Description
PicketBox, as used in Red Hat JBoss Enterprise Application Platform before 6.1.1, allows local users to obtain the admin encryption key by reading the Vault data file.
Remediation
References
http://rhn.redhat.com/errata/RHSA-2013-1207.html
http://rhn.redhat.com/errata/RHSA-2013-1208.html
http://rhn.redhat.com/errata/RHSA-2013-1209.html
http://rhn.redhat.com/errata/RHSA-2013-1437.html
http://rhn.redhat.com/errata/RHSA-2014-0029.html
https://bugzilla.redhat.com/show_bug.cgi?id=948106
Related Vulnerabilities
CVE-2016-0706 Vulnerability in maven package org.apache.tomcat:catalina
CVE-2019-3797 Vulnerability in maven package org.springframework.data:spring-data-jpa
CVE-2019-1003062 Vulnerability in maven package org.jenkins-ci.plugins:aws-cloudwatch-logs-publisher
CVE-2015-5348 Vulnerability in maven package org.apache.camel:camel-ahc
CVE-2013-4310 Vulnerability in maven package org.apache.struts:struts2-core