[RHSA-2015:0234-01] Important: Red Hat JBoss BPM Suite 6.0.3 security update
bugzilla at redhat.com
bugzilla at redhat.com
Tue Feb 17 22:32:48 UTC 2015
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Red Hat JBoss BPM Suite 6.0.3 security update
Advisory ID: RHSA-2015:0234-01
Product: Red Hat JBoss BPM Suite
Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-0234.html
Issue date: 2015-02-17
CVE Names: CVE-2012-6153 CVE-2013-4002 CVE-2013-5855
CVE-2014-0005 CVE-2014-0075 CVE-2014-0096
CVE-2014-0099 CVE-2014-0119 CVE-2014-0193
CVE-2014-0227 CVE-2014-3472 CVE-2014-3490
CVE-2014-3530 CVE-2014-3558 CVE-2014-3577
CVE-2014-3578 CVE-2014-3625 CVE-2014-3682
CVE-2014-8114 CVE-2014-8115
=====================================================================
1. Summary:
Red Hat JBoss BPM Suite 6.0.3 roll up patch 2, which fixes multiple
security issues, several bugs, and adds various enhancements, is now
available from the Red Hat Customer Portal.
Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
2. Description:
Red Hat JBoss BPM Suite is a business rules and processes management system
for the management, storage, creation, modification, and deployment of
JBoss rules and BPMN2-compliant business processes.
This roll up patch serves as a cumulative upgrade for Red Hat JBoss BPM
Suite 6.0.3, and includes bug fixes and enhancements. It includes various
bug fixes, which are listed in the README file included with the patch
files.
The following security issues are also fixed with this release,
descriptions of which can be found on the respective CVE pages linked in
the References section.
CVE-2012-6153 Apache HttpComponents client: SSL hostname verification
bypass, incomplete CVE-2012-5783 fix
CVE-2014-3577 Apache HttpComponents client: SSL hostname verification
bypass, incomplete CVE-2012-6153 fix
CVE-2013-4002 xerces-j2: Xerces-J2 OpenJDK: XML parsing Denial of Service
(JAXP, 8017298)
CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of
user-supplied content in outputText tags and EL expressions
CVE-2014-0005 security: PicketBox/JBossSX: Unauthorized access to and
modification of application server configuration and state by application
CVE-2014-0075 jbossweb: tomcat: Limited DoS in chunked transfer encoding
input filter
CVE-2014-0096 jbossweb: Apache Tomcat: XXE vulnerability via user supplied
XSLTs
CVE-2014-0099 jbossweb: Apache Tomcat: Request smuggling via malicious
content length header
CVE-2014-0119 jbossweb: Apache Tomcat 6: XML parser hijack by malicious web
application
CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation
CVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding
input filter
CVE-2014-3472 jboss-as-controller: JBoss AS Security: Invalid EJB caller
role check implementation
CVE-2014-3490 RESTEasy: XXE via parameter entities
CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage
CVE-2014-3558 hibernate-validator: Hibernate Validator: JSM bypass via
ReflectionHelper
CVE-2014-3578 spring: Spring Framework: Directory traversal
CVE-2014-3625 spring: Spring Framework: directory traversal flaw
CVE-2014-3682 jbpm-designer: XXE in BPMN2 import
CVE-2014-8114 UberFire: Information disclosure and RCE via insecure file
upload/download servlets
CVE-2014-8115 KIE Workbench: Insufficient authorization constraints
Red Hat would like to thank James Roper of Typesafe for reporting the
CVE-2014-0193 issue, CA Technologies for reporting the CVE-2014-3472 issue,
Alexander Papadakis for reporting the CVE-2014-3530 issue, and David Jorm
for reporting the CVE-2014-8114 and CVE-2014-8115 issues. The CVE-2012-6153
issue was discovered by Florian Weimer of Red Hat Product Security; the
CVE-2014-0005 issue was discovered by Josef Cacek of the Red Hat JBoss EAP
Quality Engineering team; the CVE-2014-0075, CVE-2014-3490, and
CVE-2014-3682 issues were discovered by David Jorm of Red Hat Product
Security.
All users of Red Hat JBoss BPM Suite 6.0.3 as provided from the Red Hat
Customer Portal are advised to apply this roll up patch.
3. Solution:
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing installation, including all applications, configuration files,
databases and database settings, and so on.
It is recommended to halt the server by stopping the JBoss Application
Server process before installing this update, and then after installing
the update, restart the server by starting the JBoss Application Server
process.
4. Bugs fixed (https://bugzilla.redhat.com/):
1019176 - CVE-2013-4002 Xerces-J2 OpenJDK: XML parsing Denial of Service (JAXP, 8017298)
1049736 - CVE-2014-0005 PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application
1065139 - CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions
1072776 - CVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter
1088342 - CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs
1092783 - CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation
1102030 - CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content length header
1102038 - CVE-2014-0119 Tomcat/JBossWeb: XML parser hijack by malicious web application
1103815 - CVE-2014-3472 JBoss AS Security: Invalid EJB caller role check implementation
1107901 - CVE-2014-3490 RESTEasy: XXE via parameter entities
1109196 - CVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter
1112987 - CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage
1120495 - CVE-2014-3558 Hibernate Validator: JSM bypass via ReflectionHelper
1129074 - CVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix
1129916 - CVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix
1131882 - CVE-2014-3578 Spring Framework: Directory traversal
1148260 - CVE-2014-3682 jbpm-designer: XXE in BPMN2 import
1165936 - CVE-2014-3625 Spring Framework: directory traversal flaw
1169544 - CVE-2014-8114 UberFire: Information disclosure and RCE via insecure file upload/download servlets
1169545 - CVE-2014-8115 KIE Workbench: Insufficient authorization constraints
5. References:
https://access.redhat.com/security/cve/CVE-2012-6153
https://access.redhat.com/security/cve/CVE-2013-4002
https://access.redhat.com/security/cve/CVE-2013-5855
https://access.redhat.com/security/cve/CVE-2014-0005
https://access.redhat.com/security/cve/CVE-2014-0075
https://access.redhat.com/security/cve/CVE-2014-0096
https://access.redhat.com/security/cve/CVE-2014-0099
https://access.redhat.com/security/cve/CVE-2014-0119
https://access.redhat.com/security/cve/CVE-2014-0193
https://access.redhat.com/security/cve/CVE-2014-0227
https://access.redhat.com/security/cve/CVE-2014-3472
https://access.redhat.com/security/cve/CVE-2014-3490
https://access.redhat.com/security/cve/CVE-2014-3530
https://access.redhat.com/security/cve/CVE-2014-3558
https://access.redhat.com/security/cve/CVE-2014-3577
https://access.redhat.com/security/cve/CVE-2014-3578
https://access.redhat.com/security/cve/CVE-2014-3625
https://access.redhat.com/security/cve/CVE-2014-3682
https://access.redhat.com/security/cve/CVE-2014-8114
https://access.redhat.com/security/cve/CVE-2014-8115
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite&downloadType=distributions&version=6.0.3
6. Contact:
The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2015 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFU48FxXlSAg2UNWIIRArUdAJ0cSD7p3xeDGnP1gmsO3qcsU847JQCfdWUE
0zGlE5yihaJeb8t2i3u7JAw=
=DXIH
-----END PGP SIGNATURE-----
More information about the Jboss-watch-list
mailing list