Skip to content
OpenAdvisories
Unscored RHSA-2014:0885 1 CVE

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2.0 security update

Published Sep 15, 2024 · Updated Jan 29, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el4 picketlink-federation 0:2.1.5-3_patch_01.ep5.el4
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el5 picketlink-federation 0:2.1.5-3_patch_01.ep5.el5
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el6 picketlink-federation 0:2.1.5-3_patch_01.el6_5

Vulnerabilities 1

  • High —
    CVE-2014-3530

    XML External Entity Reference in org.picketlink:picketlink-common

    The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and p…

    org.picketlink:picketlink-common Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1112987
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0885.json
  • report
    https://access.redhat.com/security/cve/CVE-2014-3530
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-3530
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-3530