Security vulnerabilities in WF10

[assumal]

Hi !

I am new to Widfly but the product I am working with uses Wildfly 10 and we have used WhiteSource to scan it for security vulnerabilities and WhiteSource found about 12 high security vulnerability.  So my question is:

1.  Are there security updates for WF 10.0.0.Final ? If so where can I download it?

2.  Is there a list of security vulnerability in WF 10, WF 12 and WF 14?  If so can someone please send me the link.

3.  Is the commercial version JBoss EAP 7.0.x 100% compatible with WF 10.0.0?

4.  Does anyone know where to get the JBoss EAP 7.0 security updates?

We would like to find a solution that fixes updates all the security issues with WF10.  If we have to move to WF14 we could but I'm told its not an easy update from 10 to 14.

Thanks,

Haresh

[claudio4j]

> 1.  Are there security updates for WF 10.0.0.Final ? If so where can I download it?

The security fixes are applied in the source code repository, which there are quarterly releases.

Wildfly doesn't perform build security updates binaries. There is the subscription based JBoss EAP with security updates

> 2.  Is there a list of security vulnerability in WF 10, WF 12 and WF 14?  If so can someone please send me the link.

I couldn't find a list for Wildfly, but there is a list for JBoss EAP.

> 3.  Is the commercial version JBoss EAP 7.0.x 100% compatible with WF 10.0.0?

Wildfly releases are productized to become a JBoss EAP release, but at some point between the Wildfly and JBoss EAP release some bug may be fixed, then it may have some small difference.

EAP Version	Wildfly Version
7.0	10
7.1	11

JBoss EAP 7 Maintenance Schedule - Red Hat Customer Portal

> 4.  Does anyone know where to get the JBoss EAP 7.0 security updates?

The binaries security updates for EAP are available in the customer portal.