CVE-2020-1732 – Soteria: security identity corruption across concurrent threads

https://notcve.org/view.php?id=CVE-2020-1732

A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across concurrent threads when using EE Security with WildFly Elytron which can lead to the possibility of being handled using the identity from another request. Se encontró un fallo en Soteria versiones anteriores a la versión 1.0.1, en un modo en el que múltiples peticiones pueden ocurrir simultáneamente causan una corrupción de identidad de seguridad por medio de subprocesos (hilos) concurrentes cuando se usa EE Security con WildFly Elytron, lo que puede conllevar a una posibilidad de que se maneje usando la identidad de otra petición . A flaw was found in WildFly where multiple requests occurring concurrently could be handled using the identity of another request. This vulnerability occurs when using EE Security with WildFly Elytron. The largest threat from this vulnerability is data confidentiality and integrity. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1732 https://github.com/wildfly-security/soteria/commit/c2479f8c39d7d661341fdcaff7f5e97c5eea1a54 https://access.redhat.com/security/cve/CVE-2020-1732 https://bugzilla.redhat.com/show_bug.cgi?id=1801726 • CWE-20: Improper Input Validation CWE-284: Improper Access Control •