From bugzilla at redhat.com Thu May 14 15:46:58 2015 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 14 May 2015 11:46:58 -0400 Subject: RHSA-2015:1009 Important: Red Hat JBoss Portal 6.2.0 update Message-ID: <201505141546.t4EFkwfm019126@int-mx13.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Portal 6.2.0 update Advisory ID: RHSA-2015:1009 Product: Red Hat JBoss Portal Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1009.html Issue date: 2015-05-14 CVE Names: CVE-2012-6153 CVE-2013-1624 CVE-2013-2133 CVE-2013-4286 CVE-2013-5855 CVE-2013-7285 CVE-2014-0005 CVE-2014-0018 CVE-2014-0034 CVE-2014-0035 CVE-2014-0050 CVE-2014-0058 CVE-2014-0059 CVE-2014-0075 CVE-2014-0086 CVE-2014-0093 CVE-2014-0096 CVE-2014-0099 CVE-2014-0107 CVE-2014-0109 CVE-2014-0110 CVE-2014-0119 CVE-2014-0193 CVE-2014-0227 CVE-2014-0245 CVE-2014-3472 CVE-2014-3481 CVE-2014-3490 CVE-2014-3529 CVE-2014-3530 CVE-2014-3574 CVE-2014-3577 CVE-2014-3586 CVE-2014-4172 ===================================================================== 1. Summary: Red Hat JBoss Portal 6.2.0, which fixes multiple security issues and various bugs, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Red Hat JBoss Portal is the open source implementation of the Java EE suite of services and Portal services running atop Red Hat JBoss Enterprise Application Platform. 2. Description: This release of Red Hat JBoss Portal 6.2.0 serves as a replacement for Red Hat JBoss BPM Suite 6.1.1, and includes bug fixes and enhancements. Refer to the Red Hat JBoss BPM Suite 6.2.0 Release Notes for information on the most significant of these changes. The Release Notes are available at https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Portal/ The following security issues are also fixed with this release, descriptions of which can be found on the respective CVE pages linked in the References section. CVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass CVE-2013-1624 bouncycastle: TLS CBC padding timing attack CVE-2013-2133 JBoss WS: EJB3 role restrictions are not applied to jaxws handlers CVE-2013-4286 JBossWeb: multiple content-length header poisoning flaws CVE-2013-5855 Mojarra JSF2: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions CVE-2013-7285 XStream: remote code execution due to insecure XML deserialization CVE-2014-0005 PicketBox/JBossSX: Security domain authentication configuration modifiable by application CVE-2014-0018 JBoss AS Server: Unchecked access to MSC Service Registry under JSM CVE-2014-0034 Apache CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid CVE-2014-0035 Apache CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy CVE-2014-0050 JBossWeb: denial of service due to too-small buffer size used bt MultipartStream CVE-2014-0058 Red Hat JBoss EAP 6: Plain text password logging CVE-2014-0059 PicketBox/JBossSX: World readable audit.log file CVE-2014-0075 JBossWeb: Limited DoS in chunked transfer encoding input filter CVE-2014-0086 JBoss RichFaces: remote denial of service via memory exhaustion CVE-2014-0093 Red Hat JBoss EAP 6: JSM policy not respected by deployed applications CVE-2014-0096 JBossWeb: XXE vulnerability via user supplied XSLTs CVE-2014-0099 JBossWeb: Request smuggling via malicious content length header CVE-2014-0107 Xalan-Java: insufficient constraints in secure processing feature (oCERT-2014-002) CVE-2014-0109 Apache CXF: HTML content posted to SOAP endpoint could cause OOM errors CVE-2014-0110 Apache CXF: Large invalid content fills temporary space CVE-2014-0119 JBossWeb: XML parser hijack by malicious web application CVE-2014-0193 Netty: DoS via memory exhaustion during data aggregation CVE-2014-0227 JBossWeb: Limited DoS in chunked transfer encoding input filter CVE-2014-0245 GateIn WSRP: Information disclosure via unsafe concurrency handling in interceptor CVE-2014-3472 JBoss AS Controller: Invalid EJB caller role check CVE-2014-3481 JBoss AS JAX RS Integration: Information disclosure via XML XXE CVE-2014-3490 RESTEasy: XXE via parameter entities CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage CVE-2014-3574 Apache POI: entity expansion (billion laughs) flaw CVE-2014-3529 Apache POI: XXE flaw CVE-2014-3577 