Skip to content
Fencer Intel
medium 4.4

CVE-2020-1729 json

Permissions bypass in SmallRye

published 5y ago modified 4mo ago also GHSA-54fx-gm74-q676 , EUVD-2022-1318

cvss
4.4
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits
0
none known

Summary

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality. This is fixed in SmallRye 1.6.2

Patch / fix

  • maven io.smallrye.config:smallrye-config 1.6.2
  • redhat smallrye_config 1.6.2
  • eap7-txw2 jboss enterprise application platform 7.3 2.3.3-4.b02_redhat_00001.1.el7eap
  • eap7-xsom jboss enterprise application platform 7.3 2.3.3-4.b02_redhat_00001.1.el7eap
  • eap7-rngom jboss enterprise application platform 7.3 2.3.3-4.b02_redhat_00001.1.el7eap
  • eap7-wss4j jboss enterprise application platform 7.3, jboss enterprise application platform 7.2 2.2.5-1.redhat_00001.1.el7eap
  • eap7-jandex jboss enterprise application platform 7.3 2.1.2-1.Final_redhat_00001.1.el7eap
  • eap7-jasypt jboss enterprise application platform 7.3, jboss enterprise application platform 7.2 1.9.3-1.redhat_00001.1.el7eap
  • eap7-wildfly jboss enterprise application platform 7.3 7.3.1-5.GA_redhat_00003.1.el7eap
  • eap7-jaxb-jxc jboss enterprise application platform 7.3 2.3.3-4.b02_redhat_00001.1.el7eap

red hat advisories RHSA-2020:2512RHSA-2020:2511RHSA-2020:2513RHSA-2020:2060RHSA-2020:2059RHSA-2020:2058

Is CVE-2020-1729 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-1729 updated cvss 4.0

SmallRye: SecuritySupport class is incorrectly public and contains a static method to access the current threads context class loader

  • Red Hat OpenShift Application Runtimes smallrye-config
    affected: no fix available
  • Red Hat JBoss EAP 7.2
    fixed: vendor fix RHSA-2020:2061
  • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-wss4j 2.2.5-1.redhat_00001.1.el6eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el6eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el6eap, eap7-wildfly 7.2.8-3.GA_redhat_00002.1.el6eap, eap7-apache-cxf 3.2.12-1.redhat_00001.1.el6eap, eap7-cryptacular 1.2.4-1.redhat_00001.1.el6eap, +152 more
    fixed: vendor fix RHSA-2020:2058
  • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-wss4j 2.2.5-1.redhat_00001.1.el7eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el7eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el7eap, eap7-wildfly 7.2.8-3.GA_redhat_00002.1.el7eap, eap7-apache-cxf 3.2.12-1.redhat_00001.1.el7eap, eap7-cryptacular 1.2.4-1.redhat_00001.1.el7eap, +154 more
    fixed: vendor fix RHSA-2020:2059
  • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-wss4j 2.2.5-1.redhat_00001.1.el8eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el8eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el8eap, eap7-wildfly 7.2.8-3.GA_redhat_00002.1.el8eap, eap7-apache-cxf 3.2.12-1.redhat_00001.1.el8eap, eap7-cryptacular 1.2.4-1.redhat_00001.1.el8eap, +152 more
    fixed: vendor fix RHSA-2020:2060
  • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-wss4j 2.2.5-1.redhat_00001.1.el8eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el8eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el8eap, eap7-txw2 2.3.3-4.b02_redhat_00001.1.el8eap, eap7-xsom 2.3.3-4.b02_redhat_00001.1.el8eap, eap7-rngom 2.3.3-4.b02_redhat_00001.1.el8eap, +194 more
    fixed: vendor fix RHSA-2020:2513
  • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-wss4j 2.2.5-1.redhat_00001.1.el6eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el6eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el6eap, eap7-txw2 2.3.3-4.b02_redhat_00001.1.el6eap, eap7-xsom 2.3.3-4.b02_redhat_00001.1.el6eap, eap7-rngom 2.3.3-4.b02_redhat_00001.1.el6eap, +194 more
    fixed: vendor fix RHSA-2020:2511
  • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-wss4j 2.2.5-1.redhat_00001.1.el7eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el7eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el7eap, eap7-txw2 2.3.3-4.b02_redhat_00001.1.el7eap, eap7-xsom 2.3.3-4.b02_redhat_00001.1.el7eap, eap7-rngom 2.3.3-4.b02_redhat_00001.1.el7eap, +196 more
    fixed: vendor fix RHSA-2020:2512
show 3 more
  • Red Hat JBoss Enterprise Application Platform 7
    fixed: vendor fix RHSA-2020:2515
  • Red Hat Text-Only RHOAR
    fixed: vendor fix RHSA-2020:2067
  • Red Hat Process Automation 7 smallrye-config Red Hat Single Sign-On 7 smallrye-config
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N
GitHub 3.1 4.0 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven io.smallrye.config:smallrye-config
<1.6.2
1.6.2

Affected products

  • n/a SmallRye

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.