From bugzilla at redhat.com Fri Mar 6 19:12:44 2009 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Fri, 6 Mar 2009 14:12:44 -0500 Subject: [RHSA-2009:0346-01] Moderate: JBoss Enterprise Application Platform 4.2.0CP06 update Message-ID: <200903061912.n26JCipQ023882@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: JBoss Enterprise Application Platform 4.2.0CP06 update Advisory ID: RHSA-2009:0346-01 Product: JBoss Enterprise Application Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2009-0346.html Issue date: 2009-03-06 CVE Names: CVE-2009-0027 ===================================================================== 1. Summary: Updated JBoss Enterprise Application Platform (JBoss EAP) 4.2 packages that fix various issues are now available for Red Hat Enterprise Linux 4 as JBEAP 4.2.0.CP06. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: JBoss Enterprise Application Platform for RHEL 4 AS - i386, noarch, x86_64 JBoss Enterprise Application Platform for RHEL 4 ES - i386, noarch, x86_64 3. Description: JBoss Enterprise Application Platform (JBoss EAP) is the market-leading platform for innovative and scalable Java applications. JBoss EAP integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam into a complete, simple enterprise solution. This release of JBoss EAP for Red Hat Enterprise Linux 4 serves as a replacement to JBEAP 4.2.0.CP05. These updated packages include bug fixes and enhancements which are detailed in the release notes. The link to the release notes is available below in the References section. The following security issue is also fixed with this release: The request handler in JBossWS did not correctly verify the resource path when serving WSDL files for custom web service endpoints. This allowed remote attackers to read arbitrary XML files with the permissions of the EAP processs. (CVE-2009-0027) Warning: before applying this update, please backup the JBoss EAP "server/[configuration]/deploy/" directory, and any other customized configuration files. All users of JBoss EAP 4.2 on Red Hat Enterprise Linux 4 are advised to upgrade to these updated packages, which resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 474619 - Tracker bug for the EAP 4.2.0.cp06 release. 479668 - CVE-2009-0027 JBoss EAP unprivileged local xml file access 6. Package List: JBoss Enterprise Application Platform for RHEL 4 AS: Source: ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/glassfish-jsf-1.2_10-0jpp.ep1.5.ep5.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/hibernate3-3.2.4-1.SP1_CP07.0jpp.ep1.14.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jacorb-2.3.0-1jpp.ep1.7.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jakarta-commons-beanutils-1.8.0-3.ep5.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jakarta-commons-fileupload-1.1.1-3jpp.ep1.2.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jakarta-commons-io-1.1-0.20051005.2jpp_1rh.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jakarta-commons-logging-jboss-1.1-4.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jboss-cache-1.4.1-6.SP11.1.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jboss-jaxr-1.2.0-SP2.0jpp.ep1.3.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jboss-remoting-2.2.2-3.SP11.0jpp.ep1.1.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jboss-seam-1.2.1-1.ep1.18.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jboss-vfs-1.0.0-1.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jbossas-4.2.0-4.GA_CP06.3.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jbossts-4.2.3-1.SP5_CP04.1jpp.ep1.1.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jbossweb-2.0.0-6.CP09.0jpp.ep1.1.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jgroups-2.4.5-2.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/rh-eap-docs-4.2.0-5.GA_CP06.ep1.3.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/tanukiwrapper-3.2.1-2jpp.ep1.2.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/ws-commons-policy-1.0-2jpp.ep1.7.