Skip to content
Fencer Vulns
medium 5.5

CVE-2019-3805 json

A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d script to terminat…

published 2019-05-03 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-13431

cvss
5.5
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits
0
none known

Summary

A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d script to terminate arbitrary processes on the system. An attacker could exploit this by modifying the PID file in /var/run/jboss-eap/ allowing the init.d script to terminate any process as root.

Patch / fix

  • eap7-dom4j jboss enterprise application platform 7.2 2.1.1-2.redhat_00001.1.el7eap
  • eap7-jberet jboss enterprise application platform 7.2 1.3.2-1.Final_redhat_00001.1.el7eap
  • eap7-yasson jboss enterprise application platform 7.2 1.0.2-1.redhat_00001.1.el7eap
  • eap7-wildfly jboss enterprise application platform 7.2 7.2.1-6.GA_redhat_00004.1.el7eap
  • eap7-narayana jboss enterprise application platform 7.2 5.9.1-1.Final_redhat_00001.1.el7eap
  • eap7-resteasy jboss enterprise application platform 7.2 3.6.1-4.SP3_redhat_00001.1.el7eap
  • eap7-undertow jboss enterprise application platform 7.2 2.0.19-1.Final_redhat_00001.1.el7eap
  • eap7-hibernate jboss enterprise application platform 7.2 5.3.9-2.Final_redhat_00002.1.el7eap

red hat advisories RHSA-2019:1108RHSA-2019:1107

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-3805 updated cvss 5.5

wildfly: Race condition on PID file allows for termination of arbitrary processes by local users

  • Red Hat JBoss Data Virtualization 6 jbossas jbossas
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise Application Platform 6 jbossas jbossas
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Fuse 6 wildfly wildfly Red Hat JBoss Fuse Service Works 6 jbossas jbossas
    affected: no fix planned “Out of support scope”
  • Red Hat Data Grid 7.3.3
    fixed: vendor fix RHSA-2020:0727
  • Red Hat Fuse 7.4.0
    fixed: vendor fix RHSA-2019:2413
  • Red Hat JBoss EAP 7.2
    fixed: vendor fix RHSA-2019:1106
  • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-dom4j 2.1.1-2.redhat_00001.1.el6eap, eap7-yasson 1.0.2-1.redhat_00001.1.el6eap, eap7-apache-cxf 3.2.7-1.redhat_00001.1.el6eap, eap7-byte-buddy 1.9.5-1.redhat_00001.1.el6eap, eap7-cxf-xjc-dv 3.2.3-2.redhat_00002.1.el6eap, eap7-cxf-xjc-ts 3.2.3-2.redhat_00002.1.el6eap, +152 more
    fixed: vendor fix RHSA-2019:1107
  • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-dom4j 2.1.1-2.redhat_00001.1.el7eap, eap7-yasson 1.0.2-1.redhat_00001.1.el7eap, eap7-apache-cxf 3.2.7-1.redhat_00001.1.el7eap, eap7-byte-buddy 1.9.5-1.redhat_00001.1.el7eap, eap7-cxf-xjc-dv 3.2.3-2.redhat_00002.1.el7eap, eap7-cxf-xjc-ts 3.2.3-2.redhat_00002.1.el7eap, +154 more
    fixed: vendor fix RHSA-2019:1108
show 3 more
  • Red Hat JBoss Enterprise Application Platform Continuous Delivery
    fixed: vendor fix RHSA-2020:2565
  • Red Hat Single Sign-On 7.3.1 zip
    fixed: vendor fix RHSA-2019:1140
  • Red Hat Decision Manager 7 wildfly wildfly Red Hat JBoss Enterprise Application Platform 5 jbossas jbossas Red Hat JBoss Operations Network 3 wildfly wildfly Red Hat JBoss SOA Platform 5 jbossas jbossas Red Hat OpenShift Application Runtimes wildfly wildfly Red Hat Process Automation 7 wildfly wildfly
    +2 more products
    Red Hat Single Sign-On 7 wildfly wildfly Red Hat Virtualization 4 eap7-wildfly
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 4.7 AV:L/AC:M/Au:N/C:N/I:N/A:C

Affected products

  • Red Hat wildfly

Classification

Weakness
  • CWE-364 Signal Handler Race Condition
  • CWE-269 Improper Privilege Management

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.