Red Hat Security Advisory: JBoss Enterprise Web Server 1.0.1 update

Fixed packages 87

Vulnerabilities 4

• Critical 9.8
  CVE-2009-3555 Public exploit EPSS 87%

  Apache Tomcat affected by vulnerability in TLS and SSL protocol

  The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Serv…

  openssl apache2 org.apache.tomcat:tomcat nss Debian Maven
  Nov 9, 2009
• Medium —
  CVE-2009-2693

  Apache Tomcat Directory Traversal vulnerability

  Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.

  org.apache.tomcat:tomcat Maven
  Jan 28, 2010
• Medium —
  CVE-2009-2902 EPSS 11%

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Apache Tomcat

  Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.

  org.apache.tomcat:tomcat Maven
  Jan 28, 2010
• Medium —
  CVE-2010-2086

  Apache MyFaces Cross-site Scripting vulnerability

  Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression…

  org.apache.myfaces.core:myfaces-core-module Maven
  May 27, 2010

References

• article
  https://access.redhat.com/security/updates/classification/#low
• article
  http://kbase.redhat.com/faq/docs/DOC-20491
• article
  http://www.redhat.com/docs/en-US/JBoss_Enterprise_Web_Server/1.0.1/html-single/Release_Notes/index.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=533125
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=558872
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=558873
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=559738
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=559761
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0119.json
• report
  https://access.redhat.com/security/cve/CVE-2009-2693
• advisory
  https://www.cve.org/CVERecord?id=CVE-2009-2693
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2009-2693
• report
  https://access.redhat.com/security/cve/CVE-2009-2902
• advisory
  https://www.cve.org/CVERecord?id=CVE-2009-2902
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2009-2902
• report
  https://access.redhat.com/security/cve/CVE-2009-3555
• advisory
  https://www.cve.org/CVERecord?id=CVE-2009-3555
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2009-3555
• report
  https://access.redhat.com/security/cve/CVE-2010-2086
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=598164
• advisory
  https://www.cve.org/CVERecord?id=CVE-2010-2086
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2010-2086