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/ws-scout0-0.7-0.rc2.4.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/xalan-j2-2.7.0-2jpp.ep1.5.el4.src.rpm i386: tanukiwrapper-3.2.1-2jpp.ep1.2.el4.i386.rpm tanukiwrapper-debuginfo-3.2.1-2jpp.ep1.2.el4.i386.rpm noarch: glassfish-jsf-1.2_10-0jpp.ep1.5.ep5.el4.noarch.rpm hibernate3-3.2.4-1.SP1_CP07.0jpp.ep1.14.el4.noarch.rpm hibernate3-javadoc-3.2.4-1.SP1_CP07.0jpp.ep1.14.el4.noarch.rpm jacorb-2.3.0-1jpp.ep1.7.el4.noarch.rpm jakarta-commons-beanutils-1.8.0-3.ep5.el4.noarch.rpm jakarta-commons-fileupload-1.1.1-3jpp.ep1.2.el4.noarch.rpm jakarta-commons-io-1.1-0.20051005.2jpp_1rh.noarch.rpm jakarta-commons-logging-jboss-1.1-4.ep1.el4.noarch.rpm jboss-cache-1.4.1-6.SP11.1.ep1.el4.noarch.rpm jboss-jaxr-1.2.0-SP2.0jpp.ep1.3.el4.noarch.rpm jboss-remoting-2.2.2-3.SP11.0jpp.ep1.1.el4.noarch.rpm jboss-seam-1.2.1-1.ep1.18.el4.noarch.rpm jboss-seam-docs-1.2.1-1.ep1.18.el4.noarch.rpm jboss-vfs-1.0.0-1.ep1.el4.noarch.rpm jbossas-4.2.0-4.GA_CP06.3.ep1.el4.noarch.rpm jbossas-4.2.0.GA_CP06-bin-4.2.0-4.GA_CP06.3.ep1.el4.noarch.rpm jbossas-client-4.2.0-4.GA_CP06.3.ep1.el4.noarch.rpm jbossts-4.2.3-1.SP5_CP04.1jpp.ep1.1.el4.noarch.rpm jbossweb-2.0.0-6.CP09.0jpp.ep1.1.el4.noarch.rpm jgroups-2.4.5-2.ep1.el4.noarch.rpm rh-eap-docs-4.2.0-5.GA_CP06.ep1.3.el4.noarch.rpm rh-eap-docs-examples-4.2.0-5.GA_CP06.ep1.3.el4.noarch.rpm ws-commons-policy-1.0-2jpp.ep1.7.el4.noarch.rpm ws-scout0-0.7-0.rc2.4.el4.noarch.rpm xalan-j2-2.7.0-2jpp.ep1.5.el4.noarch.rpm x86_64: tanukiwrapper-3.2.1-2jpp.ep1.2.el4.x86_64.rpm tanukiwrapper-debuginfo-3.2.1-2jpp.ep1.2.el4.x86_64.rpm JBoss Enterprise Application Platform for RHEL 4 ES: Source: ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/glassfish-jsf-1.2_10-0jpp.ep1.5.ep5.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/hibernate3-3.2.4-1.SP1_CP07.0jpp.ep1.14.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jacorb-2.3.0-1jpp.ep1.7.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jakarta-commons-beanutils-1.8.0-3.ep5.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jakarta-commons-fileupload-1.1.1-3jpp.ep1.2.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jakarta-commons-io-1.1-0.20051005.2jpp_1rh.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jakarta-commons-logging-jboss-1.1-4.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jboss-cache-1.4.1-6.SP11.1.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jboss-jaxr-1.2.0-SP2.0jpp.ep1.3.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jboss-remoting-2.2.2-3.SP11.0jpp.ep1.1.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jboss-seam-1.2.1-1.ep1.18.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jboss-vfs-1.0.0-1.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jbossas-4.2.0-4.GA_CP06.3.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jbossts-4.2.3-1.SP5_CP04.1jpp.ep1.1.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jbossweb-2.0.0-6.CP09.0jpp.ep1.1.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jgroups-2.4.5-2.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/rh-eap-docs-4.2.0-5.GA_CP06.ep1.3.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/tanukiwrapper-3.2.1-2jpp.ep1.2.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/ws-commons-policy-1.0-2jpp.ep1.7.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/ws-scout0-0.7-0.rc2.4.