From bugzilla at redhat.com Tue Jul 1 15:07:55 2014 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Tue, 1 Jul 2014 15:07:55 +0000 Subject: [RHSA-2014:0825-01] Moderate: Red Hat JBoss Enterprise Application Platform 6.2 httpd security update Message-ID: <201407011507.s61F7ui1009947@int-mx11.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat JBoss Enterprise Application Platform 6.2 httpd security update Advisory ID: RHSA-2014:0825-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0825.html Issue date: 2014-07-01 CVE Names: CVE-2013-6438 CVE-2014-0098 ===================================================================== 1. Summary: An update for the Apache HTTP Server packages for Red Hat JBoss Enterprise Application Platform 6.2 that fixes two security issues are now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Description: Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was found that the mod_dav module did not correctly strip leading white space from certain elements in a parsed XML. In certain httpd configurations that use the mod_dav module (for example when using the mod_dav_svn module), a remote attacker could send a specially crafted DAV request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the "apache" user. (CVE-2013-6438) A buffer over-read flaw was found in the httpd mod_log_config module. In configurations where cookie logging is enabled, a remote attacker could use this flaw to crash the httpd child process via an HTTP request with a malformed cookie header. (CVE-2014-0098) All users of the httpd packages for Red Hat JBoss Enterprise Application Platform 6.2 as provided from the Red Hat Customer Portal are advised to apply this update. The JBoss server process must be restarted for the update to take effect. 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. 4. Bugs fixed (https://bugzilla.redhat.com/): 1077867 - CVE-2013-6438 httpd: mod_dav denial of service via crafted DAV WRITE request 1077871 - CVE-2014-0098 httpd: mod_log_config does not properly handle logging certain cookies resulting in DoS 5. References: https://www.redhat.com/security/data/cve/CVE-2013-6438.html https://www.redhat.com/security/data/cve/CVE-2014-0098.html https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=6.2.0 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTss6kXlSAg2UNWIIRAv3FAKCFHwy5itOZW31LxcYKaosma8FbQwCbBbEF JUBf6TsZYS+z8feHnoRaxmI= =v0N6 -----END PGP SIGNATURE----- From bugzilla at redhat.com Tue Jul 1 15:08:57 2014 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Tue, 1 Jul 2014 15:08:57 +0000 Subject: [RHSA-2014:0826-01] Moderate: Red Hat JBoss Enterprise Application Platform 6.2 httpd security update Message-ID: <201407011509.s61F91rj016429@int-mx10.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat JBoss Enterprise Application Platform 6.2 httpd security update Advisory ID: RHSA-2014:0826-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0826.html Issue date: 2014-07-01 CVE Names: CVE-2013-6438 CVE-2014-0098 ===================================================================== 1. Summary: Updated httpd packages that fix two security issues are now available for Red Hat JBoss Enterprise Application Platform 6.2 for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server - i386, x86_64 Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server - i386, x86_64 3. Description: Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was found that the mod_dav module did not correctly strip leading white space from certain elements in a parsed XML. In certain httpd configurations that use the mod_dav module (for example when using the mod_dav_svn module), a remote attacker could send a specially crafted DAV request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the "apache" user. (CVE-2013-6438) A buffer over-read flaw was found in the httpd mod_log_config module. In configurations where cookie logging is enabled, a remote attacker could use this flaw to crash the httpd child process via an HTTP request with a malformed cookie header. (CVE-2014-0098) All users of Red Hat JBoss Enterprise Application Platform 6.2 should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, users must restart the httpd service for the update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1077867 - CVE-2013-6438 httpd: mod_dav denial of service via crafted DAV WRITE request 1077871 - CVE-2014-0098 httpd: mod_log_config does not properly handle logging certain cookies resulting in DoS 6. Package List: Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server: Source: httpd-2.2.22-27.ep6.el5.src.rpm i386: httpd-2.2.22-27.ep6.el5.i386.rpm httpd-debuginfo-2.2.22-27.ep6.el5.i386.rpm httpd-devel-2.2.22-27.ep6.el5.i386.rpm httpd-tools-2.2.22-27.ep6.el5.i386.rpm mod_ssl-2.2.22-27.ep6.el5.i386.rpm x86_64: httpd-2.2.22-27.ep6.el5.x86_64.rpm httpd-debuginfo-2.2.22-27.ep6.el5.x86_64.rpm httpd-devel-2.2.22-27.ep6.el5.x86_64.rpm httpd-tools-2.2.22-27.ep6.el5.x86_64.rpm mod_ssl-2.2.22-27.ep6.el5.x86_64.rpm Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server: Source: httpd-2.2.22-27.ep6.el6.src.rpm i386: httpd-2.2.22-27.ep6.el6.i386.rpm httpd-debuginfo-2.2.22-27.ep6.el6.i386.rpm httpd-devel-2.2.22-27.ep6.el6.i386.rpm httpd-tools-2.2.22-27.ep6.el6.i386.rpm mod_ssl-2.2.22-27.ep6.el6.i386.rpm x86_64: httpd-2.2.22-27.ep6.el6.x86_64.rpm httpd-debuginfo-2.2.22-27.ep6.el6.x86_64.rpm httpd-devel-2.2.22-27.ep6.el6.x86_64.rpm httpd-tools-2.2.22-27.ep6.el6.x86_64.rpm mod_ssl-2.2.22-27.ep6.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2013-6438.html https://www.redhat.com/security/data/cve/CVE-2014-0098.html https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTss7yXlSAg2UNWIIRAt1EAJ96htOQl3XoYv3JEqf5rqa7YSSMLACfT9Kz TFW2v4Sz0mdTjqQfIGs8uLI= =WcyY -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Jul 3 18:41:54 2014 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 3 Jul 2014 18:41:54 +0000 Subject: [RHSA-2014:0833-01] Moderate: Red Hat JBoss Web Server 2.0.1 tomcat6 security update Message-ID: <201407031841.s63IftW8018382@int-mx10.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat JBoss Web Server 2.0.1 tomcat6 security update Advisory ID: RHSA-2014:0833-01 Product: Red Hat JBoss Web Server Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0833.html Issue date: 2014-07-03 CVE Names: CVE-2014-0075 CVE-2014-0096 CVE-2014-0099 ===================================================================== 1. Summary: An update for the Apache Tomcat 6 component for Red Hat JBoss Web Server 2.0.1 that fixes three security issues is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Description: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library. It was discovered that Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources. (CVE-2014-0075) It was found that Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a Tomcat server located behind a reverse proxy that processed the content length header correctly. (CVE-2014-0099) It was found that the org.apache.catalina.servlets.DefaultServlet implementation in Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information. (CVE-2014-0096) The CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product Security. All users of Red Hat JBoss Web Server 2.0.1 as provided from the Red Hat Customer Portal are advised to apply this update. The Red Hat JBoss Web Server process must be restarted for the update to take effect. 