In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Jakarta_expression_language | Eclipse | * | 3.0.3 (including) |
| Jakarta-el-api | Ubuntu | hirsute | * |
| Jakarta-el-api | Ubuntu | impish | * |
| Jakarta-el-api | Ubuntu | kinetic | * |
| Jakarta-el-api | Ubuntu | lunar | * |
| Jakarta-el-api | Ubuntu | mantic | * |
| Jakarta-el-api | Ubuntu | trusty | * |
| Jakarta-el-api | Ubuntu | xenial | * |
| EAP 7.3.9 release | RedHat | jakarta.el | * |
| EAP 7.4.1 release | RedHat | * | |
| Red Hat build of Quarkus 2.2.5 | RedHat | jakarta.el | * |
| Red Hat EAP-XP 2.0.0 via EAP 7.3.x base | RedHat | jakarta.el | * |
| Red Hat Fuse 7.10 | RedHat | jakarta.el | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-apache-commons-io-0:2.10.0-1.redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-hal-console-0:3.2.16-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-hibernate-0:5.3.20-4.SP2_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-ironjacamar-0:1.4.35-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-jakarta-el-0:3.0.3-2.redhat_00006.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-jberet-0:1.3.9-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-jboss-remoting-0:5.0.23-2.SP1_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-jboss-server-migration-0:1.7.2-9.Final_redhat_00010.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-narayana-0:5.9.12-1.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-picketbox-0:5.0.3-9.Final_redhat_00008.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-undertow-0:2.0.39-1.SP2_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-wildfly-0:7.3.9-2.GA_redhat_00002.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-wildfly-http-client-0:1.0.29-1.Final_redhat_00002.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | RedHat | eap7-wildfly-transaction-client-0:1.1.14-2.Final_redhat_00001.1.el6eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-apache-commons-io-0:2.10.0-1.redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-hal-console-0:3.2.16-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-hibernate-0:5.3.20-4.SP2_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-ironjacamar-0:1.4.35-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-jakarta-el-0:3.0.3-2.redhat_00006.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-jberet-0:1.3.9-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-jboss-remoting-0:5.0.23-2.SP1_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-jboss-server-migration-0:1.7.2-9.Final_redhat_00010.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-narayana-0:5.9.12-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-picketbox-0:5.0.3-9.Final_redhat_00008.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-undertow-0:2.0.39-1.SP2_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-wildfly-0:7.3.9-2.GA_redhat_00002.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-wildfly-http-client-0:1.0.29-1.Final_redhat_00002.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | RedHat | eap7-wildfly-transaction-client-0:1.1.14-2.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-apache-commons-io-0:2.10.0-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-hal-console-0:3.2.16-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-hibernate-0:5.3.20-4.SP2_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-ironjacamar-0:1.4.35-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-jakarta-el-0:3.0.3-2.redhat_00006.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-jberet-0:1.3.9-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-jboss-remoting-0:5.0.23-2.SP1_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-jboss-server-migration-0:1.7.2-9.Final_redhat_00010.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-narayana-0:5.9.12-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-picketbox-0:5.0.3-9.Final_redhat_00008.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-undertow-0:2.0.39-1.SP2_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-wildfly-0:7.3.9-2.GA_redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-wildfly-http-client-0:1.0.29-1.Final_redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | RedHat | eap7-wildfly-transaction-client-0:1.1.14-2.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | RedHat | eap7-jakarta-el-0:3.0.3-2.redhat_00006.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | RedHat | eap7-jakarta-el-0:3.0.3-2.redhat_00006.1.el7eap | * |
| Red Hat Single Sign-On 7.4.9 | RedHat | jakarta.el | * |
| RHINT Camel-K 1.6.4 | RedHat | jakarta.el | * |
| RHINT Camel-Q 2.2.1 | RedHat | jakarta.el | * |