From bugzilla at redhat.com Thu Jun 9 13:51:30 2016 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 9 Jun 2016 09:51:30 -0400 Subject: [RHSA-2016:1218-01] Moderate: Red Hat JBoss BPM Suite security and bug fix update Message-ID: <201606091351.u59DpUY2006032@int-mx13.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat JBoss BPM Suite security and bug fix update Advisory ID: RHSA-2016:1218-01 Product: Red Hat JBoss BPM Suite Advisory URL: https://access.redhat.com/errata/RHSA-2016:1218 Issue date: 2016-06-09 CVE Names: CVE-2015-3192 ===================================================================== 1. Summary: An update is now available for Red Hat JBoss BPM Suite. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat JBoss BPM Suite is a business rules and processes management system for the management, storage, creation, modification, and deployment of JBoss rules and BPMN2-compliant business processes. Security Fix(es): * A denial of service flaw was found in the way Spring processes inline DTD declarations. A remote attacker could submit a specially crafted XML file that would cause out-of-memory errors when parsed. (CVE-2015-3192) 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process. 4. Bugs fixed (https://bugzilla.redhat.com/): 1239002 - CVE-2015-3192 Spring Framework: denial-of-service attack with XML input 5. References: https://access.redhat.com/security/cve/CVE-2015-3192 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite&downloadType=securityPatches&version=6.2.0 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXWXRgXlSAg2UNWIIRAtpcAJ4k/dYD4qa6rs1dT7MGdqAUadS4SwCZAZhe wHr5aqVxKRBlPchxe3kDhik= =EH3o -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Jun 9 13:51:35 2016 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 9 Jun 2016 09:51:35 -0400 Subject: [RHSA-2016:1219-01] Moderate: Red Hat JBoss BRMS security and bug fix update Message-ID: <201606091351.u59DpZBB025241@int-mx09.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat JBoss BRMS security and bug fix update Advisory ID: RHSA-2016:1219-01 Product: Red Hat JBoss BRMS Advisory URL: https://access.redhat.com/errata/RHSA-2016:1219 Issue date: 2016-06-09 CVE Names: CVE-2015-3192 ===================================================================== 1. Summary: An update is now available for Red Hat JBoss BRMS. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat JBoss BRMS is a business rules management system for the management, storage, creation, modification, and deployment of JBoss Rules. Security Fix(es): * A denial of service flaw was found in the way Spring processes inline DTD declarations. A remote attacker could submit a specially crafted XML file that would cause out-of-memory errors when parsed. (CVE-2015-3192) 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process. 4. Bugs fixed (https://bugzilla.redhat.com/): 1239002 - CVE-2015-3192 Spring Framework: denial-of-service attack with XML input 5. References: https://access.redhat.com/security/cve/CVE-2015-3192 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms&downloadType=securityPatches&version=6.2.0 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXWXRlXlSAg2UNWIIRArXyAJ0d6/DGBZWCeaQ0er3my9E7djssswCeIyEH 72Getjk9fCJSo/jnQ/dwjVE= =4Ink -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Jun 23 21:12:58 2016 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 23 Jun 2016 17:12:58 -0400 Subject: [RHSA-2016:1328-01] Critical: Red Hat JBoss Enterprise Application Platform 5.2 security update Message-ID: <201606232112.u5NLCwLD008583@int-mx10.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: Red Hat JBoss Enterprise Application Platform 5.2 security update Advisory ID: RHSA-2016:1328-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://access.redhat.com/errata/RHSA-2016:1328 Issue date: 2016-06-23 CVE Names: CVE-2016-2141 ===================================================================== 1. Summary: A security update is now available for Red Hat JBoss Enterprise Application Platform 5.2.0 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS - noarch Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES - noarch Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server - noarch Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server - noarch 3. Description: Red Hat JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam. This asynchronous patch is a security update for JGroups package in Red Hat JBoss Enterprise Application Platform 5.2. More information about this vulnerability is available at: https://access.redhat.com/articles/2360521 Security Fix(es): * It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141) The CVE-2016-2141 issue was discovered by Dennis Reed (Red Hat). 