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/xalan-j2-2.7.0-2jpp.ep1.5.el4.src.rpm i386: tanukiwrapper-3.2.1-2jpp.ep1.2.el4.i386.rpm tanukiwrapper-debuginfo-3.2.1-2jpp.ep1.2.el4.i386.rpm noarch: glassfish-jsf-1.2_10-0jpp.ep1.5.ep5.el4.noarch.rpm hibernate3-3.2.4-1.SP1_CP07.0jpp.ep1.14.el4.noarch.rpm hibernate3-javadoc-3.2.4-1.SP1_CP07.0jpp.ep1.14.el4.noarch.rpm jacorb-2.3.0-1jpp.ep1.7.el4.noarch.rpm jakarta-commons-beanutils-1.8.0-3.ep5.el4.noarch.rpm jakarta-commons-fileupload-1.1.1-3jpp.ep1.2.el4.noarch.rpm jakarta-commons-io-1.1-0.20051005.2jpp_1rh.noarch.rpm jakarta-commons-logging-jboss-1.1-4.ep1.el4.noarch.rpm jboss-cache-1.4.1-6.SP11.1.ep1.el4.noarch.rpm jboss-jaxr-1.2.0-SP2.0jpp.ep1.3.el4.noarch.rpm jboss-remoting-2.2.2-3.SP11.0jpp.ep1.1.el4.noarch.rpm jboss-seam-1.2.1-1.ep1.18.el4.noarch.rpm jboss-seam-docs-1.2.1-1.ep1.18.el4.noarch.rpm jboss-vfs-1.0.0-1.ep1.el4.noarch.rpm jbossas-4.2.0-4.GA_CP06.3.ep1.el4.noarch.rpm jbossas-4.2.0.GA_CP06-bin-4.2.0-4.GA_CP06.3.ep1.el4.noarch.rpm jbossas-client-4.2.0-4.GA_CP06.3.ep1.el4.noarch.rpm jbossts-4.2.3-1.SP5_CP04.1jpp.ep1.1.el4.noarch.rpm jbossweb-2.0.0-6.CP09.0jpp.ep1.1.el4.noarch.rpm jgroups-2.4.5-2.ep1.el4.noarch.rpm rh-eap-docs-4.2.0-5.GA_CP06.ep1.3.el4.noarch.rpm rh-eap-docs-examples-4.2.0-5.GA_CP06.ep1.3.el4.noarch.rpm ws-commons-policy-1.0-2jpp.ep1.7.el4.noarch.rpm ws-scout0-0.7-0.rc2.4.el4.noarch.rpm xalan-j2-2.7.0-2jpp.ep1.5.el4.noarch.rpm x86_64: tanukiwrapper-3.2.1-2jpp.ep1.2.el4.x86_64.rpm tanukiwrapper-debuginfo-3.2.1-2jpp.ep1.2.el4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0027 http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp06/html-single/readme/index.html 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2009 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFJsXWkXlSAg2UNWIIRAkzHAJ44ORPcEY/0PiSjaMLUagIfEQYq0QCeKjvl Dy/EDqU9YPwws49bJgx+qgE= =9SzC -----END PGP SIGNATURE----- From bugzilla at redhat.com Fri Mar 6 19:12:49 2009 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Fri, 6 Mar 2009 14:12:49 -0500 Subject: [RHSA-2009:0347-01] Moderate: JBoss Enterprise Application Platform 4.3.0CP04 update Message-ID: <200903061912.n26JCn8j023945@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: JBoss Enterprise Application Platform 4.3.0CP04 update Advisory ID: RHSA-2009:0347-01 Product: JBoss Enterprise Application Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2009-0347.html Issue date: 2009-03-06 CVE Names: CVE-2009-0027 ===================================================================== 1. Summary: Updated JBoss Enterprise Application Platform (JBoss EAP) 4.3 packages that fix various issues are now available for Red Hat Enterprise Linux 4 as JBEAP 4.3.0.CP04. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS - i386, noarch, x86_64 JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES - i386, noarch, x86_64 3. Description: JBoss Enterprise Application Platform (JBoss EAP) is the market-leading platform for innovative and scalable Java applications. JBoss EAP integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam into a complete, simple enterprise solution. This release of JBoss EAP for Red Hat Enterprise Linux 4 serves as a replacement for JBEAP 4.3.0.CP03. These updated packages include bug fixes and enhancements which are detailed in the release notes. The link to the release notes is available in the References section of this errata. The following security issue is also fixed with this release: The request handler in JBossWS did not correctly verify the resource path when serving WSDL files for custom web service endpoints. This allowed remote attackers to read arbitrary XML files with the permissions of the EAP process. (CVE-2009-0027) Warning: before applying this update, please back up the JBoss EAP "server/[configuration]/deploy/" directory, and any other customized configuration files. All users of JBoss EAP 4.3 on Red Hat Enterprise Linux 4 are advised to upgrade to these updated packages, which resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 474622 - Tracker bug for the EAP 4.3.0.cp04 release. 479668 - CVE-2009-0027 JBoss EAP unprivileged local xml file access 6. Package List: JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS: Source: ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/glassfish-jaxb-2.1.4-1.6.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/glassfish-jsf-1.2_10-0jpp.ep1.5.ep5.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/hibernate3-3.2.4-1.SP1_CP07.0jpp.ep1.14.