CVE-2019-3834

It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. Exploits that have been published rely on ClassLoader properties that are exposed such as those in JON 3. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/site/solutions/869353. Note that while multiple products released patches for the original CVE-2014-0114 flaw, the reversion described by this CVE-2019-3834 flaw only occurred in JON 3.

• CWE-470
• CWE-470

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3834Issue Tracking, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3834Issue Tracking, Vendor Advisory

Published

Oct 3, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-3828Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 h…4.2
• CVE-2019-3829A vulnerability was found in gnutls versions from 3.5.8 befo…5.3
• CVE-2019-3830A vulnerability was found in ceilometer before version 12.0.…7.8
• CVE-2019-3831A vulnerability was discovered in vdsm, version 4.19 through…6.7
• CVE-2019-3832It was discovered the fix for CVE-2018-19758 (libsndfile) wa…5.5
• CVE-2019-3833Openwsman, versions up to and including 2.6.9, are vulnerabl…7.5
• CVE-2019-3835It was found that the superexec operator was available in th…5.5
• CVE-2019-3836It was discovered in gnutls before version 3.6.7 upstream th…5.9
• CVE-2019-3837It was found that the net_dma code in tcp_recvmsg() in the 2…6.1
• CVE-2019-3838It was found that the forceput operator could be extracted f…5.5
• CVE-2019-3839It was found that in ghostscript some privileged operators r…7.8
• CVE-2019-3840A NULL pointer dereference flaw was discovered in libvirt be…5.8