Skip to content
OpenAdvisories
Unscored RHSA-2010:0938 3 CVEs

Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP09 update

Published Sep 15, 2024 · Updated Nov 22, 2025

Ecosystem: Red Hat

Fixed packages 26

ReleasePackageFixed in
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 glassfish-jaxb 0:2.1.4-1.17.patch04.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 glassfish-jaxws 0:2.1.1-1jpp.ep1.13.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 hibernate3 1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 hibernate3-annotations 0:3.3.1-2.0.GA_CP04.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 hibernate3-annotations-javadoc 0:3.3.1-2.0.GA_CP04.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 hibernate3-javadoc 1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 javassist 0:3.9.0-2.ep1.1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 jboss-common 0:1.2.2-1.ep1.1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 jboss-messaging 0:1.4.0-4.SP3_CP11.1.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 jboss-remoting 0:2.2.3-4.SP3.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 jboss-seam 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.22.el5.1
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 jboss-seam-docs 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.22.el5.1
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 jboss-seam2 0:2.0.2.FP-1.ep1.26.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 jboss-seam2-docs 0:2.0.2.FP-1.ep1.26.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 jbossas 0:4.3.0-8.GA_CP09.2.1.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 jbossas-4.3.0.GA_CP09-bin 0:4.3.0-8.GA_CP09.2.1.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 jbossas-client 0:4.3.0-8.GA_CP09.2.1.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 jbossts 1:4.2.3-2.SP5_CP10.1jpp.ep1.1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 jbossweb 0:2.0.0-7.CP15.0jpp.ep1.1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 jbossws 0:2.0.1-6.SP2_CP09.2.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 jbossws-common 0:1.0.0-3.GA_CP06.1.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 jgroups 1:2.4.9-1.ep1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 quartz 0:1.5.2-1jpp.patch01.ep1.4.2.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 rh-eap-docs 0:4.3.0-8.GA_CP09.ep1.3.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 rh-eap-docs-examples 0:4.3.0-8.GA_CP09.ep1.3.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 xalan-j2 0:2.7.1-4.ep1.1.el5

Vulnerabilities 3

  • High —
    CVE-2010-3708

    Drools Improper Input Validation vulnerability allows remote attackers to execute arbitrary code in JBoss EAP

    The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers…

    org.drools:drools-core Maven
  • Unscored —
    CVE-2010-3862

    The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remotin…

  • Unscored —
    CVE-2010-3878

    Cross-site request forgery (CSRF) vulnerability in the JMX Console in Red Hat JBoss Enterprise Application Platform (ak…

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    http://docs.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3/html-single/Release_Notes_CP09/index.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=604617
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=633859
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=638236
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=641389
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0938.json
  • report
    https://access.redhat.com/security/cve/CVE-2010-3708
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2010-3708
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2010-3708
  • report
    https://access.redhat.com/security/cve/CVE-2010-3862
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2010-3862
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2010-3862
  • report
    https://access.redhat.com/security/cve/CVE-2010-3878
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2010-3878
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2010-3878