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jacorb-2.3.0-1jpp.ep1.7.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jakarta-commons-beanutils-1.8.0-3.ep5.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jakarta-commons-fileupload-1.1.1-3jpp.ep1.2.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jakarta-commons-io-1.1-0.20051005.2jpp_1rh.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jakarta-commons-logging-jboss-1.1-4.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jboss-cache-1.4.1-6.SP11.1.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jboss-jaxr-1.2.0-SP2.0jpp.ep1.3.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jboss-messaging-1.4.0-2.SP3_CP07.1.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jboss-remoting-2.2.2-3.SP11.0jpp.ep1.1.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jboss-seam-1.2.1-3.JBPAPP_4_3_0_GA.ep1.14.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jboss-vfs-1.0.0-1.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jbossas-4.3.0-3.GA_CP04.3.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jbossts-4.2.3-1.SP5_CP04.1jpp.ep1.1.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jbossweb-2.0.0-6.CP09.0jpp.ep1.1.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jbossws-2.0.1-3.SP2_CP05.4.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jbossws-common-1.0.0-2.GA_CP03.1.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jbossws-framework-2.0.1-1.GA_CP03.2.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jgroups-2.4.5-2.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/rh-eap-docs-4.3.0-4.GA_CP04.ep1.3.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/tanukiwrapper-3.2.1-2jpp.ep1.2.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/ws-commons-policy-1.0-2jpp.ep1.7.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/ws-scout0-0.7-0.rc2.4.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/xalan-j2-2.7.0-2jpp.ep1.5.el4.src.rpm i386: tanukiwrapper-3.2.1-2jpp.ep1.2.el4.i386.rpm tanukiwrapper-debuginfo-3.2.1-2jpp.ep1.2.el4.i386.rpm noarch: glassfish-jaxb-2.1.4-1.6.ep1.el4.noarch.rpm glassfish-jaxb-javadoc-2.1.4-1.6.ep1.el4.noarch.rpm glassfish-jsf-1.2_10-0jpp.ep1.5.ep5.el4.noarch.rpm hibernate3-3.2.4-1.SP1_CP07.0jpp.ep1.14.el4.noarch.rpm hibernate3-javadoc-3.2.4-1.SP1_CP07.0jpp.ep1.14.el4.noarch.rpm jacorb-2.3.0-1jpp.ep1.7.el4.noarch.rpm jakarta-commons-beanutils-1.8.0-3.ep5.el4.noarch.rpm jakarta-commons-fileupload-1.1.1-3jpp.ep1.2.el4.noarch.rpm jakarta-commons-io-1.1-0.20051005.2jpp_1rh.noarch.rpm jakarta-commons-logging-jboss-1.1-4.ep1.el4.noarch.rpm jboss-cache-1.4.1-6.SP11.1.ep1.el4.noarch.rpm jboss-jaxr-1.2.0-SP2.0jpp.ep1.3.el4.noarch.rpm jboss-messaging-1.4.0-2.SP3_CP07.1.ep1.el4.noarch.rpm jboss-remoting-2.2.2-3.SP11.0jpp.ep1.1.el4.noarch.rpm jboss-seam-1.2.1-3.JBPAPP_4_3_0_GA.ep1.14.el4.noarch.rpm jboss-seam-docs-1.2.1-3.JBPAPP_4_3_0_GA.ep1.14.el4.noarch.rpm jboss-vfs-1.0.0-1.ep1.el4.noarch.rpm jbossas-4.3.0-3.GA_CP04.3.ep1.el4.noarch.rpm jbossas-4.3.0.GA_CP04-bin-4.3.0-3.GA_CP04.3.ep1.el4.noarch.rpm jbossas-client-4.3.0-3.GA_CP04.3.ep1.el4.noarch.rpm jbossts-4.2.3-1.SP5_CP04.1jpp.ep1.1.el4.noarch.rpm jbossweb-2.0.0-6.CP09.0jpp.ep1.1.el4.noarch.rpm jbossws-2.0.1-3.SP2_CP05.4.ep1.el4.noarch.rpm jbossws-common-1.0.0-2.GA_CP03.1.ep1.el4.noarch.rpm jbossws-framework-2.0.1-1.GA_CP03.2.ep1.el4.noarch.rpm jgroups-2.4.5-2.ep1.el4.noarch.rpm rh-eap-docs-4.3.0-4.GA_CP04.ep1.3.el4.noarch.rpm rh-eap-docs-examples-4.3.0-4.GA_CP04.ep1.3.el4.noarch.rpm ws-commons-policy-1.0-2jpp.ep1.7.el4.noarch.rpm ws-scout0-0.7-0.rc2.4.el4.noarch.rpm xalan-j2-2.7.0-2jpp.ep1.5.el4.noarch.rpm x86_64: tanukiwrapper-3.2.1-2jpp.ep1.2.el4.x86_64.rpm tanukiwrapper-debuginfo-3.2.1-2jpp.ep1.2.el4.x86_64.rpm JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES: Source: ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/glassfish-jaxb-2.1.4-1.6.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/glassfish-jsf-1.2_10-0jpp.ep1.5.ep5.