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing Red Hat JBoss Enterprise Application Platform 5 installation (including all applications and configuration files). The JBoss server process must be restarted for the update to take effect. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1313589 - CVE-2016-2141 Authorization bypass in JGroups 6. Package List: Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS: Source: jgroups-2.6.22-2.ep5.el4.src.rpm noarch: jgroups-2.6.22-2.ep5.el4.noarch.rpm Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES: Source: jgroups-2.6.22-2.ep5.el4.src.rpm noarch: jgroups-2.6.22-2.ep5.el4.noarch.rpm Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server: Source: jgroups-2.6.22-2.ep5.el5.src.rpm noarch: jgroups-2.6.22-2.ep5.el5.noarch.rpm Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server: Source: jgroups-2.6.22-2.ep5.el6.src.rpm noarch: jgroups-2.6.22-2.ep5.el6.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-2141 https://access.redhat.com/security/updates/classification/#critical https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/?version=5 https://access.redhat.com/articles/2360521 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXbFDZXlSAg2UNWIIRAiCqAKCvJ72OKjZx4UyHuChwsDH0bvtxogCgmBuw EIVtpM1cBLJzylHYBhqYN78= =3lK1 -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Jun 23 21:13:15 2016 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 23 Jun 2016 17:13:15 -0400 Subject: [RHSA-2016:1330-01] Critical: Red Hat JBoss Enterprise Application Platform 6.4 security update Message-ID: <201606232113.u5NLDFKT023613@int-mx14.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: Red Hat JBoss Enterprise Application Platform 6.4 security update Advisory ID: RHSA-2016:1330-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://access.redhat.com/errata/RHSA-2016:1330 Issue date: 2016-06-23 CVE Names: CVE-2016-2141 ===================================================================== 1. Summary: A security update is now available for Red Hat JBoss Enterprise Application Platform from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat JBoss EAP 6.4 for RHEL 5 - noarch Red Hat JBoss EAP 6.4 for RHEL 6 - noarch Red Hat JBoss Enterprise Application Platform 6 for RHEL 7 Server - noarch 3. Description: Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This asynchronous patch is a security update for JGroups package in Red Hat JBoss Enterprise Application Platform 6.4 More information about this vulnerability is available at: https://access.redhat.com/articles/2360521 Security Fix(es): * It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141) The CVE-2016-2141 issue was discovered by Dennis Reed (Red Hat). 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1313589 - CVE-2016-2141 Authorization bypass in JGroups 1343598 - RHEL6 RPMs: Upgrade jgroups to 3.2.16.Final-redhat-1 1343599 - RHEL5 RPMs: Upgrade jgroups to 3.2.16.Final-redhat-1 1343600 - RHEL7 RPMs: Upgrade jgroups to 3.2.16.Final-redhat-1 6. Package List: Red Hat JBoss EAP 6.4 for RHEL 5: Source: jgroups-3.2.16-1.Final_redhat_1.1.ep6.el5.src.rpm noarch: jgroups-3.2.16-1.Final_redhat_1.1.ep6.el5.noarch.rpm Red Hat JBoss EAP 6.4 for RHEL 6: Source: jgroups-3.2.16-1.Final_redhat_1.1.ep6.el6.src.rpm noarch: jgroups-3.2.16-1.Final_redhat_1.1.ep6.el6.noarch.rpm Red Hat JBoss Enterprise Application Platform 6 for RHEL 7 Server: Source: jgroups-3.2.16-1.Final_redhat_1.1.ep6.el7.src.rpm noarch: jgroups-3.2.16-1.Final_redhat_1.1.ep6.el7.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-2141 https://access.redhat.com/security/updates/classification/#critical https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/?version=6.4 https://access.redhat.com/articles/2360521 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXbFDqXlSAg2UNWIIRAhkzAJ9SeQRRD4Y+LBxuxZlkcUYtknRAkQCfacNm M7n26HADrVK2Dp4iOMhvFog= =A/sJ -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Jun 23 21:13:30 2016 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 23 Jun 2016 17:13:30 -0400 Subject: [RHSA-2016:1332-01] Critical: Red Hat JBoss Enterprise Application Platform 7.0 security update Message-ID: <201606232113.u5NLDU7f020928@int-mx11.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: Red Hat JBoss Enterprise Application Platform 7.0 security update Advisory ID: RHSA-2016:1332-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://access.redhat.com/errata/RHSA-2016:1332 Issue date: 2016-06-23 CVE Names: CVE-2016-2141 ===================================================================== 1. Summary: A security update is now available for Red Hat JBoss Enterprise Application Platform from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server - noarch Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server - noarch 3. Description: Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on Wildfly. This asynchronous patch is a security update for JGroups package in Red Hat JBoss Enterprise Application Platform 7.0 More information about this vulnerability is available at: https://access.redhat.com/articles/2360521 Security Fix(es): * It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141) The CVE-2016-2141 issue was discovered by Dennis Reed (Red Hat). 