Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 | apache-cxf | 0:2.7.12-1.SP1_redhat_5.1.ep6.el5 |
| Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 | wss4j | 0:1.6.16-2.redhat_3.1.ep6.el5 |
| Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el6 | apache-cxf | 0:2.7.12-1.SP1_redhat_5.1.ep6.el6 |
| Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el6 | wss4j | 0:1.6.16-2.redhat_3.1.ep6.el6 |
| Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 | apache-cxf | 0:2.7.12-1.SP1_redhat_5.1.ep6.el7 |
| Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 | wss4j | 0:1.6.16-2.redhat_3.1.ep6.el7 |
Vulnerabilities 3
-
High —
Improper certificate validation in org.apache.httpcomponents:httpclient
http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-m…
-
Medium —
Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of th…
-
Medium —
Improper Authentication in Apache WSS4J
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to …
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1129074
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1129916
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1157304
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_2019.json
-
report
https://access.redhat.com/security/cve/CVE-2012-6153
-
advisory
https://www.cve.org/CVERecord?id=CVE-2012-6153
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2012-6153
-
report
https://access.redhat.com/security/cve/CVE-2014-3577
-
advisory
https://www.cve.org/CVERecord?id=CVE-2014-3577
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2014-3577
-
report
https://access.redhat.com/security/cve/CVE-2014-3623
-
advisory
https://www.cve.org/CVERecord?id=CVE-2014-3623
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2014-3623