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). 4. Bugs fixed (https://bugzilla.redhat.com/): 1072776 - CVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter 1088342 - CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs 1102030 - CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content length header 5. References: https://www.redhat.com/security/data/cve/CVE-2014-0075.html https://www.redhat.com/security/data/cve/CVE-2014-0096.html https://www.redhat.com/security/data/cve/CVE-2014-0099.html https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver&downloadType=securityPatches&version=2.0.1 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTtaPdXlSAg2UNWIIRAhrCAKC1npkA9rY3/60CBN59GnEynLsgggCfT0zg TUqsunatvAtbihs+9jH0Lhg= =AdmM -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Jul 3 18:43:01 2014 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 3 Jul 2014 18:43:01 +0000 Subject: [RHSA-2014:0834-02] Moderate: Red Hat JBoss Web Server 2.0.1 tomcat6 security and bug fix update Message-ID: <201407031843.s63Ih1Qj002622@int-mx14.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat JBoss Web Server 2.0.1 tomcat6 security and bug fix update Advisory ID: RHSA-2014:0834-02 Product: Red Hat JBoss Web Server Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0834.html Issue date: 2014-07-03 CVE Names: CVE-2014-0075 CVE-2014-0096 CVE-2014-0099 ===================================================================== 1. Summary: Updated tomcat6 packages that fix three security issues and one bug are now available for Red Hat JBoss Web Server 2.0.1 on Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat JBoss Web Server 2 for RHEL 5 Server - noarch Red Hat JBoss Web Server 2 for RHEL 6 Server - noarch 3. Description: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library. It was discovered that Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources. (CVE-2014-0075) It was found that Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a Tomcat server located behind a reverse proxy that processed the content length header correctly. (CVE-2014-0099) It was found that the org.apache.catalina.servlets.DefaultServlet implementation in Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information. (CVE-2014-0096) The CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product Security. This update also fixes the following bug: The tomcat6-lib-6.0.37-19_patch_04.ep6.el5 package, provided as a dependency of Red Hat JBoss Web Server 2.0.1, included a build of commons-dbcp.jar that used an incorrect java package name, causing applications using this dependency to not function properly. With this update, the java package name has been corrected. (BZ#1101287) All users of Red Hat JBoss Web Server 2.0.1 are advised to upgrade to these updated tomcat6 packages, which contain backported patches to correct these issues. The Red Hat JBoss Web Server process must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied, and back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1072776 - CVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter 1088342 - CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs 1102030 - CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content length header 6. Package List: Red Hat JBoss Web Server 2 for RHEL 5 Server: Source: tomcat6-6.0.37-20_patch_04.ep6.el5.src.rpm noarch: tomcat6-6.0.37-20_patch_04.ep6.el5.noarch.rpm tomcat6-admin-webapps-6.0.37-20_patch_04.ep6.el5.noarch.rpm tomcat6-docs-webapp-6.0.37-20_patch_04.ep6.el5.noarch.rpm tomcat6-el-2.1-api-6.0.37-20_patch_04.ep6.el5.noarch.rpm tomcat6-javadoc-6.0.37-20_patch_04.ep6.el5.noarch.rpm tomcat6-jsp-2.1-api-6.0.37-20_patch_04.ep6.el5.noarch.rpm tomcat6-lib-6.0.37-20_patch_04.ep6.el5.noarch.rpm tomcat6-log4j-6.0.37-20_patch_04.ep6.el5.noarch.rpm tomcat6-servlet-2.5-api-6.0.37-20_patch_04.ep6.el5.noarch.rpm tomcat6-webapps-6.0.37-20_patch_04.ep6.el5.noarch.rpm Red Hat JBoss Web Server 2 for RHEL 6 Server: Source: tomcat6-6.0.37-29_patch_05.ep6.el6.src.rpm noarch: tomcat6-6.0.37-29_patch_05.ep6.el6.noarch.rpm tomcat6-admin-webapps-6.0.37-29_patch_05.ep6.el6.noarch.rpm tomcat6-docs-webapp-6.0.37-29_patch_05.ep6.el6.noarch.rpm tomcat6-el-2.1-api-6.0.37-29_patch_05.ep6.el6.noarch.rpm tomcat6-javadoc-6.0.37-29_patch_05.ep6.el6.noarch.rpm tomcat6-jsp-2.1-api-6.0.37-29_patch_05.ep6.el6.noarch.rpm tomcat6-lib-6.0.37-29_patch_05.ep6.el6.noarch.rpm tomcat6-log4j-6.0.37-29_patch_05.ep6.el6.noarch.rpm tomcat6-servlet-2.5-api-6.0.37-29_patch_05.ep6.el6.noarch.rpm tomcat6-webapps-6.0.37-29_patch_05.ep6.el6.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2014-0075.html https://www.redhat.com/security/data/cve/CVE-2014-0096.html https://www.redhat.com/security/data/cve/CVE-2014-0099.html https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTtaQUXlSAg2UNWIIRAnQNAJ9XOAJ7/QdoJa25ws3FiVfBOatOVwCgoOfn nr2IjzFsTM7cxwO3OBPd6HY= =oNNp -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Jul 3 18:43:45 2014 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 3 Jul 2014 18:43:45 +0000 Subject: [RHSA-2014:0835-01] Moderate: Red Hat JBoss Web Server 2.0.1 tomcat7 security update Message-ID: <201407031843.s63IhjD8005342@int-mx13.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat JBoss Web Server 2.0.1 tomcat7 security update Advisory ID: RHSA-2014:0835-01 Product: Red Hat JBoss Web Server Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0835.html Issue date: 2014-07-03 CVE Names: CVE-2014-0075 CVE-2014-0096 CVE-2014-0099 ===================================================================== 1. Summary: Updated tomcat7 packages that fix three security issues are now available for Red Hat JBoss Web Server 2.0.1 on Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat JBoss Web Server 2 for RHEL 5 Server - noarch Red Hat JBoss Web Server 2 for RHEL 6 Server - noarch 3. Description: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library. It was discovered that Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources. (CVE-2014-0075) It was found that Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a Tomcat server located behind a reverse proxy that processed the content length header correctly. (CVE-2014-0099) It was found that the