Skip to content
OpenAdvisories
Unscored RHSA-2013:0873 1 CVE

Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 security update

Published Sep 29, 2024 · Updated May 15, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el4 apache-cxf 0:2.2.12-12.patch_07.ep5.el4
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el4 jbossws 0:3.1.2-14.SP15_patch_02.ep5.el4
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el4 wss4j 0:1.5.12-6_patch_03.ep5.el4
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el5 apache-cxf 0:2.2.12-12.patch_07.ep5.el5
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el5 jbossws 0:3.1.2-14.SP15_patch_02.ep5.el5
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el5 wss4j 0:1.5.12-6_patch_03.ep5.el5
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el6 apache-cxf 0:2.2.12-12.patch_07.ep5.el6
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el6 jbossws 0:3.1.2-14.SP15_patch_02.ep5.el6
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el6 wss4j 0:1.5.12-6_patch_03.ep5.el6

Vulnerabilities 1

  • Medium —
    CVE-2012-5575 Public exploit

    Inadequate Encryption Strength in Apache CXF

    Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force…

    org.apache.cxf:cxf-rt-transports-http Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    http://ws.apache.org/wss4j/best_practice.html
  • article
    http://cxf.apache.org/cve-2012-5575.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=880443
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0873.json
  • report
    https://access.redhat.com/security/cve/CVE-2012-5575
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5575
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5575
  • article
    http://www.nds.ruhr-uni-bochum.de/research/publications/backwards-compatibility/