Apache HttpComponents incomplete fix for CVE-2012-6153 CVE-2014-3586 JBoss AS CLI: Insecure default permissions on history file CVE-2014-4172 Cas-client: Bypass of security constraints via URL parameter injection Red Hat would like to thank James Roper of Typesafe for reporting CVE-2014-0193, CA Technologies for reporting CVE-2014-3472, and Alexander Papadakis for reporting CVE-2014-3530. The CVE-2013-2133 issue was discovered by Richard Opalka and Arun Neelicattu of Red Hat, the CVE-2014-0005 issue was discovered by Josef Cacek of the Red Hat JBoss EAP Quality Engineering team, the CVE-2014-0018 issue was discovered by Stuart Douglas of Red Hat, the CVE-2014-3481 issue was discovered by the Red Hat JBoss Enterprise Application Platform QE team, the CVE-2014-0075 and CVE-2014-3490 issues were discovered by David Jorm of Red Hat Product Security, and the CVE-2014-0093 issue was discovered by Josef Cacek of the Red Hat JBoss EAP Quality Engineering team. 3. Solution: All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat Customer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0. The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up all applications deployed on JBoss Enterprise Portal Platform, along with all customized configuration files, and any databases and database settings. 4. Bugs fixed (https://bugzilla.redhat.com/): 908428 - CVE-2013-1624 bouncycastle: TLS CBC padding timing attack 969924 - CVE-2013-2133 JBoss WS: EJB3 role restrictions are not applied to jaxws handlers 1049736 - CVE-2014-0005 PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application 1051277 - CVE-2013-7285 XStream: remote code execution due to insecure XML deserialization 1052783 - CVE-2014-0018 jboss-as-server: Unchecked access to MSC Service Registry under JSM 1058454 - CVE-2013-1624 bouncycastle: TLS CBC padding timing attack [jpp-6.2.0] 1062337 - CVE-2014-0050 apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream 1063641 - CVE-2014-0058 Red Hat JBoss EAP6: Plain text password logging during security audit 1063642 - CVE-2014-0059 JBossSX/PicketBox: World readable audit.log file 1065139 - CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions 1067268 - CVE-2014-0086 JBoss RichFaces: remote denial of service via memory exhaustion 1069921 - CVE-2013-4286 tomcat: multiple content-length header poisoning flaws 1070046 - CVE-2014-0093 JBoss EAP 6: JSM policy not respected by deployed applications 1072776 - CVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter 1080248 - CVE-2014-0107 Xalan-Java: insufficient constraints in secure processing feature 1088342 - CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs 1092783 - CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation 1093526 - CVE-2014-0109 Apache CXF: HTML content posted to SOAP endpoint could cause OOM errors 1093527 - CVE-2014-0110 Apache CXF: Large invalid content could cause temporary space to fill 1093529 - CVE-2014-0034 Apache CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid 1093530 - CVE-2014-0035 Apache CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy 1101303 - CVE-2014-0245 GateIn WSRP: Information disclosure via unsafe concurrency handling in interceptor 1102030 - CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content length header 1102038 - CVE-2014-0119 Tomcat/JBossWeb: XML parser hijack by malicious web application 1103815 - CVE-2014-3472 JBoss AS Security: Invalid EJB caller role check implementation 1105242 - CVE-2014-3481 JBoss AS JAX-RS: Information disclosure via XML eXternal Entity (XXE) 1107901 - CVE-2014-3490 RESTEasy: XXE via parameter entities 1109196 - CVE-2014-0227 Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter 1112987 - CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage 1126687 - CVE-2014-3586 JBoss AS CLI: Insecure default permissions on history file 1129074 - CVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix 1129916 - CVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix 1131350 - CVE-2014-4172 cas-client: Bypass of security constraints via URL parameter injection 1138135 - CVE-2014-3529 apache-poi: XML eXternal Entity (XXE) flaw 1138140 - CVE-2014-3574 