Skip to content
OpenAdvisories
Medium RHSA-2009:1146 3 CVEs

Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP05 update

Published Sep 15, 2024 · Updated Nov 22, 2025

Ecosystem: Red Hat

Fixed packages 33

ReleasePackageFixed in
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 glassfish-jaxb 0:2.1.4-1.11.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 glassfish-jaxb-javadoc 0:2.1.4-1.11.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 hibernate3 1:3.2.4-1.SP1_CP08.0jpp.ep1.2.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 hibernate3-annotations 0:3.3.1-1.10.GA_CP01.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 hibernate3-annotations-javadoc 0:3.3.1-1.10.GA_CP01.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 hibernate3-commons-annotations 0:3.0.0-1jpp.ep1.5.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 hibernate3-commons-annotations-javadoc 0:3.0.0-1jpp.ep1.5.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 hibernate3-entitymanager 0:3.3.2-2.4.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 hibernate3-entitymanager-javadoc 0:3.3.2-2.4.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 hibernate3-javadoc 1:3.2.4-1.SP1_CP08.0jpp.ep1.2.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 hibernate3-validator 0:3.0.0-1jpp.ep1.8.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 hibernate3-validator-javadoc 0:3.0.0-1jpp.ep1.8.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 hsqldb 1:1.8.0.8-2.patch02.1jpp.ep1.2.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jakarta-slide-webdavclient 0:2.1-9.2.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jboss-cache 0:1.4.1-6.SP13.1.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jboss-messaging 0:1.4.0-2.SP3_CP08.1.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jboss-remoting 0:2.2.3-2.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jboss-seam 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.15.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jboss-seam-docs 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.15.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jbossas 0:4.3.0-4.GA_CP05.6.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jbossas-4.3.0.GA_CP05-bin 0:4.3.0-4.GA_CP05.6.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jbossas-client 0:4.3.0-4.GA_CP05.6.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jbossts 1:4.2.3-1.SP5_CP05.1jpp.ep1.1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jbossweb 0:2.0.0-6.CP11.0jpp.ep1.1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jbossws 0:2.0.1-3.SP2_CP06.3.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jbossws-common 0:1.0.0-2.GA_CP04.1.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jbossws-framework 0:2.0.1-1.GA_CP04.2.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jbossws-native42 0:2.0.1-3.SP2_CP06.3.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jbossws-spi 0:1.0.0-1.GA_CP02.1.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jgroups 1:2.4.6-1.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 rh-eap-docs 0:4.3.0-5.GA_CP05.ep1.2.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 rh-eap-docs-examples 0:4.3.0-5.GA_CP05.ep1.2.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 xerces-j2 0:2.7.1-9jpp.ep1.2.el4

Vulnerabilities 3

  • Medium 5.3
    CVE-2008-5515 EPSS 19%

    Directory Traversal in Apache Tomcat

    Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass int…

    org.apache.tomcat:tomcat Maven
  • Medium 4.2
    CVE-2009-0783

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

    Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2009-0580 Public exploit EPSS 94%

    Exposure of Sensitive Information in Apache Tomcat

    Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to i…

    org.apache.tomcat:tomcat Maven

References

  • article
    http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3.0.cp05/html-single/Release_Notes/index.html
  • article
    http://www.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=499608
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=503978
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=504153
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=504753
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1146.json
  • report
    https://access.redhat.com/security/cve/CVE-2008-5515
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2008-5515
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2008-5515
  • report
    https://access.redhat.com/security/cve/CVE-2009-0580
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-0580
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-0580
  • report
    https://access.redhat.com/security/cve/CVE-2009-0783
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-0783
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-0783