Description (CNA)
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4.25 | unaffected |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | unaffected 0:2.16.0-22.redhat_00057.1.el7eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | unaffected 0:2.3.14-11.SP11_redhat_00001.1.el7eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | unaffected 0:1.5.26-2.Final_redhat_00001.1.el7eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | unaffected 0:2.18.8-1.redhat_00003.1.el7eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | unaffected 0:2.18.8-1.redhat_00003.1.el7eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | unaffected 0:2.18.8-1.redhat_00003.1.el7eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | unaffected 0:2.18.8-1.redhat_00003.1.el7eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | unaffected 0:2.18.8-1.redhat_00003.1.el7eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | unaffected 0:2.18.8-1.redhat_00003.1.el7eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | unaffected 0:5.0.31-3.SP2_redhat_00001.1.el7eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | unaffected 0:1.10.0-46.Final_redhat_00044.1.el7eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | unaffected 0:4.1.135-1.Final_redhat_00001.1.el7eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | unaffected 0:4.1.135-1.Final_redhat_00001.1.el7eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | unaffected 0:2.5.5-30.SP12_redhat_00020.1.el7eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | unaffected 0:2.5.5-24.SP12_redhat_00016.1.el7eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | unaffected 0:2.2.40-2.SP3_redhat_00001.1.el7eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | unaffected 0:7.4.25-2.GA_redhat_00001.1.el7eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | unaffected 0:2.16.0-22.redhat_00057.1.el8eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | unaffected 0:2.3.14-11.SP11_redhat_00001.1.el8eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | unaffected 0:1.5.26-2.Final_redhat_00001.1.el8eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | unaffected 0:2.18.8-1.redhat_00003.1.el8eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | unaffected 0:2.18.8-1.redhat_00003.1.el8eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | unaffected 0:2.18.8-1.redhat_00003.1.el8eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | unaffected 0:2.18.8-1.redhat_00003.1.el8eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | unaffected 0:2.18.8-1.redhat_00003.1.el8eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | unaffected 0:2.18.8-1.redhat_00003.1.el8eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | unaffected 0:5.0.31-3.SP2_redhat_00001.1.el8eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | unaffected 0:1.10.0-46.Final_redhat_00044.1.el8eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | unaffected 0:4.1.135-1.Final_redhat_00001.1.el8eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | unaffected 0:4.1.135-1.Final_redhat_00001.1.el8eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | unaffected 0:2.5.5-30.SP12_redhat_00020.1.el8eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | unaffected 0:2.5.5-24.SP12_redhat_00016.1.el8eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | unaffected 0:2.2.40-1.SP3_redhat_00001.1.el8eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | unaffected 0:7.4.25-2.GA_redhat_00001.1.el8eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | unaffected 0:2.16.0-22.redhat_00057.1.el9eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | unaffected 0:2.3.14-11.SP11_redhat_00001.1.el9eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | unaffected 0:1.5.26-2.Final_redhat_00001.1.el9eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | unaffected 0:2.18.8-1.redhat_00003.1.el9eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | unaffected 0:2.18.8-1.redhat_00003.1.el9eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | unaffected 0:2.18.8-1.redhat_00003.1.el9eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | unaffected 0:2.18.8-1.redhat_00003.1.el9eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | unaffected 0:2.18.8-1.redhat_00003.1.el9eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | unaffected 0:2.18.8-1.redhat_00003.1.el9eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | unaffected 0:5.0.31-3.SP2_redhat_00001.1.el9eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | unaffected 0:1.10.0-46.Final_redhat_00044.1.el9eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | unaffected 0:4.1.135-1.Final_redhat_00001.1.el9eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | unaffected 0:4.1.135-1.Final_redhat_00001.1.el9eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | unaffected 0:2.5.5-30.SP12_redhat_00020.1.el9eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | unaffected 0:2.5.5-24.SP12_redhat_00016.1.el9eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | unaffected 0:2.2.40-1.SP3_redhat_00001.1.el9eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | unaffected 0:7.4.25-2.GA_redhat_00001.1.el9eap before * |
| Red Hat / Red Hat JBoss Enterprise Application Platform 8 | unaffected |
CWE
CWE-347
References
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:53645
- https://access.redhat.com/errata/RHSA-2026:53646
- https://access.redhat.com/errata/RHSA-2026:53806
- https://access.redhat.com/security/cve/CVE-2026-10579
- https://bugzilla.redhat.com/show_bug.cgi?id=2480325
ADP enrichment
No English description supplied.
No references supplied.