Skip to content
Fencer Intel
medium 5.3

CVE-2022-0866 json

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configu…

published 4y ago modified 2mo ago also BIT-wildfly-2022-0866 , EUVD-2022-15908

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.

Patch / fix

  • bitnami wildfly 26.1.1
  • redhat wildfly 26.1.1
  • eap7-netty jboss enterprise application platform 7.4 4.1.72-4.Final_redhat_00001.1.el7eap
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.5-3.GA_redhat_00001.1.el7eap
  • eap7-undertow jboss enterprise application platform 7.4 2.2.17-2.SP4_redhat_00001.1.el7eap
  • eap7-netty-all jboss enterprise application platform 7.4 4.1.72-4.Final_redhat_00001.1.el7eap
  • eap7-xerces-j2 jboss enterprise application platform 7.4 2.12.0-3.SP04_redhat_00001.1.el7eap
  • eap7-h2database jboss enterprise application platform 7.4 1.4.197-2.redhat_00004.1.el7eap
  • eap7-hal-console jboss enterprise application platform 7.4 3.3.12-1.Final_redhat_00001.1.el7eap
  • eap7-netty-codec jboss enterprise application platform 7.4 4.1.72-4.Final_redhat_00001.1.el7eap

red hat advisories RHSA-2022:4918RHSA-2022:4919RHSA-2022:7411RHSA-2022:7409RHSA-2022:7410RHSA-2022:6783

Is CVE-2022-0866 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-0866 updated cvss 3.1

wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled

  • Red Hat Decision Manager 7 wildfly wildfly Red Hat JBoss Data Grid 7 wildfly wildfly Red Hat JBoss Enterprise Application Platform 6 wildfly wildfly, keycloak-adapter-eap6 keycloak-adapter-eap6, keycloak-adapter-sso7_2-eap6 keycloak-adapter-sso7_2-eap6, keycloak-adapter-sso7_3-eap6 keycloak-adapter-sso7_3-eap6, keycloak-adapter-sso7_4-eap6 keycloak-adapter-sso7_4-eap6, keycloak-adapter-sso7_5-eap6 keycloak-adapter-sso7_5-eap6 Red Hat JBoss Fuse 6 wildfly wildfly Red Hat JBoss Fuse Service Works 6 wildfly wildfly Red Hat OpenStack Platform 13 (Queens) opendaylight
    +1 more products
    Red Hat Process Automation 7 wildfly wildfly
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wildfly 7.4.5-3.GA_redhat_00001.1.el7eap, eap7-wildfly-modules 7.4.5-3.GA_redhat_00001.1.el7eap, eap7-wildfly-javadocs 7.4.5-3.GA_redhat_00001.1.el7eap, eap7-wildfly-java-jdk8 7.4.5-3.GA_redhat_00001.1.el7eap, eap7-wildfly-java-jdk11 7.4.5-3.GA_redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2022:4918
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-wildfly 7.4.5-3.GA_redhat_00001.1.el8eap, eap7-wildfly-modules 7.4.5-3.GA_redhat_00001.1.el8eap, eap7-wildfly-javadocs 7.4.5-3.GA_redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2022:4919
  • Red Hat JBoss Enterprise Application Platform wildfly-elytron 1.15.12.Final-redhat-00001
    fixed: vendor fix RHSA-2022:4922
  • Red Hat Single Sign-On 7
    fixed: vendor fix RHSA-2022:6787
  • Red Hat Single Sign-On 7.5 for RHEL 7 Server rh-sso7-keycloak 15.0.8-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 15.0.8-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2022:6782
  • Red Hat Single Sign-On 7.5 for RHEL 8 rh-sso7-keycloak 15.0.8-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 15.0.8-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2022:6783
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.3-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.3-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2022:7409
show 4 more
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.3-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.3-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2022:7410
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7 1-5.el9sso, rh-sso7-runtime 1-5.el9sso, rh-sso7-javapackages-tools 6.0.0-7.el9sso, rh-sso7-python3-javapackages 6.0.0-7.el9sso, rh-sso7-javapackages-filesystem 6.0.0-7.el9sso, rh-sso7-keycloak 18.0.3-1.redhat_00001.1.el9sso, +1 more
    fixed: vendor fix RHSA-2022:7411
  • Red Hat Single Sign-On 7.6.1
    fixed: vendor fix RHSA-2022:7417
  • Red Hat build of Apicurio Registry 2 wildfly wildfly Red Hat build of Debezium 1 wildfly wildfly Red Hat build of Quarkus wildfly wildfly Red Hat Data Grid 8 wildfly wildfly Red Hat Fuse 7 wildfly wildfly Red Hat Integration Camel K 1 wildfly wildfly
    +8 more products
    Red Hat Integration Camel Quarkus 1 wildfly wildfly Red Hat Integration Data Virtualisation Operator wildfly wildfly Red Hat Integration Service Registry wildfly wildfly Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-log4j 2.17.1-2.redhat_00002.1.el7eap, eap7-jberet 1.3.9-1.SP1_redhat_00001.1.el7eap, eap7-snakeyaml 1.29.0-1.redhat_00001.2.el7eap, eap7-h2database 1.4.197-2.redhat_00004.1.el7eap, eap7-netty 4.1.72-4.Final_redhat_00001.1.el7eap, eap7-jackson-core 2.12.6-1.redhat_00001.1.el7eap, +80 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-log4j 2.17.1-2.redhat_00002.1.el8eap, eap7-jberet 1.3.9-1.SP1_redhat_00001.1.el8eap, eap7-snakeyaml 1.29.0-1.redhat_00001.2.el8eap, eap7-h2database 1.4.197-2.redhat_00004.1.el8eap, eap7-netty 4.1.72-4.Final_redhat_00001.1.el8eap, eap7-jackson-core 2.12.6-1.redhat_00001.1.el8eap, +80 more Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, ms 2.0.0, ms 2.1.2, +1482 more Red Hat JBoss Enterprise Application Platform Expansion Pack wildfly wildfly Red Hat streams for Apache Kafka wildfly wildfly
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.90% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N
OSV 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
bitnami wildfly
>=11.0.0, <26.1.1
26.1.1

Affected products

  • n/a Wildfly

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.