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/hibernate3-3.2.4-1.SP1_CP07.0jpp.ep1.14.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jacorb-2.3.0-1jpp.ep1.7.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jakarta-commons-beanutils-1.8.0-3.ep5.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jakarta-commons-fileupload-1.1.1-3jpp.ep1.2.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jakarta-commons-io-1.1-0.20051005.2jpp_1rh.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jakarta-commons-logging-jboss-1.1-4.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jboss-cache-1.4.1-6.SP11.1.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jboss-jaxr-1.2.0-SP2.0jpp.ep1.3.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jboss-messaging-1.4.0-2.SP3_CP07.1.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jboss-remoting-2.2.2-3.SP11.0jpp.ep1.1.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jboss-seam-1.2.1-3.JBPAPP_4_3_0_GA.ep1.14.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jboss-vfs-1.0.0-1.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jbossas-4.3.0-3.GA_CP04.3.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jbossts-4.2.3-1.SP5_CP04.1jpp.ep1.1.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jbossweb-2.0.0-6.CP09.0jpp.ep1.1.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jbossws-2.0.1-3.SP2_CP05.4.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jbossws-common-1.0.0-2.GA_CP03.1.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jbossws-framework-2.0.1-1.GA_CP03.2.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jgroups-2.4.5-2.ep1.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/rh-eap-docs-4.3.0-4.GA_CP04.ep1.3.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/tanukiwrapper-3.2.1-2jpp.ep1.2.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/ws-commons-policy-1.0-2jpp.ep1.7.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/ws-scout0-0.7-0.rc2.4.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/xalan-j2-2.7.0-2jpp.ep1.5.el4.src.rpm i386: tanukiwrapper-3.2.1-2jpp.ep1.2.el4.i386.rpm tanukiwrapper-debuginfo-3.2.1-2jpp.ep1.2.el4.i386.rpm noarch: glassfish-jaxb-2.1.4-1.6.ep1.el4.noarch.rpm glassfish-jaxb-javadoc-2.1.4-1.6.ep1.el4.noarch.rpm glassfish-jsf-1.2_10-0jpp.ep1.5.ep5.el4.noarch.rpm hibernate3-3.2.4-1.SP1_CP07.0jpp.ep1.14.el4.noarch.rpm hibernate3-javadoc-3.2.4-1.SP1_CP07.0jpp.ep1.14.el4.noarch.rpm jacorb-2.3.0-1jpp.ep1.7.el4.noarch.rpm jakarta-commons-beanutils-1.8.0-3.ep5.el4.noarch.rpm jakarta-commons-fileupload-1.1.1-3jpp.ep1.2.el4.noarch.rpm jakarta-commons-io-1.1-0.20051005.2jpp_1rh.noarch.rpm jakarta-commons-logging-jboss-1.1-4.ep1.el4.noarch.rpm jboss-cache-1.4.1-6.SP11.1.ep1.el4.noarch.rpm jboss-jaxr-1.2.0-SP2.0jpp.ep1.3.el4.noarch.rpm jboss-messaging-1.4.0-2.SP3_CP07.1.ep1.el4.noarch.rpm jboss-remoting-2.2.2-3.SP11.0jpp.ep1.1.el4.noarch.rpm jboss-seam-1.2.1-3.JBPAPP_4_3_0_GA.ep1.14.el4.noarch.rpm jboss-seam-docs-1.2.1-3.JBPAPP_4_3_0_GA.ep1.14.el4.noarch.rpm jboss-vfs-1.0.0-1.ep1.el4.noarch.rpm jbossas-4.3.0-3.GA_CP04.3.ep1.el4.noarch.rpm jbossas-4.3.0.GA_CP04-bin-4.3.0-3.GA_CP04.3.ep1.el4.noarch.rpm jbossas-client-4.3.0-3.GA_CP04.3.ep1.el4.noarch.rpm jbossts-4.2.3-1.SP5_CP04.1jpp.ep1.1.el4.noarch.rpm jbossweb-2.0.0-6.CP09.0jpp.ep1.1.el4.noarch.rpm jbossws-2.0.1-3.SP2_CP05.4.ep1.el4.noarch.rpm jbossws-common-1.0.0-2.GA_CP03.1.ep1.el4.noarch.rpm jbossws-framework-2.0.1-1.GA_CP03.2.ep1.el4.noarch.rpm jgroups-2.4.5-2.ep1.el4.noarch.rpm rh-eap-docs-4.3.0-4.GA_CP04.ep1.3.el4.noarch.rpm rh-eap-docs-examples-4.3.0-4.GA_CP04.ep1.3.el4.noarch.rpm ws-commons-policy-1.0-2jpp.ep1.7.el4.noarch.rpm ws-scout0-0.7-0.rc2.4.el4.noarch.rpm xalan-j2-2.7.0-2jpp.ep1.5.el4.noarch.rpm x86_64: tanukiwrapper-3.2.1-2jpp.ep1.2.el4.x86_64.rpm tanukiwrapper-debuginfo-3.2.1-2jpp.ep1.2.el4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0027 http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3.0.cp04/html-single/readme/index.html 