org.apache.catalina.servlets.DefaultServlet implementation in Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information. (CVE-2014-0096) The CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product Security. All users of Red Hat JBoss Web Server 2.0.1 are advised to upgrade to these updated tomcat7 packages, which contain backported patches to correct these issues. The Red Hat JBoss Web Server process must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied, and back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1072776 - CVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter 1088342 - CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs 1102030 - CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content length header 6. Package List: Red Hat JBoss Web Server 2 for RHEL 5 Server: Source: tomcat7-7.0.40-14_patch_03.ep6.el5.src.rpm noarch: tomcat7-7.0.40-14_patch_03.ep6.el5.noarch.rpm tomcat7-admin-webapps-7.0.40-14_patch_03.ep6.el5.noarch.rpm tomcat7-docs-webapp-7.0.40-14_patch_03.ep6.el5.noarch.rpm tomcat7-el-2.2-api-7.0.40-14_patch_03.ep6.el5.noarch.rpm tomcat7-javadoc-7.0.40-14_patch_03.ep6.el5.noarch.rpm tomcat7-jsp-2.2-api-7.0.40-14_patch_03.ep6.el5.noarch.rpm tomcat7-lib-7.0.40-14_patch_03.ep6.el5.noarch.rpm tomcat7-log4j-7.0.40-14_patch_03.ep6.el5.noarch.rpm tomcat7-servlet-3.0-api-7.0.40-14_patch_03.ep6.el5.noarch.rpm tomcat7-webapps-7.0.40-14_patch_03.ep6.el5.noarch.rpm Red Hat JBoss Web Server 2 for RHEL 6 Server: Source: tomcat7-7.0.40-11_patch_03.ep6.el6.src.rpm noarch: tomcat7-7.0.40-11_patch_03.ep6.el6.noarch.rpm tomcat7-admin-webapps-7.0.40-11_patch_03.ep6.el6.noarch.rpm tomcat7-docs-webapp-7.0.40-11_patch_03.ep6.el6.noarch.rpm tomcat7-el-2.2-api-7.0.40-11_patch_03.ep6.el6.noarch.rpm tomcat7-javadoc-7.0.40-11_patch_03.ep6.el6.noarch.rpm tomcat7-jsp-2.2-api-7.0.40-11_patch_03.ep6.el6.noarch.rpm tomcat7-lib-7.0.40-11_patch_03.ep6.el6.noarch.rpm tomcat7-log4j-7.0.40-11_patch_03.ep6.el6.noarch.rpm tomcat7-servlet-3.0-api-7.0.40-11_patch_03.ep6.el6.noarch.rpm tomcat7-webapps-7.0.40-11_patch_03.ep6.el6.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2014-0075.html https://www.redhat.com/security/data/cve/CVE-2014-0096.html https://www.redhat.com/security/data/cve/CVE-2014-0099.html https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTtaRIXlSAg2UNWIIRAmT4AKC340y2M9XbcI44HOdYrOLa/iJPmACfWWoo boP4qbJluv76igNl9mj0cJE= =mW1i -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Jul 3 18:44:13 2014 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 3 Jul 2014 18:44:13 +0000 Subject: [RHSA-2014:0836-01] Moderate: Red Hat JBoss Web Server 2.0.1 tomcat7 security update Message-ID: <201407031844.s63IiD5O003425@int-mx14.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat JBoss Web Server 2.0.1 tomcat7 security update Advisory ID: RHSA-2014:0836-01 Product: Red Hat JBoss Web Server Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0836.html Issue date: 2014-07-03 CVE Names: CVE-2014-0075 CVE-2014-0096 CVE-2014-0099 ===================================================================== 1. Summary: An update for the Apache Tomcat 7 component for Red Hat JBoss Web Server 2.0.1 that fixes three security issues is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Description: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library. It was discovered that Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources. (CVE-2014-0075) It was found that Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a Tomcat server located behind a reverse proxy that processed the content length header correctly. (CVE-2014-0099) It was found that the org.apache.catalina.servlets.DefaultServlet implementation in Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information. (CVE-2014-0096) The CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product Security. All users of Red Hat JBoss Web Server 2.0.1 as provided from the Red Hat Customer Portal are advised to apply this update. The Red Hat JBoss Web Server process must be restarted for the update to take effect. 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). 4. Bugs fixed (https://bugzilla.redhat.com/): 1072776 - CVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter 1088342 - CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs 1102030 - CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content length header 5. References: https://www.redhat.com/security/data/cve/CVE-2014-0075.html https://www.redhat.com/security/data/cve/CVE-2014-0096.html https://www.redhat.com/security/data/cve/CVE-2014-0099.html https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver&downloadType=securityPatches&version=2.0.1 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTtaRsXlSAg2UNWIIRAnckAJwPR0xJH6L+5hlRdg3E+Tqy4BIhOwCgub+Z gXDaSMCgHf0099OtMHBbits= =frPX -----END PGP SIGNATURE----- From bugzilla at redhat.com Mon Jul 7 15:01:09 2014 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Mon, 7 Jul 2014 15:01:09 +0000 Subject: [RHSA-2014:0842-01] Moderate: Red Hat JBoss Enterprise Application Platform 6.2.4 security update Message-ID: <201407071501.s67F19E2012826@int-mx09.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat JBoss Enterprise Application Platform 6.2.4 security update Advisory ID: RHSA-2014:0842-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0842.html Issue date: 2014-07-07 CVE Names: CVE-2014-0075 CVE-2014-0096 CVE-2014-0099 CVE-2014-0119 ===================================================================== 1. Summary: An update for Red Hat JBoss Enterprise Application Platform 6.2.4 that fixes multiple security issues is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Description: Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was discovered that JBoss Web did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web by streaming an unlimited quantity of data, leading to excessive consumption of server resources. (CVE-2014-0075) It was found that JBoss Web did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web server located behind a reverse proxy that processed the content length header correctly. (CVE-2014-0099) It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information. (CVE-2014-0096) It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web instance. (CVE-2014-0119) The CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product Security. All users of Red Hat JBoss Enterprise Application Platform 6.2.4 as provided from the Red Hat Customer Portal are advised to apply this update. The JBoss server process must be restarted for the update to take effect. 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. 4. Bugs fixed (https://bugzilla.redhat.com/): 1072776 - CVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter 1088342 - CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs 1102030 - CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content length header 1102038 - CVE-2014-0119 Tomcat/JBossWeb: XML parser hijack by malicious web application 5. References: https://www.redhat.com/security/data/cve/CVE-2014-0075.html https://www.redhat.com/security/data/cve/CVE-2014-0096.html https://www.redhat.com/security/data/cve/CVE-2014-0099.html https://www.redhat.com/security/data/cve/CVE-2014-0119.html https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=6.2.0 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTurYSXlSAg2UNWIIRAlDYAJ496i6dFcgxkX/W2eSS7Z+dvfpakQCbBRrD Pq39VOFGH547g3Gu3ZXbBuk= =0pO5 -----END PGP SIGNATURE----- From bugzilla at redhat.com Mon Jul 7 15:01:43 2014 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Mon, 7 Jul 2014 15:01:43 +0000 Subject: [RHSA-2014:0843-01] Moderate: Red Hat JBoss Enterprise Application Platform 6.2.4 security update Message-ID: <201407071501.s67F1iH9009909@int-mx14.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat JBoss Enterprise Application Platform 6.2.4 security update Advisory ID: RHSA-2014:0843-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0843.html Issue date: 2014-07-07 CVE Names: CVE-2014-0075 CVE-2014-0096 CVE-2014-0099 CVE-2014-0119 ===================================================================== 1. Summary: Updated Red Hat JBoss Enterprise Application Platform 6.2.4 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server - noarch Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server - noarch 3. Description: Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was discovered that JBoss Web did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web by streaming an unlimited quantity of data, leading to excessive consumption of server resources. (CVE-2014-0075) It was found that JBoss Web did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web server located behind a reverse proxy that processed the content length header correctly. (CVE-2014-0099) It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information. (CVE-2014-0096) It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web instance. (CVE-2014-0119) The CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product Security. All users of Red Hat JBoss Enterprise Application Platform 6.2.4 on Red Hat Enterprise Linux 5 and 6 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up any customized Red Hat JBoss Enterprise Application Platform 6 configuration files. On update, the configuration files that have been locally modified will not be updated. The updated version of such files will be stored as the rpmnew files. Make sure to locate any such files after the update and merge any changes manually. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1072776 - CVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter 1088342 - CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs 1102030 - CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content length header 1102038 - CVE-2014-0119 Tomcat/JBossWeb: XML parser hijack by malicious web application 6. Package List: Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server: Source: jbossweb-7.3.2-4.Final_redhat_3.1.ep6.el5.src.rpm noarch: jbossweb-7.3.2-4.Final_redhat_3.1.ep6.el5.noarch.rpm Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server: Source: jbossweb-7.3.2-4.Final_redhat_3.1.ep6.el6.src.rpm noarch: jbossweb-7.3.2-4.Final_redhat_3.1.ep6.el6.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2014-0075.html https://www.redhat.com/security/data/cve/CVE-2014-0096.html https://www.redhat.com/security/data/cve/CVE-2014-0099.html https://www.redhat.com/security/data/cve/CVE-2014-0119.html https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTurZGXlSAg2UNWIIRAjQuAJ9G3FrmmxQq8xNK5ngLTL/E35dXQgCdFTvu rNpjwHEU4w/Fa4I/WyPuVh0= =tXq5 -----END PGP SIGNATURE----- From bugzilla at redhat.com Tue Jul 15 17:48:24 2014 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Tue, 15 Jul 2014 17:48:24 +0000 Subject: [RHSA-2014:0883-01] Important: Red Hat JBoss Enterprise Application Platform 6.2.4 security update Message-ID: <201407151748.s6FHmOqS015357@int-mx10.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Enterprise Application Platform 6.2.4 security update Advisory ID: RHSA-2014:0883-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0883.html Issue date: 2014-07-15 CVE Names: CVE-2014-3530 ===================================================================== 1. Summary: Updated Red Hat JBoss Enterprise Application Platform 6.2.4 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server - noarch Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server - noarch 3. Description: Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. (CVE-2014-3530) Red Hat would like to thank Alexander Papadakis for reporting this issue. All users of Red Hat JBoss Enterprise Application Platform 6.2.4 on Red Hat Enterprise Linux 5 and 6 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up any customized Red Hat JBoss Enterprise Application Platform 6 configuration files. On update, the configuration files that have been locally modified will not be updated. The updated version of such files will be stored as the rpmnew files. Make sure to locate any such files after the update and merge any changes manually. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1112987 - CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage 6. Package List: Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server: Source: picketlink-federation-2.1.9-5.SP3_redhat_2.1.ep6.el5.src.rpm noarch: picketlink-federation-2.1.9-5.SP3_redhat_2.1.ep6.el5.noarch.rpm Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server: Source: picketlink-federation-2.1.9-5.SP3_redhat_2.1.ep6.el6.src.rpm noarch: picketlink-federation-2.1.9-5.SP3_redhat_2.1.ep6.el6.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2014-3530.html https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTxWkcXlSAg2UNWIIRAhK1AKDB10Qg31qbbOzU+gttMekblvSPrACggdcR X/aLTHGBycHamjmGlembbFI= =kcAa -----END PGP SIGNATURE----- From bugzilla at redhat.com Tue Jul 15 19:11:23 2014 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Tue, 15 Jul 2014 19:11:23 +0000 Subject: [RHSA-2014:0884-00] Important: Red Hat JBoss Enterprise Application Platform 6.2.4 security update Message-ID: <201407151911.s6FJBNQM026496@int-mx10.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Enterprise Application Platform 6.2.4 security update Advisory ID: RHSA-2014:0884-00 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0884.html Issue date: 2014-07-15 CVE Names: CVE-2014-3530 ===================================================================== 1. Summary: An update for Red Hat JBoss Enterprise Application Platform 6.2.4 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Description: Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. (CVE-2014-3530) Red Hat would like to thank Alexander Papadakis for reporting this issue. All users of Red Hat JBoss Enterprise Application Platform 6.2.4 as provided from the Red Hat Customer Portal are advised to apply this update. The JBoss server process must be restarted for the update to take effect. 