CVE-2019-3834

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. Exploits that have been published rely on ClassLoader properties that are exposed such as those in JON 3. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/site/solutions/869353. Note that while multiple products released patches for the original CVE-2014-0114 flaw, the reversion described by this CVE-2019-3834 flaw only occurred in JON 3.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-470

Affected software

No affected versions have been published.

Timeline

Published: Oct 3, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-38355.5It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript CVE-2019-38367.5It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later wh CVE-2019-38376.1It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-thre CVE-2019-38385.5It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted Po CVE-2019-38397.8It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially CVE-2019-38406.3A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information through the QEMU age CVE-2019-38416.8Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into CVE-2019-38427.0In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable CVE-2019-38437.8It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the tr CVE-2019-38447.8It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which CVE-2019-38458.0A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before CVE-2019-38468.8A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting t