Skip to content
OpenAdvisories
Unscored RHSA-2009:1650 5 CVEs

Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP08 update

Published Sep 29, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 25

ReleasePackageFixed in
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 glassfish-jsf 0:1.2_13-2.1.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 hibernate3 1:3.2.4-1.SP1_CP09.0jpp.ep1.2.4.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 hibernate3-annotations 0:3.3.1-1.11GA_CP02.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 hibernate3-annotations-javadoc 0:3.3.1-1.11GA_CP02.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 hibernate3-entitymanager 0:3.3.2-2.5.1.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 hibernate3-entitymanager-javadoc 0:3.3.2-2.5.1.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 hibernate3-javadoc 1:3.2.4-1.SP1_CP09.0jpp.ep1.2.4.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 jacorb 0:2.3.0-1jpp.ep1.9.1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 jboss-aop 0:1.5.5-3.CP04.2.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 jboss-common 0:1.2.1-0jpp.ep1.3.el5.1
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 jboss-remoting 0:2.2.3-3.SP1.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 jboss-seam 0:1.2.1-1.ep1.14.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 jboss-seam-docs 0:1.2.1-1.ep1.14.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 jbossas 0:4.2.0-5.GA_CP08.5.2.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 jbossas-4.2.0.GA_CP08-bin 0:4.2.0-5.GA_CP08.5.2.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 jbossas-client 0:4.2.0-5.GA_CP08.5.2.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 jbossts 1:4.2.3-1.SP5_CP08.1jpp.ep1.1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 jbossweb 0:2.0.0-6.CP12.0jpp.ep1.2.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 jcommon 0:1.0.16-1.1.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 jfreechart 0:1.0.13-2.3.1.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 jgroups 1:2.4.7-1.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 quartz 0:1.5.2-1jpp.patch01.ep1.4.1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 rh-eap-docs 0:4.2.0-6.GA_CP08.ep1.3.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 rh-eap-docs-examples 0:4.2.0-6.GA_CP08.ep1.3.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 xml-security 0:1.3.0-1.3.patch01.ep1.2.1.el5

Vulnerabilities 5

  • Medium —
    CVE-2009-0217

    Apache XML Security For Java vulnerable to authentication bypass by HMAC truncation

    The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server…

    mono org.apache.santuario:xmlsec xml-security-c xmlsec1 Debian Maven
  • Unscored —
    CVE-2009-1380

    Cross-site scripting (XSS) vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform (ak…

  • Unscored —
    CVE-2009-2405

    Multiple cross-site scripting (XSS) vulnerabilities in the Web Console in the Application Server in Red Hat JBoss Enter…

  • Medium —
    CVE-2009-2625 EPSS 30%

    Denial of service in Apache Xerces2

    XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and applic…

    xerces:xercesImpl libxerces2-java Debian Maven
  • Unscored —
    CVE-2009-3554

    Twiddle in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP08 and 4.3 before …

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=510023
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=511224
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=511915
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=512921
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=532111
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=539495
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1650.json
  • report
    https://access.redhat.com/security/cve/CVE-2009-0217
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-0217
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-0217
  • report
    https://access.redhat.com/security/cve/CVE-2009-1380
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-1380
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-1380
  • report
    https://access.redhat.com/security/cve/CVE-2009-2405
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-2405
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-2405
  • report
    https://access.redhat.com/security/cve/CVE-2009-2625
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-2625
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-2625
  • report
    https://access.redhat.com/security/cve/CVE-2009-3554
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-3554
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-3554