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. 4. Bugs fixed (https://bugzilla.redhat.com/): 1112987 - CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage 5. References: https://www.redhat.com/security/data/cve/CVE-2014-3530.html https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=6.2.0 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTxXy5XlSAg2UNWIIRAlubAKDCGnOABIAs0MRckDOVcDTO63ZYBACff4PW 6ygKzW6PHrAAjtkCQ7Z0GVw= =+lrO -----END PGP SIGNATURE----- From bugzilla at redhat.com Tue Jul 15 19:12:02 2014 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Tue, 15 Jul 2014 19:12:02 +0000 Subject: [RHSA-2014:0885-01] Important: Red Hat JBoss Enterprise Application Platform 5.2.0 security update Message-ID: <201407151912.s6FJC23S026800@int-mx14.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Enterprise Application Platform 5.2.0 security update Advisory ID: RHSA-2014:0885-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0885.html Issue date: 2014-07-15 CVE Names: CVE-2014-3530 ===================================================================== 1. Summary: Updated packages for Red Hat JBoss Enterprise Application Platform 5.2.0 that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS - noarch Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES - noarch Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server - noarch Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server - noarch 3. Description: Red Hat JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam. It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. (CVE-2014-3530) Red Hat would like to thank Alexander Papadakis for reporting this issue. All users of Red Hat JBoss Enterprise Application Platform 5.2.0 on Red Hat Enterprise Linux 4, 5, and 6 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing Red Hat JBoss Enterprise Application Platform 5 installation (including all applications and configuration files). This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1112987 - CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage 6. Package List: Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS: Source: picketlink-federation-2.1.5-3_patch_01.ep5.el4.src.rpm noarch: picketlink-federation-2.1.5-3_patch_01.ep5.el4.noarch.rpm Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES: Source: picketlink-federation-2.1.5-3_patch_01.ep5.el4.src.rpm noarch: picketlink-federation-2.1.5-3_patch_01.ep5.el4.noarch.rpm Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server: Source: picketlink-federation-2.1.5-3_patch_01.ep5.el5.src.rpm noarch: picketlink-federation-2.1.5-3_patch_01.ep5.el5.noarch.rpm Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server: Source: picketlink-federation-2.1.5-3_patch_01.el6_5.src.rpm noarch: picketlink-federation-2.1.5-3_patch_01.el6_5.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2014-3530.html https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTxXz7XlSAg2UNWIIRAlAuAJ9dS6fZ66TWC1hgcC399o5T4+gC2ACeKuje CNAPxoGL+RLi2LLfL30j1D8= =kyLe -----END PGP SIGNATURE----- From bugzilla at redhat.com Tue Jul 15 19:12:26 2014 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Tue, 15 Jul 2014 19:12:26 +0000 Subject: [RHSA-2014:0886-00] Important: Red Hat JBoss Enterprise Application Platform 5.2.0 security update Message-ID: <201407151912.s6FJCQNF009291@int-mx13.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Enterprise Application Platform 5.2.0 security update Advisory ID: RHSA-2014:0886-00 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0886.html Issue date: 2014-07-15 CVE Names: CVE-2014-3530 ===================================================================== 1. Summary: An update for Red Hat JBoss Enterprise Application Platform 5.2.0 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Description: Red Hat JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam. It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. (CVE-2014-3530) Red Hat would like to thank Alexander Papadakis for reporting this issue. All users of Red Hat JBoss Enterprise Application Platform 5.2.0 as provided from the Red Hat Customer Portal are advised to apply this update. The JBoss server process must be restarted for this update to take effect. 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing JBoss Enterprise Application Platform installation (including all applications and configuration files). 4. Bugs fixed (https://bugzilla.redhat.com/): 1112987 - CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage 5. References: https://www.redhat.com/security/data/cve/CVE-2014-3530.html https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches&product=appplatform&version=5.2.0 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTxX0RXlSAg2UNWIIRAvK6AKC/Tc9gQV2HFlZ3cDQBJ0CnkOSZ3wCgtXa8 2UXF9ID/9cwgSblaRBKt2J4= =DqOl -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Jul 16 05:21:20 2014 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 16 Jul 2014 05:21:20 +0000 Subject: [RHSA-2014:0887-02] Important: JBoss Remoting security update Message-ID: <201407160521.s6G5LL1Q000549@int-mx10.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: JBoss Remoting security update Advisory ID: RHSA-2014:0887-02 Product: Red Hat JBoss Middleware Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0887.html Issue date: 2014-07-16 CVE Names: CVE-2014-3518 ===================================================================== 1. Summary: This advisory contains instructions on how to resolve one security issue found in the JBoss Remoting component, which is included in Red Hat JBoss Enterprise Application Platform 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1. The Red Hat Security Response Team has rated this security issue as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Description: JBoss Remoting is a stand-alone project that provides an API for making remote invocations using pluggable transports and data marshallers. JBoss Application Server 5 and supported Red Hat JBoss 5.x products contain JBoss Remoting, which includes a partial implementation of the JMX remoting specification JSR 160. This implementation is provided in jmx-remoting.sar, which is deployed by default in unsupported community releases of JBoss Application Server 5.x. This implementation does not implement security as defined in JSR 160, and therefore does not apply any authentication or authorization constraints. A remote attacker could use this flaw to potentially execute arbitrary code on a vulnerable server. All of the supported Red Hat JBoss 5.x products are not affected by this issue in their default configuration. These products are only vulnerable if JMX remoting is enabled by manually deploying jmx-remoting.sar from the jboss-as/docs/examples directory. Unsupported community releases of JBoss Application Server 5.x are affected. All users of the standalone JBoss Remoting project are also affected. (CVE-2014-3518) Red Hat would like to thank Harun ESUR of Sceptive for reporting this issue. All users of Red Hat JBoss Enterprise Application Platform 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1 as provided from the Red Hat Customer Portal who have jmx-remoting.sar deployed are advised to follow the instructions provided in the Solution section of this advisory. 