Описание
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat JBoss Enterprise Application Platform 8 | picketlink-federation | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 7.4.25 | picketlink-federation | Fixed | RHSA-2026:53806 | 11.08.2026 |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | eap7-activemq-artemis | Fixed | RHSA-2026:53644 | 11.08.2026 |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | eap7-glassfish-jsf | Fixed | RHSA-2026:53644 | 11.08.2026 |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | eap7-ironjacamar | Fixed | RHSA-2026:53644 | 11.08.2026 |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | eap7-jackson-annotations | Fixed | RHSA-2026:53644 | 11.08.2026 |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | eap7-jackson-core | Fixed | RHSA-2026:53644 | 11.08.2026 |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | eap7-jackson-databind | Fixed | RHSA-2026:53644 | 11.08.2026 |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | eap7-jackson-jaxrs-providers | Fixed | RHSA-2026:53644 | 11.08.2026 |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | eap7-jackson-modules-base | Fixed | RHSA-2026:53644 | 11.08.2026 |
Показывать по
Дополнительная информация
Статус:
9.8 Critical
CVSS3
Связанные уязвимости
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.
9.8 Critical
CVSS3