apache-poi: entity expansion (billion laughs) flaw 5. References: https://access.redhat.com/security/cve/CVE-2012-6153 https://access.redhat.com/security/cve/CVE-2013-1624 https://access.redhat.com/security/cve/CVE-2013-2133 https://access.redhat.com/security/cve/CVE-2013-4286 https://access.redhat.com/security/cve/CVE-2013-5855 https://access.redhat.com/security/cve/CVE-2013-7285 https://access.redhat.com/security/cve/CVE-2014-0005 https://access.redhat.com/security/cve/CVE-2014-0018 https://access.redhat.com/security/cve/CVE-2014-0034 https://access.redhat.com/security/cve/CVE-2014-0035 https://access.redhat.com/security/cve/CVE-2014-0050 https://access.redhat.com/security/cve/CVE-2014-0058 https://access.redhat.com/security/cve/CVE-2014-0059 https://access.redhat.com/security/cve/CVE-2014-0075 https://access.redhat.com/security/cve/CVE-2014-0086 https://access.redhat.com/security/cve/CVE-2014-0093 https://access.redhat.com/security/cve/CVE-2014-0096 https://access.redhat.com/security/cve/CVE-2014-0099 https://access.redhat.com/security/cve/CVE-2014-0107 https://access.redhat.com/security/cve/CVE-2014-0109 https://access.redhat.com/security/cve/CVE-2014-0110 https://access.redhat.com/security/cve/CVE-2014-0119 https://access.redhat.com/security/cve/CVE-2014-0193 https://access.redhat.com/security/cve/CVE-2014-0227 https://access.redhat.com/security/cve/CVE-2014-0245 https://access.redhat.com/security/cve/CVE-2014-3472 https://access.redhat.com/security/cve/CVE-2014-3481 https://access.redhat.com/security/cve/CVE-2014-3490 https://access.redhat.com/security/cve/CVE-2014-3529 https://access.redhat.com/security/cve/CVE-2014-3530 https://access.redhat.com/security/cve/CVE-2014-3574 https://access.redhat.com/security/cve/CVE-2014-3577 https://access.redhat.com/security/cve/CVE-2014-3586 https://access.redhat.com/security/cve/CVE-2014-4172 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal&downloadType=distributions https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Portal/ 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVVMNwXlSAg2UNWIIRAtmkAJ9GoL0JQeJKs+fbXJcs1Qt6sbP87gCglw4D AkWnyhjYum8n3N723AZS1So= =dWRf -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu May 14 15:47:05 2015 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 14 May 2015 11:47:05 -0400 Subject: RHSA-2015:1010 Important: Red Hat JBoss Portal 6.2.0 security update Message-ID: <201505141547.t4EFl5ps029163@int-mx10.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Portal 6.2.0 security update Advisory ID: RHSA-2015:1010 Product: Red Hat JBoss Portal Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1010.html Issue date: 2015-05-14 CVE Names: CVE-2014-3596 ===================================================================== 1. Summary: An update for the Axis component of Red Hat JBoss Portal 6.2.0 that fixes one security issue is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Description: Red Hat JBoss Portal is the open source implementation of the Java EE suite of services and Portal services running atop Red Hat JBoss Enterprise Application Platform. It was discovered that Axis incorrectly extracted the host name from an X.509 certificate subject's Common Name (CN) field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. (CVE-2014-3596) This issue was discovered by David Jorm and Arun Neelicattu of Red Hat Product Security. All users of Red Hat JBoss Portal 6.2.0 as provided from the Red Hat Customer Portal are advised to apply this update. 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up all applications deployed on JBoss Enterprise Portal Platform, along with all customized configuration files, and any databases and database settings. 4. Bugs fixed (https://bugzilla.redhat.com/): 1129935 - CVE-2014-3596 axis: SSL hostname verification bypass, incomplete CVE-2012-5784 fix 5. References: https://access.redhat.com/security/cve/CVE-2014-3596 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal&downloadType=securityPatches&version=6.2.0 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVVMN4XlSAg2UNWIIRAgUJAJ4ngJK23Aa6XY1PctKHyh86q5dNWACeJvKH weiMBLk9ksA0DeJfH5U4Plk= =bnlY -----END PGP SIGNATURE-----