3. Solution: In case your server is affected, undeploy jmx-remoting.sar if JMX remoting is not required by your applications. If your applications do require it, secure JMX remoting by following the instructions at https://access.redhat.com/solutions/238943 For more information, see https://access.redhat.com/solutions/1120423 4. Bugs fixed (https://bugzilla.redhat.com/): 1112545 - CVE-2014-3518 JBoss EAP/AS 5: Remote code execution via unauthenticated JMX/RMI connector 5. References: https://www.redhat.com/security/data/cve/CVE-2014-3518.html https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/solutions/238943 https://access.redhat.com/solutions/1120423 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTxgt5XlSAg2UNWIIRAjczAJ9F6uSgwR0JTGCNVMIDeNh/k5NFLwCfeUIh dltY2MVzLihWQlMsE8u7jbA= =f1Ak -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Jul 16 18:25:42 2014 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 16 Jul 2014 18:25:42 +0000 Subject: [RHSA-2014:0895-01] Moderate: Red Hat JBoss Data Grid 6.3.0 update Message-ID: <201407161825.s6GIPhBI016993@int-mx09.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat JBoss Data Grid 6.3.0 update Advisory ID: RHSA-2014:0895-01 Product: Red Hat JBoss Data Grid Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0895.html Issue date: 2014-07-16 CVE Names: CVE-2014-0058 CVE-2014-0059 CVE-2014-0075 CVE-2014-0096 CVE-2014-0099 CVE-2014-0119 ===================================================================== 1. Summary: Red Hat JBoss Data Grid 6.3.0, which fixes multiple security issues, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Description: Red Hat JBoss Data Grid is a distributed in-memory data grid, based on Infinispan. This release of Red Hat JBoss Data Grid 6.3.0 serves as a replacement for Red Hat JBoss Data Grid 6.2.1. It includes various bug fixes and enhancements which are detailed in the Red Hat JBoss Data Grid 6.3.0 Release Notes. The Release Notes will be available shortly from https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Data_Grid/ This update also fixes the following security issues: It was discovered that JBoss Web did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web by streaming an unlimited quantity of data, leading to excessive consumption of server resources. (CVE-2014-0075) It was found that JBoss Web did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web server located behind a reverse proxy that processed the content length header correctly. (CVE-2014-0099) It was found that the security audit functionality, provided by Red Hat JBoss Data Grid, logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain application or server authentication credentials. Refer to the Solution section of this advisory for additional information on the fix for this issue. (CVE-2014-0058) It was found that the security auditing functionality provided by PicketBox and JBossSX, both security frameworks for Java applications, used a world-readable audit.log file to record sensitive information. A local user could possibly use this flaw to gain access to the sensitive information in the audit.log file. (CVE-2014-0059) It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information. (CVE-2014-0096) It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web instance. (CVE-2014-0119) The CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product Security. All users of Red Hat JBoss Data Grid 6.2.1 as provided from the Red Hat Customer Portal are advised to upgrade to Red Hat JBoss Data Grid 6.3.0. 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing JBoss Data Grid installation. The provided patch to fix CVE-2014-0058 also allows greater control over which of the following components of web requests are captured in audit logs: - - parameters - - cookies - - headers - - attributes It is also possible to selectively mask some elements of headers, parameters, cookies, and attributes using masks. This capability is provided by two system properties, which are introduced by this patch: 1) org.jboss.security.web.audit Description: This property controls the granularity of the security auditing of web requests. Possible values: off = Disables auditing of web requests headers = Audits only the headers of web requests cookies = Audits only the cookies of web requests parameters = Audits only the parameters of web requests attributes = Audits only the attributes of web requests headers,cookies,parameters = Audits the headers, cookies, and parameters of web requests headers,cookies = Audits the headers and cookies of web requests Default Value: headers, parameters Examples: Setting "org.jboss.security.web.audit=off" disables security auditing of web requests entirely. Setting "org.jboss.security.web.audit=headers" enables security auditing of only headers in web requests. 2) org.jboss.security.web.audit.mask Description: This property can be used to specify a list of strings to be matched against headers, parameters, cookies, and attributes of web requests. Any element matching the specified masks will be excluded from security audit logging. Possible values: Any comma separated string indicating keys of headers, parameters, cookies, and attributes. Default Value: j_password, authorization Note that currently the matching of the masks is fuzzy rather than strict. For example, a mask of "authorization" will mask both the header called authorization and the parameter called "custom_authorization". A future release may introduce strict masks. 