Skip to content
OpenAdvisories
Unscored RHSA-2009:1637 5 CVEs

Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP08 update

Published Sep 29, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 28

ReleasePackageFixed in
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 glassfish-javamail 0:1.4.2-0jpp.ep1.5.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 glassfish-jsf 0:1.2_13-2.1.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 hibernate3 1:3.2.4-1.SP1_CP09.0jpp.ep1.1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 hibernate3-annotations 0:3.3.1-1.11.GA_CP02.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 hibernate3-annotations-javadoc 0:3.3.1-1.11.GA_CP02.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 hibernate3-entitymanager 0:3.3.2-2.5.GA_CP01.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 hibernate3-entitymanager-javadoc 0:3.3.2-2.5.GA_CP01.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 hibernate3-javadoc 1:3.2.4-1.SP1_CP09.0jpp.ep1.1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jacorb 0:2.3.0-1jpp.ep1.9.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jakarta-commons-logging-jboss 0:1.1-9.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jboss-aop 0:1.5.5-3.CP04.2.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jboss-common 0:1.2.1-0jpp.ep1.3.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jboss-remoting 0:2.2.3-3.SP1.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jboss-seam 0:1.2.1-1.ep1.22.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jboss-seam-docs 0:1.2.1-1.ep1.22.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jbossas 0:4.2.0-5.GA_CP08.5.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jbossas-4.2.0.GA_CP08-bin 0:4.2.0-5.GA_CP08.5.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jbossas-client 0:4.2.0-5.GA_CP08.5.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jbossts 1:4.2.3-1.SP5_CP08.1jpp.ep1.1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jbossweb 0:2.0.0-6.CP12.0jpp.ep1.2.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jcommon 0:1.0.16-1.1.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jfreechart 0:1.0.13-2.3.1.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jgroups 1:2.4.7-1.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 quartz 0:1.5.2-1jpp.patch01.ep1.4.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 rh-eap-docs 0:4.2.0-6.GA_CP08.ep1.3.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 rh-eap-docs-examples 0:4.2.0-6.GA_CP08.ep1.3.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 xerces-j2 0:2.7.1-9jpp.4.patch_02.1.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 xml-security 0:1.3.0-1.3.patch01.ep1.2.el4

Vulnerabilities 5

  • Medium —
    CVE-2009-0217

    Apache XML Security For Java vulnerable to authentication bypass by HMAC truncation

    The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server…

    mono org.apache.santuario:xmlsec xml-security-c xmlsec1 Debian Maven
  • Unscored —
    CVE-2009-1380

    Cross-site scripting (XSS) vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform (ak…

  • Unscored —
    CVE-2009-2405

    Multiple cross-site scripting (XSS) vulnerabilities in the Web Console in the Application Server in Red Hat JBoss Enter…

  • Medium —
    CVE-2009-2625 EPSS 30%

    Denial of service in Apache Xerces2

    XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and applic…

    xerces:xercesImpl libxerces2-java Debian Maven
  • Unscored —
    CVE-2009-3554

    Twiddle in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP08 and 4.3 before …

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=510023
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=511224
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=511915
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=512921
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=532116
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=539495
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1637.json
  • report
    https://access.redhat.com/security/cve/CVE-2009-0217
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-0217
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-0217
  • report
    https://access.redhat.com/security/cve/CVE-2009-1380
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-1380
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-1380
  • report
    https://access.redhat.com/security/cve/CVE-2009-2405
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-2405
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-2405
  • report
    https://access.redhat.com/security/cve/CVE-2009-2625
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-2625
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-2625
  • report
    https://access.redhat.com/security/cve/CVE-2009-3554
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-3554
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-3554