CVE-2019-3894

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run the thread as. These threads do not necessarily terminate if the keep alive time has not expired. This could allow a shared thread to use the wrong security identity when executing.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-358

Affected software

Vendor	Product	Versions
Red Hat	wildfly	affects from 11 to 16

References

https://access.redhat.com/errata/RHSA-2019:1106Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1107Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1108Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1140Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3894Issue Tracking, Vendor Advisory
https://security.netapp.com/advisory/ntap-20190517-0004/Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1106Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1107Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1108Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1140Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3894Issue Tracking, Vendor Advisory
https://security.netapp.com/advisory/ntap-20190517-0004/Third Party Advisory

Timeline

Published: May 3, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-38958.0An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An a CVE-2019-38967.8A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged local attacker can use this flaw f CVE-2019-38975.3It has been discovered in redhat-certification that any unauthorized user may download any file under /var/www/rhcert, provided they know it CVE-2019-38999.8It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misus CVE-2019-39007.7An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packet CVE-2019-39014.7A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particula CVE-2019-39025.9A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and CVE-2019-390510.0Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.CVE-2019-39068.8Premisys Identicard version 3.1.190 contains hardcoded credentials in the WCF service on port 9003. An authenticated remote attacker can use CVE-2019-39077.5Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash of CVE-2019-39087.5Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An a CVE-2019-39099.8Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor interventio