4. Bugs fixed (https://bugzilla.redhat.com/): 1063641 - CVE-2014-0058 Red Hat JBoss EAP6: Plain text password logging during security audit 1063642 - CVE-2014-0059 JBossSX/PicketBox: World readable audit.log file 1072776 - CVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter 1088342 - CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs 1102030 - CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content length header 1102038 - CVE-2014-0119 Tomcat/JBossWeb: XML parser hijack by malicious web application 5. References: https://www.redhat.com/security/data/cve/CVE-2014-0058.html https://www.redhat.com/security/data/cve/CVE-2014-0059.html https://www.redhat.com/security/data/cve/CVE-2014-0075.html https://www.redhat.com/security/data/cve/CVE-2014-0096.html https://www.redhat.com/security/data/cve/CVE-2014-0099.html https://www.redhat.com/security/data/cve/CVE-2014-0119.html https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.grid&downloadType=distributions https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Data_Grid/ 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTxsOWXlSAg2UNWIIRAnvFAJ9oo6SpbAMA5fFfcl87bkcnKma7jQCeOY3U BKYtD4zlGceUuD+E3C1i3vE= =swqj -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Jul 16 18:27:40 2014 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 16 Jul 2014 18:27:40 +0000 Subject: [RHSA-2014:0896-01] Moderate: Red Hat JBoss Web Framework Kit 2.6.0 update Message-ID: <201407161827.s6GIReEl018341@int-mx09.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat JBoss Web Framework Kit 2.6.0 update Advisory ID: RHSA-2014:0896-01 Product: Red Hat JBoss Web Framework Kit Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0896.html Issue date: 2014-07-16 CVE Names: CVE-2013-1624 CVE-2013-5855 ===================================================================== 1. Summary: Red Hat JBoss Web Framework Kit 2.6.0, which fixes two security issues, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Description: Red Hat JBoss Web Framework Kit combines popular open source web frameworks into a single solution for Java applications. This release serves as a replacement for Red Hat JBoss Web Framework Kit 2.5.0, and includes bug fixes and enhancements. Refer to the 2.6.0 Release Notes for information on the most significant of these changes, available shortly from https://access.redhat.com/documentation/ This release also fixes the following security issues: It was discovered that bouncycastle leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle. (CVE-2013-1624) It was found that Mojarra JavaServer Faces did not properly escape user-supplied content in certain circumstances. Contents of outputText tags and raw EL expressions that immediately follow script or style elements were not escaped. A remote attacker could use a specially crafted URL to execute arbitrary web script in the user's browser. (CVE-2013-5855) All users of Red Hat JBoss Web Framework Kit 2.5.0 as provided from the Red Hat Customer Portal are advised to upgrade to Red Hat JBoss Web Framework Kit 2.6.0. 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing installation of Red Hat JBoss Enterprise Application Platform or Red Hat JBoss Web Server, and applications deployed to it. The JBoss server process must be restarted for this update to take effect. 4. Bugs fixed (https://bugzilla.redhat.com/): 908428 - CVE-2013-1624 bouncycastle: TLS CBC padding timing attack 1065139 - CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions 5. References: https://www.redhat.com/security/data/cve/CVE-2013-1624.html https://www.redhat.com/security/data/cve/CVE-2013-5855.html https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=web.framework.kit&downloadType=distributions https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Framework_Kit/ 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTxsPAXlSAg2UNWIIRArBpAJ9CFsYsDVtMXL5opx1bRUBGqyEggACgn4b9 BnECFIZSnyUdmuoYw3/3J+Y= =KSgo -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Jul 16 18:28:28 2014 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 16 Jul 2014 18:28:28 +0000 Subject: [RHSA-2014:0897-01] Important: Red Hat JBoss Enterprise Web Platform 5.2.0 security update Message-ID: <201407161828.s6GISS3Y012614@int-mx11.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Enterprise Web Platform 5.2.0 security update Advisory ID: RHSA-2014:0897-01 Product: Red Hat JBoss Web Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0897.html Issue date: 2014-07-16 CVE Names: CVE-2014-3530 ===================================================================== 1. Summary: An update for Red Hat JBoss Enterprise Web Platform 5.2.0 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Description: Red Hat JBoss Enterprise Web Platform is a platform for Java applications, which integrates the JBoss Web Server with JBoss Hibernate and JBoss Seam. It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. (CVE-2014-3530) Red Hat would like to thank Alexander Papadakis for reporting this issue. All users of Red Hat JBoss Enterprise Web Platform 5.2.0 as provided from the Red Hat Customer Portal are advised to apply this update. The JBoss server process must be restarted for this update to take effect. 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing JBoss Enterprise Web Platform installation (including all applications and configuration files). 4. Bugs fixed (https://bugzilla.redhat.com/): 1112987 - CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage 5. References: https://www.redhat.com/security/data/cve/CVE-2014-3530.html https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=enterpriseweb.platform&downloadType=securityPatches&version=5.2.0 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTxsQmXlSAg2UNWIIRAoLIAKCIwgSYskzuM0E7PZp+c+jBTz3StwCgp6oY N/VqoMnFXk/GcWq+MW8+KL4= =q2I4 -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Jul 16 18:28:51 2014 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 16 Jul 2014 18:28:51 +0000 Subject: [RHSA-2014:0898-01] Important: Red Hat JBoss Enterprise Web Platform 5.2.0 security update Message-ID: <201407161828.s6GISqii021066@int-mx13.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Enterprise Web Platform 5.2.0 security update Advisory ID: RHSA-2014:0898-01 Product: Red Hat JBoss Web Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0898.html Issue date: 2014-07-16 CVE Names: CVE-2014-3530 ===================================================================== 1. Summary: Updated packages for Red Hat JBoss Enterprise Web Platform 5.2.0 that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat JBoss Web Platform 5 for RHEL 4 AS - noarch Red Hat JBoss Web Platform 5 for RHEL 4 ES - noarch Red Hat JBoss Web Platform 5 for RHEL 5 Server - noarch Red Hat JBoss Web Platform 5 for RHEL 6 Server - noarch 3. Description: Red Hat JBoss Enterprise Web Platform is a platform for Java applications, which integrates the JBoss Web Server with JBoss Hibernate and JBoss Seam. It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. (CVE-2014-3530) Red Hat would like to thank Alexander Papadakis for reporting this issue. All users of Red Hat JBoss Enterprise Web Platform 5.2.0 on Red Hat Enterprise Linux 4, 5, and 6 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing Red Hat JBoss Enterprise Web Platform 5 installation (including all applications and configuration files). This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1112987 - CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage 6. Package List: Red Hat JBoss Web Platform 5 for RHEL 4 AS: Source: picketlink-federation-2.1.5-3_patch_01.ep5.el4.src.rpm noarch: picketlink-federation-2.1.5-3_patch_01.ep5.el4.noarch.rpm Red Hat JBoss Web Platform 5 for RHEL 4 ES: Source: picketlink-federation-2.1.5-3_patch_01.ep5.el4.src.rpm noarch: picketlink-federation-2.1.5-3_patch_01.ep5.el4.noarch.rpm Red Hat JBoss Web Platform 5 for RHEL 5 Server: Source: picketlink-federation-2.1.5-3_patch_01.ep5.el5.src.rpm noarch: picketlink-federation-2.1.5-3_patch_01.ep5.el5.noarch.rpm Red Hat JBoss Web Platform 5 for RHEL 6 Server: Source: picketlink-federation-2.1.5-3_patch_01.el6_5.src.rpm noarch: picketlink-federation-2.1.5-3_patch_01.el6_5.