Skip to content
OpenAdvisories
Unscored RHSA-2012:1052 1 CVE

Red Hat Security Advisory: mod_cluster security update

Published Sep 15, 2024 · Updated Nov 22, 2025

Ecosystem: Red Hat

Fixed packages 15

ReleasePackageFixed in
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el4 mod_cluster 0:1.0.10-4.GA_CP02_patch01.ep5.el4
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el4 mod_cluster-demo 0:1.0.10-4.GA_CP02_patch01.ep5.el4
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el4 mod_cluster-jbossas 0:1.0.10-4.GA_CP02_patch01.ep5.el4
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el4 mod_cluster-jbossweb2 0:1.0.10-4.GA_CP02_patch01.ep5.el4
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el4 mod_cluster-tomcat6 0:1.0.10-4.GA_CP02_patch01.ep5.el4
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el5 mod_cluster 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el5 mod_cluster-demo 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el5 mod_cluster-jbossas 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el5 mod_cluster-jbossweb2 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el5 mod_cluster-tomcat6 0:1.0.10-4.1.GA_CP02_patch01.ep5.el5
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el6 mod_cluster 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el6 mod_cluster-demo 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el6 mod_cluster-jbossas 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el6 mod_cluster-jbossweb2 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el6 mod_cluster-tomcat6 0:1.0.10-4.1.GA_CP02_patch01.ep5.el6

Vulnerabilities 1

  • Medium —
    CVE-2012-1154

    Improper Access Control in JBoss mod_cluster

    mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions a…

    org.jboss.mod_cluster:mod_cluster Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://rhn.redhat.com/errata/RHSA-2011-1800.html
  • article
    https://rhn.redhat.com/errata/RHSA-2011-1799.html
  • article
    https://rhn.redhat.com/errata/RHSA-2011-1798.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=802200
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1052.json
  • report
    https://access.redhat.com/security/cve/CVE-2012-1154
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-1154
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-1154