":"wildfly"},{"vendor":"redhat","product":"jboss_enterprise_application_platform"},{"vendor":"redhat","product":"openstack_platform"},{"vendor":"redhat","product":"wildfly"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060929#c0","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Mitigation","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0866","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-pjxg-p9c7-7c3v"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0866.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:4918","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004133","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004135","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2031958","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2039403","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041472","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2047200","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060725","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060929","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2063601","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064226","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064698","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072009","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073890","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-23120","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23171","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23194","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23241","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23299","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23300","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23312","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23313","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23336","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23338","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23339","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23351","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23353","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23429","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23432","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23451","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23531","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23532","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4918.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-36518","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-36518","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36518","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-57j2-w4cx-62h2","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-37136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-37136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37136","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-37137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-37137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37137","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-42392","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-42392","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42392","tags":["advisory"]},{"url":"https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-43797","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-43797","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43797","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0084","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0084","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0084","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0853","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0866","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0866","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1319","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1319","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1319","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21299","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21299","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21299","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23221","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23221","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-45hx-wfhj-473x","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23437","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23437","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23437","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23913","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23913","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23913","tags":["advisory"]},{"url":"https://lists.apache.org/thread/fjynj57rd99s814rdn5hzvmx8lz403q2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24785","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24785","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24785","tags":["advisory"]},{"url":"https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:4919","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/JBEAP-23121","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4919.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6782","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040268","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2101942","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115392","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6782.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0225","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0225","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0225","tags":["advisory"]},{"url":"https://github.com/keycloak/keycloak/security/advisories/GHSA-755v-r4x4-qf7m","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2256","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2256","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2256","tags":["advisory"]},{"url":"https://github.com/keycloak/keycloak/security/advisories/GHSA-w9mf-83w3-fv49","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2668","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2668","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2668","tags":["advisory"]},{"url":"https://github.com/keycloak/keycloak/security/advisories/GHSA-wf7g-7h6h-678v","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6783","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6783.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:7409","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7409.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-42575","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2027195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-42575","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42575","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:7410","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7410.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:7411","tags":["advisory"]},{"url":"https://access.redhat.com/articles/11258","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7411.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-0866","description":"This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.","status":"published","published":"2022-05-10T20:20:35Z","modified":"2024-08-02T23:40:04.505Z","cwes":["CWE-863"],"updated_at":"2026-11-02T14:34:41.69911Z"}],"euvd":[{"id":"EUVD-2022-15908","description":"This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.","status":"published","published":"2022-05-10T20:20:35Z","modified":"2024-08-02T23:40:04Z","updated_at":"2026-11-03T03:26:03.474849Z"}],"ghsa":[{"id":"GHSA-pjxg-p9c7-7c3v","title":"This is a concurrency issue that can result in the wrong caller principal being returned from the...","description":"This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.","status":"published","published":"2022-05-11T00:01:07Z","modified":"2023-02-01T05:02:11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:49:51.819251Z"}],"nvd":[{"id":"CVE-2022-0866","description":"This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.","status":"published","published":"2022-05-10T21:15:08.817Z","modified":"2026-06-17T04:21:23.847Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:07:19.51203Z"}],"osv":[{"id":"RHSA-2022:4918","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 7","status":"published","published":"2024-09-29T19:10:02Z","modified":"2026-10-13T10:03:05Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:4919","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 8","status":"published","published":"2024-09-29T19:09:55Z","modified":"2026-10-13T10:03:06Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:6782","title":"Red Hat Security Advisory: Red Hat Single Sign-On 7.5.3 security update on RHEL 7","status":"published","published":"2024-09-29T19:06:57Z","modified":"2026-10-13T10:03:25Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:6783","title":"Red Hat Security Advisory: Red Hat Single Sign-On 7.5.3 security update on RHEL 8","status":"published","published":"2024-09-29T19:07:05Z","modified":"2026-10-13T10:03:26Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:7409","title":"Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 7","status":"published","published":"2024-09-29T19:07:31Z","modified":"2026-10-13T10:03:28Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:7410","title":"Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 8","status":"published","published":"2024-09-29T19:07:15Z","modified":"2026-10-13T10:03:28Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:7411","title":"Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 9","status":"published","published":"2024-09-29T19:07:39Z","modified":"2026-10-13T10:03:28Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"BIT-wildfly-2022-0866","description":"This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.","status":"published","published":"2025-11-07T11:01:40.946Z","modified":"2026-09-08T08:48:21.551910173Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"CVE-2022-0866","description":"This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.","status":"published","published":"2022-05-10T20:20:35Z","modified":"2026-10-28T02:30:55.885315447Z","cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:23.245966Z"}]}}