4. Solution: Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. The JBoss server process must be restarted for the update to take effect. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1313589 - CVE-2016-2141 Authorization bypass in JGroups 6. Package List: Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server: Source: eap7-jgroups-3.6.8-3.Final_redhat_3.1.ep7.el6.src.rpm noarch: eap7-jgroups-3.6.8-3.Final_redhat_3.1.ep7.el6.noarch.rpm Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server: Source: eap7-jgroups-3.6.8-3.Final_redhat_3.1.ep7.el7.src.rpm noarch: eap7-jgroups-3.6.8-3.Final_redhat_3.1.ep7.el7.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-2141 https://access.redhat.com/security/updates/classification/#critical https://access.redhat.com/documentation/en/jboss-enterprise-application-platform/ https://access.redhat.com/articles/2360521 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD4DBQFXbFD4XlSAg2UNWIIRAmU4AJikKCijhjZUQjr+P+LndZNUMGHqAJ4xDs4s q3Odi/g+btE/N+WdsbtdMw== =JTWb -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Jun 23 21:13:42 2016 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 23 Jun 2016 17:13:42 -0400 Subject: [RHSA-2016:1334-01] Critical: Red Hat JBoss Data Grid 6.6 security update Message-ID: <201606232113.u5NLDgUX009248@int-mx10.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: Red Hat JBoss Data Grid 6.6 security update Advisory ID: RHSA-2016:1334-01 Product: Red Hat JBoss Data Grid Advisory URL: https://access.redhat.com/errata/RHSA-2016:1334 Issue date: 2016-06-23 CVE Names: CVE-2016-2141 ===================================================================== 1. Summary: A security update is now available for Red Hat JBoss Data Grid from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat JBoss Data Grid is a distributed in-memory data grid, based on Infinispan. This asynchronous patch is a security update for JGroups package in Red Hat JBoss Data Grid 6.6. More information about this vulnerability is available at: https://access.redhat.com/articles/2360521 Security Fix(es): * It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141) The CVE-2016-2141 issue was discovered by Dennis Reed (Red Hat). 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing JBoss Data Grid installation. 4. Bugs fixed (https://bugzilla.redhat.com/): 1313589 - CVE-2016-2141 Authorization bypass in JGroups 5. References: https://access.redhat.com/security/cve/CVE-2016-2141 https://access.redhat.com/security/updates/classification/#critical https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.grid&downloadType=securityPatches&version=6.6.0 https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Data_Grid/ https://access.redhat.com/articles/2360521 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXbFEFXlSAg2UNWIIRAvtSAKC+wmT8kyDgKA6zLJ2f7+WiXUA6igCfWu+u fmzOLR4gwPAsfoS9EH7K9yw= =M2h1 -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Jun 23 22:33:02 2016 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 23 Jun 2016 22:33:02 +0000 Subject: [RHSA-2016:1329-01] Critical: Red Hat JBoss Enterprise Application Platform 5.2 security update Message-ID: <201606232233.u5NMX24g004897@int-mx09.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: Red Hat JBoss Enterprise Application Platform 5.2 security update Advisory ID: RHSA-2016:1329-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-1329.html Issue date: 2016-06-23 CVE Names: CVE-2016-2141 ===================================================================== 1. Summary: A security update is now available for Red Hat JBoss Enterprise Application Platform 5.2.0 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam. This asynchronous patch is a security update for JGroups package in Red Hat JBoss Enterprise Application Platform 5.2. More information about this vulnerability is available at: https://access.redhat.com/articles/2360521 Security Fix(es): * It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141) The CVE-2016-2141 issue was discovered by Dennis Reed (Red Hat). 3. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing Red Hat JBoss Enterprise Application Platform 5 installation (including all applications and configuration files). The JBoss server process must be restarted for the update to take effect. 