Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 update

Fixed packages 151

Vulnerabilities 14

• Medium 5.9
  CVE-2011-2487

  Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J

  The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.

  Red Hat Apache JBossWS WSS4J Maven
  Mar 11, 2020
• Unscored —
  CVE-2009-5066

  twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local us…

  Aug 13, 2012
• Unscored —
  CVE-2011-1096

  The W3C XML Encryption Standard, as used in the JBoss Web Services (JBossWS) component in JBoss Enterprise Portal Platf…

  Nov 23, 2012
• High —
  CVE-2011-2730 EPSS 12%

  Improper Neutralization of Directives in Dynamically Evaluated Code in Spring Framework

  VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) nam…

  org.springframework:spring-core Maven
  Dec 5, 2012
• Unscored —
  CVE-2011-2908

  Cross-site request forgery (CSRF) vulnerability in the JMX Console (jmx-console) in JBoss Enterprise Portal Platform be…

  Nov 23, 2012
• Unscored —
  CVE-2011-4575

  Cross-site scripting (XSS) vulnerability in the JMX console in JBoss Enterprise Application Platform (EAP) before 5.2.0…

  Feb 5, 2013
• Unscored —
  CVE-2012-0034

  The NonManagedConnectionFactory in JBoss Enterprise Application Platform (EAP) 5.1.2 and 5.2.0, Web Platform (EWP) 5.1.…

  Feb 5, 2013
• Unscored —
  CVE-2012-0874 Public exploit EPSS 16%

  The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP)…

  Feb 5, 2013
• Unscored —
  CVE-2012-2377

  JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platf…

  Nov 23, 2012
• High —
  CVE-2012-2379

  XML Signature/Encryption Not Validated in Apache CXF

  Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and att…

  org.apache.cxf:cxf Maven
  Jan 3, 2013
• Unscored —
  CVE-2012-3369

  The CallerIdentityLoginModule in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.…

  Feb 5, 2013
• Unscored —
  CVE-2012-3370

  The SecurityAssociation.getCredential method in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform …

  Feb 5, 2013
• Medium —
  CVE-2012-3546 EPSS 12%

  Authentication Bypass in Apache Tomcat

  org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /…

  org.apache.tomcat:tomcat Maven
  Dec 19, 2012
• Unscored —
  CVE-2012-5478

  The AuthorizationInterceptor in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2…

  Feb 5, 2013

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/knowledge/docs/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=681916
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=713539
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=730176
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=737608
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=760387
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=772835
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=795645
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=823392
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=826534
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=836451
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=836456
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=842477
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=848486
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=874349
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=883634
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0191.json
• report
  https://access.redhat.com/security/cve/CVE-2009-5066
• advisory
  https://www.cve.org/CVERecord?id=CVE-2009-5066
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2009-5066
• report
  https://access.redhat.com/security/cve/CVE-2011-1096
• advisory
  https://www.cve.org/CVERecord?id=CVE-2011-1096
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2011-1096
• report
  https://access.redhat.com/security/cve/CVE-2011-2487
• advisory
  https://www.cve.org/CVERecord?id=CVE-2011-2487
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2011-2487
• article
  https://www.nds.ruhr-uni-bochum.de/research/publications/breaking-xml-encryption-pkcs15/
• report
  https://access.redhat.com/security/cve/CVE-2011-2730
• advisory
  https://www.cve.org/CVERecord?id=CVE-2011-2730
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2011-2730
• report
  https://access.redhat.com/security/cve/CVE-2011-2908
• advisory
  https://www.cve.org/CVERecord?id=CVE-2011-2908
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2011-2908
• report
  https://access.redhat.com/security/cve/CVE-2011-4575
• advisory
  https://www.cve.org/CVERecord?id=CVE-2011-4575
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2011-4575
• report
  https://access.redhat.com/security/cve/CVE-2012-0034
• advisory
  https://www.cve.org/CVERecord?id=CVE-2012-0034