Skip to content
OpenAdvisories
Unscored RHSA-2010:0937 3 CVEs

Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP09 update

Published Sep 15, 2024 · Updated Nov 22, 2025

Ecosystem: Red Hat

Fixed packages 25

ReleasePackageFixed in
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 glassfish-jaxb 0:2.1.4-1.17.patch04.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 glassfish-jaxws 0:2.1.1-1jpp.ep1.13.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 hibernate3 1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 hibernate3-annotations 0:3.3.1-2.0.GA_CP04.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 hibernate3-annotations-javadoc 0:3.3.1-2.0.GA_CP04.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 hibernate3-javadoc 1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 javassist 0:3.9.0-2.ep1.1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jboss-common 0:1.2.2-1.ep1.1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jboss-messaging 0:1.4.0-4.SP3_CP11.1.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jboss-remoting 0:2.2.3-4.SP3.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jboss-seam 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.22.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jboss-seam-docs 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.22.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jboss-seam2 0:2.0.2.FP-1.ep1.26.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jboss-seam2-docs 0:2.0.2.FP-1.ep1.26.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jbossas 0:4.3.0-8.GA_CP09.2.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jbossas-4.3.0.GA_CP09-bin 0:4.3.0-8.GA_CP09.2.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jbossas-client 0:4.3.0-8.GA_CP09.2.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jbossts 1:4.2.3-2.SP5_CP10.1jpp.ep1.1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jbossweb 0:2.0.0-7.CP15.0jpp.ep1.1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jbossws 0:2.0.1-6.SP2_CP09.2.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jbossws-common 0:1.0.0-3.GA_CP06.1.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jgroups 1:2.4.9-1.ep1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 rh-eap-docs 0:4.3.0-8.GA_CP09.ep1.3.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 rh-eap-docs-examples 0:4.3.0-8.GA_CP09.ep1.3.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 xalan-j2 0:2.7.1-4.ep1.1.el4

Vulnerabilities 3

  • High —
    CVE-2010-3708

    Drools Improper Input Validation vulnerability allows remote attackers to execute arbitrary code in JBoss EAP

    The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers…

    org.drools:drools-core Maven
  • Unscored —
    CVE-2010-3862

    The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remotin…

  • Unscored —
    CVE-2010-3878

    Cross-site request forgery (CSRF) vulnerability in the JMX Console in Red Hat JBoss Enterprise Application Platform (ak…

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    http://docs.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3/html-single/Release_Notes_CP09/index.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=604617
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=633859
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=638224
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=641389
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0937.json
  • report
    https://access.redhat.com/security/cve/CVE-2010-3708
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2010-3708
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2010-3708
  • report
    https://access.redhat.com/security/cve/CVE-2010-3862
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2010-3862
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2010-3862
  • report
    https://access.redhat.com/security/cve/CVE-2010-3878
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2010-3878
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2010-3878