Loading vulnerability…
JBoss Weld stale thread-local conversation state information disclosure
CVE-2014-8122 is a race condition in JBoss Weld conversation-state handling. In affected releases, conversation state retained in a thread-local variable was not correctly sanitized when a conversation ended under specific conditions. Reuse of the thread with stale state could cause information associated with a prior conversation to be exposed to a subsequent conversation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker who successfully triggers the race condition may obtain sensitive information from another, previously processed Weld conversation. The documented impact is limited confidentiality loss; integrity and availability impact are not described.
If you can’t patch tonight, do this now.
As a temporary measure, restrict access to the affected application to trusted users only, and monitor for unusual session activity. However, the only effective mitigation is to apply the vendor-provided patch or upgrade to a fixed version.
Patch, then assume compromise.
Upgrade JBoss Weld dependencies to a fixed release. The 2.x line is fixed in Weld 2.2.8.Final and later, and the listed 3.0.0 pre-release line is fixed in 3.0.0.Alpha3 and later. For supported Red Hat middleware distributions, install the applicable vendor security update and restart the JBoss server process. Fixed product updates include JBoss EAP 6.3.3 and later applicable errata, JBoss Data Virtualization 6.1.0, JBoss Data Grid 6.4.1, JBoss BPM Suite 6.1.0, and JBoss BRMS 6.1.0.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.