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2009 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFJsXWsXlSAg2UNWIIRApp+AKCgyZpEe2P9hSlaNRQzQ0gaJmuJUACgtb4r WJsSq6H2c4cCcIp4aR+1QmM= =Yc3p -----END PGP SIGNATURE----- From bugzilla at redhat.com Fri Mar 6 19:12:58 2009 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Fri, 6 Mar 2009 14:12:58 -0500 Subject: [RHSA-2009:0348-01] Moderate: JBoss Enterprise Application Platform 4.2.0CP06 update Message-ID: <200903061912.n26JCxD6024014@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: JBoss Enterprise Application Platform 4.2.0CP06 update Advisory ID: RHSA-2009:0348-01 Product: JBoss Enterprise Application Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2009-0348.html Issue date: 2009-03-06 CVE Names: CVE-2009-0027 ===================================================================== 1. Summary: Updated JBoss Enterprise Application Platform (JBoss EAP) 4.2 packages that fix various issues are now available for Red Hat Enterprise Linux 5 as JBEAP 4.2.0.CP06. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: JBoss Enterprise Application Platform for RHEL 5 Server - i386, noarch, x86_64 3. Description: JBoss Enterprise Application Platform (JBoss EAP) is the market-leading platform for innovative and scalable Java applications. JBoss EAP integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam into a complete, simple enterprise solution. This release of JBoss EAP for Red Hat Enterprise Linux 5 serves as a replacement for JBEAP 4.2.0.CP05. These updated packages include bug fixes and enhancements which are detailed in the release notes. The link to the release notes is available below in the References section. The following security issue is also fixed with this release: The request handler in JBossWS did not correctly verify the resource path when serving WSDL files for custom web service endpoints. This allowed remote attackers to read arbitrary XML files with the permissions of the EAP process. (CVE-2009-0027) Warning: before applying this update, make sure to back up the JBEAP "server/[configuration]/deploy/" directory, as well as any other customized configuration files. All users of JBoss EAP 4.2 on Red Hat Enterprise Linux 5 are advised to upgrade to these updated packages, which resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 475211 - Tracker bug for the EAP 4.2.0.cp06 release for RHEL-5. 479668 - CVE-2009-0027 JBoss EAP unprivileged local xml file access 6. Package List: JBoss Enterprise Application Platform for RHEL 5 Server: Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/glassfish-jsf-1.2_10-0jpp.ep1.5.ep5.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/hibernate3-3.2.4-1.SP1_CP07.0jpp.ep1.14.1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jacorb-2.3.0-1jpp.ep1.7.1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jakarta-commons-logging-jboss-1.1-4.1.ep1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-cache-1.4.1-6.SP11.1.ep1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-jaxr-1.2.0-SP2.0jpp.ep1.3.2.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-remoting-2.2.2-3.SP11.0jpp.ep1.1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-seam-1.2.1-1.ep1.12.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-vfs-1.0.0-1.ep1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossas-4.2.0-4.GA_CP06.3.1.ep1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossts-4.2.3-1.SP5_CP04.1jpp.ep1.2.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossweb-2.0.0-6.CP09.0jpp.ep1.1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossws-jboss42-1.2.1-1.1.ep1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jgroups-2.4.5-2.1.ep1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/rh-eap-docs-4.2.0-5.GA_CP06.ep1.3.1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/tanukiwrapper-3.2.1-2jpp.ep1.2.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/ws-commons-policy-1.0-2jpp.ep1.7.