Is CVE-2015-7575 applicable to wild fly

[anuk]

Hi ,

   We are using Wildfly8.2final as a web server in application. I wanted to know whether wildfly is vulnerable SLOTH attack(CVE-2015-7575). Or it depends on the jre where the application is running.

Thanks and Regards

Anu

[ctomc]

WildFly as such no.

but JDK on top with you are running it, could be affected.

some list of RHEL packages that are affected https://access.redhat.com/security/cve/cve-2015-7575

and there is update for Oracle JDK see Oracle Critical Patch Update - January 2016 to fix this.

[anuk]

Thank you. I wanted to confirm this. So that we can upgrade only java to fix this issue.