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2014-3530.html https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTxsRZXlSAg2UNWIIRArInAJ4vhDuKmJAya2OJ5KWTiJFtLIMdQQCffjTu X6gkXNIQjXxixGClvuSdCn4= =6+3J -----END PGP SIGNATURE----- From bugzilla at redhat.com Mon Jul 21 18:41:39 2014 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Mon, 21 Jul 2014 18:41:39 +0000 Subject: [RHSA-2014:0910-01] Important: Red Hat JBoss Operations Network 3.2.2 update Message-ID: <201407211841.s6LIfd5h004078@int-mx13.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Operations Network 3.2.2 update Advisory ID: RHSA-2014:0910-01 Product: Red Hat JBoss Operations Network Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0910.html Issue date: 2014-07-21 CVE Names: CVE-2013-5855 CVE-2014-0058 CVE-2014-0193 CVE-2014-3530 ===================================================================== 1. Summary: Red Hat JBoss Operations Network 3.2.2, which fixes multiple security issues and several bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Description: Red Hat JBoss Operations Network is a middleware management solution that provides a single point of control to deploy, manage, and monitor JBoss Enterprise Middleware, applications, and services. This JBoss Operations Network 3.2.2 release serves as a replacement for JBoss Operations Network 3.2.1, and includes several bug fixes. Refer to the JBoss Operations Network 3.2.2 Release Notes for information on the most significant of these changes. The Release Notes will be available shortly from https://access.redhat.com/documentation/en-US/ The following security issues are also fixed with this release: It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. (CVE-2014-3530) It was found that Mojarra JavaServer Faces did not properly escape user-supplied content in certain circumstances. Contents of outputText tags and raw EL expressions that immediately follow script or style elements were not escaped. A remote attacker could use a specially crafted URL to execute arbitrary web script in the user's browser. (CVE-2013-5855) It was found that the security audit functionality, provided by JBoss Operations Network, logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain application or server authentication credentials. Refer to the Solution section of this advisory for additional information on the fix for this issue. (CVE-2014-0058) A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service. (CVE-2014-0193) Red Hat would like to thank Alexander Papadakis for reporting CVE-2014-3530, and James Roper of Typesafe for reporting CVE-2014-0193. All users of JBoss Operations Network 3.2.1 as provided from the Red Hat Customer Portal are advised to upgrade to JBoss Operations Network 3.2.2. 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing JBoss Operations Network installation (including its databases, applications, configuration files, the JBoss Operations Network server's file system directory, and so on). Refer to the JBoss Operations Network 3.2.2 Release Notes for installation information. The provided patch to fix CVE-2014-0058 also allows greater control over which of the following components of web requests are captured in audit logs: - - parameters - - cookies - - headers - - attributes It is also possible to selectively mask some elements of headers, parameters, cookies, and attributes using masks. This capability is provided by two system properties, which are introduced by this patch: 1) org.jboss.security.web.audit Description: This property controls the granularity of the security auditing of web requests. Possible values: off = Disables auditing of web requests headers = Audits only the headers of web requests cookies = Audits only the cookies of web requests parameters = Audits only the parameters of web requests attributes = Audits only the attributes of web requests headers,cookies,parameters = Audits the headers, cookies, and parameters of web requests headers,cookies = Audits the headers and cookies of web requests Default Value: headers, parameters Examples: Setting "org.jboss.security.web.audit=off" disables security auditing of web requests entirely. Setting "org.jboss.security.web.audit=headers" enables security auditing of only headers in web requests. 2) org.jboss.security.web.audit.mask Description: This property can be used to specify a list of strings to be matched against headers, parameters, cookies, and attributes of web requests. Any element matching the specified masks will be excluded from security audit logging. Possible values: Any comma separated string indicating keys of headers, parameters, cookies, and attributes. Default Value: j_password, authorization Note that currently the matching of the masks is fuzzy rather than strict. For example, a mask of "authorization" will mask both the header called authorization and the parameter called "custom_authorization". A future release may introduce strict masks. 4. Bugs fixed (https://bugzilla.redhat.com/): 1063641 - CVE-2014-0058 Red Hat JBoss EAP6: Plain text password logging during security audit 1065139 - CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions 1092783 - CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation 1112987 - CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage 5. References: https://www.redhat.com/security/data/cve/CVE-2013-5855.html https://www.redhat.com/security/data/cve/CVE-2014-0058.html https://www.redhat.com/security/data/cve/CVE-2014-0193.html https://www.redhat.com/security/data/cve/CVE-2014-3530.html https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=em&downloadType=securityPatches&version=3.2.0 https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Operations_Network/ 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTzV68XlSAg2UNWIIRAqkhAJ9DYb7c0XKQAJnP9Y/bgcGMthGIVACgv/Ep c8xrj/3zEs2pcxmQClRZk8o= =dgI5 -----END PGP SIGNATURE-----