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/ws-scout0-0.7-0.rc2.4.el5.src.rpm i386: tanukiwrapper-3.2.1-2jpp.ep1.2.el5.i386.rpm tanukiwrapper-debuginfo-3.2.1-2jpp.ep1.2.el5.i386.rpm noarch: glassfish-jsf-1.2_10-0jpp.ep1.5.ep5.el5.noarch.rpm hibernate3-3.2.4-1.SP1_CP07.0jpp.ep1.14.1.el5.noarch.rpm hibernate3-javadoc-3.2.4-1.SP1_CP07.0jpp.ep1.14.1.el5.noarch.rpm jacorb-2.3.0-1jpp.ep1.7.1.el5.noarch.rpm jakarta-commons-logging-jboss-1.1-4.1.ep1.el5.noarch.rpm jboss-cache-1.4.1-6.SP11.1.ep1.el5.noarch.rpm jboss-jaxr-1.2.0-SP2.0jpp.ep1.3.2.el5.noarch.rpm jboss-remoting-2.2.2-3.SP11.0jpp.ep1.1.el5.noarch.rpm jboss-seam-1.2.1-1.ep1.12.el5.noarch.rpm jboss-seam-docs-1.2.1-1.ep1.12.el5.noarch.rpm jboss-vfs-1.0.0-1.ep1.el5.noarch.rpm jbossas-4.2.0-4.GA_CP06.3.1.ep1.el5.noarch.rpm jbossas-4.2.0.GA_CP06-bin-4.2.0-4.GA_CP06.3.1.ep1.el5.noarch.rpm jbossas-client-4.2.0-4.GA_CP06.3.1.ep1.el5.noarch.rpm jbossts-4.2.3-1.SP5_CP04.1jpp.ep1.2.el5.noarch.rpm jbossweb-2.0.0-6.CP09.0jpp.ep1.1.el5.noarch.rpm jbossws-jboss42-1.2.1-1.1.ep1.el5.noarch.rpm jgroups-2.4.5-2.1.ep1.el5.noarch.rpm rh-eap-docs-4.2.0-5.GA_CP06.ep1.3.1.el5.noarch.rpm rh-eap-docs-examples-4.2.0-5.GA_CP06.ep1.3.1.el5.noarch.rpm ws-commons-policy-1.0-2jpp.ep1.7.el5.noarch.rpm ws-scout0-0.7-0.rc2.4.el5.noarch.rpm x86_64: tanukiwrapper-3.2.1-2jpp.ep1.2.el5.x86_64.rpm tanukiwrapper-debuginfo-3.2.1-2jpp.ep1.2.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0027 http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp06/html-single/readme/index.html 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2009 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFJsXWwXlSAg2UNWIIRAjQPAKCEnkJwSc2UOWTdVko/zDvVOxNupACfUunK JSPoLuXwvMEg2kAo8uM0c3I= =BbXt -----END PGP SIGNATURE----- From bugzilla at redhat.com Fri Mar 6 19:13:11 2009 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Fri, 6 Mar 2009 14:13:11 -0500 Subject: [RHSA-2009:0349-01] Moderate: JBoss Enterprise Application Platform 4.3.0CP04 update Message-ID: <200903061913.n26JDB3P024134@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: JBoss Enterprise Application Platform 4.3.0CP04 update Advisory ID: RHSA-2009:0349-01 Product: JBoss Enterprise Application Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2009-0349.html Issue date: 2009-03-06 CVE Names: CVE-2009-0027 ===================================================================== 1. Summary: Updated JBoss Enterprise Application Platform (JBoss EAP) 4.3 packages that fix various issues are now available for Red Hat Enterprise Linux 5 as JBEAP 4.3.0.CP04. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server - i386, noarch, x86_64 3. Description: JBoss Enterprise Application Platform (JBoss EAP) is the market-leading platform for innovative and scalable Java applications. JBoss EAP integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam into a complete, simple enterprise solution. This release of JBoss EAP for Red Hat Enterprise Linux 5 serves as a replacement for JBEAP 4.3.0.CP03. These updated packages include bug fixes and enhancements which are detailed in the release notes. The link to the release notes is available in the References section of this errata. The following security issue is also fixed with this release: The request handler in JBossWS did not correctly verify the resource path when serving WSDL files for custom web service endpoints. This allowed remote attackers to read arbitrary XML files with the permissions of the EAP process. (CVE-2009-0027) Warning: before applying this update, please back up the JBoss EAP "server/[configuration]/deploy/" directory, as well as any other customized configuration files. All users of JBoss EAP 4.3 on Red Hat Enterprise Linux 5 are advised to upgrade to these updated packages, which resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 475258 - Tracker bug for the EAP 4.3.0.cp04 release for RHEL-5. 479668 - CVE-2009-0027 JBoss EAP unprivileged local xml file access 6. Package List: JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server: Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/glassfish-jaxb-2.1.4-1.6.1.ep1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/glassfish-jsf-1.2_10-0jpp.ep1.5.ep5.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/hibernate3-3.2.4-1.SP1_CP07.0jpp.ep1.14.1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jacorb-2.3.0-1jpp.ep1.7.1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jakarta-commons-logging-jboss-1.1-4.1.ep1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-cache-1.4.1-6.SP11.1.ep1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-jaxr-1.2.0-SP2.0jpp.ep1.3.2.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-messaging-1.4.0-2.SP3_CP07.1.ep1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-remoting-2.2.2-3.SP11.0jpp.ep1.1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-seam-1.2.1-3.JBPAPP_4_3_0_GA.ep1.10.el5.1.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-vfs-1.0.0-1.ep1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossas-4.3.0-3.GA_CP04.2.1.ep1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossts-4.2.3-1.SP5_CP04.1jpp.ep1.2.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossweb-2.0.0-6.CP09.0jpp.ep1.1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossws-2.0.1-3.SP2_CP05.3.1.ep1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossws-common-1.0.0-2.GA_CP03.1.ep1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossws-framework-2.0.1-1.GA_CP03.2.ep1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jgroups-2.4.5-2.1.ep1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/rh-eap-docs-4.3.0-4.GA_CP04.ep1.3.1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/tanukiwrapper-3.2.1-2jpp.ep1.2.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/ws-commons-policy-1.0-2jpp.ep1.7.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/ws-scout0-0.7-0.rc2.4.el5.src.rpm i386: tanukiwrapper-3.2.1-2jpp.ep1.2.el5.i386.rpm tanukiwrapper-debuginfo-3.2.1-2jpp.ep1.2.el5.i386.rpm noarch: glassfish-jaxb-2.1.4-1.6.1.ep1.el5.noarch.rpm glassfish-jaxb-javadoc-2.1.4-1.6.1.ep1.el5.noarch.rpm glassfish-jsf-1.2_10-0jpp.ep1.5.ep5.el5.noarch.rpm hibernate3-3.2.4-1.SP1_CP07.0jpp.ep1.14.1.el5.noarch.rpm hibernate3-javadoc-3.2.4-1.SP1_CP07.0jpp.ep1.14.1.el5.noarch.rpm jacorb-2.3.0-1jpp.ep1.7.1.el5.noarch.rpm jakarta-commons-logging-jboss-1.1-4.1.ep1.el5.noarch.rpm jboss-cache-1.4.1-6.SP11.1.ep1.el5.noarch.rpm jboss-jaxr-1.2.0-SP2.0jpp.ep1.3.2.el5.noarch.rpm jboss-messaging-1.4.0-2.SP3_CP07.1.ep1.el5.noarch.rpm jboss-remoting-2.2.2-3.SP11.0jpp.ep1.1.el5.noarch.rpm jboss-seam-1.2.1-3.JBPAPP_4_3_0_GA.ep1.10.el5.1.noarch.rpm jboss-seam-docs-1.2.1-3.JBPAPP_4_3_0_GA.ep1.10.el5.1.noarch.rpm jboss-vfs-1.0.0-1.ep1.el5.noarch.rpm jbossas-4.3.0-3.GA_CP04.2.1.ep1.el5.noarch.rpm jbossas-4.3.0.GA_CP04-bin-4.3.0-3.GA_CP04.2.1.ep1.el5.noarch.rpm jbossas-client-4.3.0-3.GA_CP04.2.1.ep1.el5.noarch.rpm jbossts-4.2.3-1.SP5_CP04.1jpp.ep1.2.el5.noarch.rpm jbossweb-2.0.0-6.CP09.0jpp.ep1.1.el5.noarch.rpm jbossws-2.0.1-3.SP2_CP05.3.1.ep1.el5.noarch.rpm jbossws-common-1.0.0-2.GA_CP03.1.ep1.el5.noarch.rpm jbossws-framework-2.0.1-1.GA_CP03.2.ep1.el5.noarch.rpm jgroups-2.4.5-2.1.ep1.el5.noarch.rpm rh-eap-docs-4.3.0-4.GA_CP04.ep1.3.1.el5.noarch.rpm rh-eap-docs-examples-4.3.0-4.GA_CP04.ep1.3.1.el5.noarch.rpm ws-commons-policy-1.0-2jpp.ep1.7.el5.noarch.rpm ws-scout0-0.7-0.rc2.4.el5.noarch.rpm x86_64: tanukiwrapper-3.2.1-2jpp.ep1.2.el5.x86_64.rpm tanukiwrapper-debuginfo-3.2.1-2jpp.ep1.2.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0027 http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3.0.cp04/html-single/readme/index.html 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2009 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFJsXW5XlSAg2UNWIIRAkOzAKCthhFgScWjaiYVnZ3xuAm70bMZPQCfeeQV yjol3NEXBPKRThjXVF+yElQ= =0q3D -----END PGP SIGNATURE-----