4. Bugs fixed (https://bugzilla.redhat.com/): 1313589 - CVE-2016-2141 Authorization bypass in JGroups 5. References: https://access.redhat.com/security/cve/CVE-2016-2141 https://access.redhat.com/security/updates/classification/#critical https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/?version=5 https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=5.2.0 https://access.redhat.com/articles/2360521 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXbGOFXlSAg2UNWIIRAoglAJ4lhTnlxeht6UNsZjFECgPpeVKZgQCeId30 O+vGD6Fv40IlbAAlem0CpQI= =nLrt -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Jun 23 22:34:31 2016 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 23 Jun 2016 22:34:31 +0000 Subject: [RHSA-2016:1331-01] Critical: Red Hat JBoss Enterprise Application Platform 6.4 security update Message-ID: <201606232234.u5NMYVii021334@int-mx13.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: Red Hat JBoss Enterprise Application Platform 6.4 security update Advisory ID: RHSA-2016:1331-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-1331.html Issue date: 2016-06-23 CVE Names: CVE-2016-2141 ===================================================================== 1. Summary: A security update is now available for Red Hat JBoss Enterprise Application Platform from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This asynchronous patch is a security update for JGroups package in Red Hat JBoss Enterprise Application Platform 6.4. More information about this vulnerability is available at: https://access.redhat.com/articles/2360521 Security Fix(es): * It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141) The CVE-2016-2141 issue was discovered by Dennis Reed (Red Hat). 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. The JBoss server process must be restarted for the update to take effect. 4. Bugs fixed (https://bugzilla.redhat.com/): 1313589 - CVE-2016-2141 Authorization bypass in JGroups 5. References: https://access.redhat.com/security/cve/CVE-2016-2141 https://access.redhat.com/security/updates/classification/#critical https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/?version=6.4 https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=6.4 https://access.redhat.com/articles/2360521 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXbGPLXlSAg2UNWIIRAltaAKCP2gyDrmFnWPL+dY7bgsC5NREmcwCgl4ez agCWATOdxvejRvA0T48iBJ8= =gdJ+ -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Jun 23 22:36:33 2016 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 23 Jun 2016 22:36:33 +0000 Subject: [RHSA-2016:1333-01] Critical: Red Hat JBoss Enterprise Application Platform 7.0 security update Message-ID: <201606232236.u5NMaXJP006928@int-mx09.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: Red Hat JBoss Enterprise Application Platform 7.0 security update Advisory ID: RHSA-2016:1333-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-1333.html Issue date: 2016-06-23 CVE Names: CVE-2016-2141 ===================================================================== 1. Summary: A security update is now available for Red Hat JBoss Enterprise Application Platform from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on Wildfly. This asynchronous patch is a security update for JGroups package in Red Hat JBoss Enterprise Application Platform 7.0. More information about this vulnerability is available at: https://access.redhat.com/articles/2360521 Security Fix(es): * It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141) The CVE-2016-2141 issue was discovered by Dennis Reed (Red Hat). 3. Solution: Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. The JBoss server process must be restarted for the update to take effect. 4. Bugs fixed (https://bugzilla.redhat.com/): 1313589 - CVE-2016-2141 Authorization bypass in JGroups 5. References: https://access.redhat.com/security/cve/CVE-2016-2141 https://access.redhat.com/security/updates/classification/#critical https://access.redhat.com/documentation/en/jboss-enterprise-application-platform/ https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=7.0 https://access.redhat.com/articles/2360521 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXbGRhXlSAg2UNWIIRAjqBAKCdp/pE75/71JkMMGra7IYIFQNMwwCfXhmk Huj5IO+WgIk3TWJGQvNNGEY= =+5B5 -----END PGP SIGNATURE----- From bugzilla at redhat.com Mon Jun 27 21:05:23 2016 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Mon, 27 Jun 2016 17:05:23 -0400 Subject: [RHSA-2016:1345-01] Critical: Red Hat JBoss BRMS security update Message-ID: <201606272105.u5RL5N2S022928@int-mx13.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: Red Hat JBoss BRMS security update Advisory ID: RHSA-2016:1345-01 Product: Red Hat JBoss BRMS Advisory URL: https://access.redhat.com/errata/RHSA-2016:1345 Issue date: 2016-06-27 CVE Names: CVE-2016-2141 ===================================================================== 1. Summary: An update is now available for Red Hat JBoss BRMS. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat JBoss BRMS is a business rules management system for the management, storage, creation, modification, and deployment of JBoss Rules. Security Fix(es): * It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141) This issue was discovered by Dennis Reed (Red Hat). 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process. 4. Bugs fixed (https://bugzilla.redhat.com/): 1313589 - CVE-2016-2141 Authorization bypass in JGroups 5. References: https://access.redhat.com/security/cve/CVE-2016-2141 https://access.redhat.com/security/updates/classification/#critical https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms&downloadType=securityPatches&version=5.3.1 https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms&downloadType=securityPatches&version=6.3 https://access.redhat.com/articles/2360521 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXcZURXlSAg2UNWIIRAsotAKDDobk6pLexTDX3JAQdLKoaZT3kEgCgwq9l Ay4Ffo3NuNQyr/z/qikPKHA= =3uh1 -----END PGP SIGNATURE----- From bugzilla at redhat.com Mon Jun 27 21:05:27 2016 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Mon, 27 Jun 2016 17:05:27 -0400 Subject: [RHSA-2016:1346-01] Critical: Red Hat JBoss Data Virtualization security and bug fix update Message-ID: <201606272105.u5RL5Rlo031932@int-mx10.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: Red Hat JBoss Data Virtualization security and bug fix update Advisory ID: RHSA-2016:1346-01 Product: Red Hat JBoss Data Virtualization Advisory URL: https://access.redhat.com/errata/RHSA-2016:1346 Issue date: 2016-06-27 CVE Names: CVE-2016-2141 ===================================================================== 1. Summary: An update is now available for Red Hat JBoss Data Virtualization. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat JBoss Data Virtualization is a lean data integration solution that provides easy, real-time, and unified data access across disparate sources to multiple applications and users. JBoss Data Virtualization makes data spread across physically distinct systems - such as multiple databases, XML files, and even Hadoop systems - appear as a set of tables in a local database. Security Fix(es): * It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141) This issue was discovered by Dennis Reed (Red Hat). 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Data Virtualization installation (including its databases, applications, configuration files, and so on). Note that it is recommended to halt the Red Hat JBoss Data Virtualization server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the Red Hat JBoss Data Virtualization server by starting the JBoss Application Server process. 4. Bugs fixed (https://bugzilla.redhat.com/): 1313589 - CVE-2016-2141 Authorization bypass in JGroups 5. References: https://access.redhat.com/security/cve/CVE-2016-2141 https://access.redhat.com/security/updates/classification/#critical https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform&downloadType=securityPatches&version=6.2.0 https://access.redhat.com/articles/2360521 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXcZUVXlSAg2UNWIIRAiF+AJ43DhhcSH7Ohrk+fT5GtS2YAyfL+ACeNu22 XMDpHCOA8MybzlqdLHi2BJY= =+fDm -----END PGP SIGNATURE----- From bugzilla at redhat.com Mon Jun 27 21:05:31 2016 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Mon, 27 Jun 2016 17:05:31 -0400 Subject: [RHSA-2016:1347-01] Critical: Red Hat JBoss BPM Suite security update Message-ID: <201606272105.u5RL5VHK002923@int-mx11.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: Red Hat JBoss BPM Suite security update Advisory ID: RHSA-2016:1347-01 Product: Red Hat JBoss BPM Suite Advisory URL: https://access.redhat.com/errata/RHSA-2016:1347 Issue date: 2016-06-27 CVE Names: CVE-2016-2141 ===================================================================== 1. Summary: An update is now available for Red Hat JBoss BPM Suite. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat JBoss BPM Suite is a business rules and processes management system for the management, storage, creation, modification, and deployment of JBoss rules and BPMN2-compliant business processes. Security Fix(es): * It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141) This issue was discovered by Dennis Reed (Red Hat). 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process. 4. Bugs fixed (https://bugzilla.redhat.com/): 1313589 - CVE-2016-2141 Authorization bypass in JGroups 5. References: https://access.redhat.com/security/cve/CVE-2016-2141 https://access.redhat.com/security/updates/classification/#critical https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite&downloadType=securityPatches&version=6.3 https://access.redhat.com/articles/2360521 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXcZUaXlSAg2UNWIIRAkXeAJ0YK4JyVsTORSwhktHuq1+RxwWIggCgthw4 EJxZ6IzYKSy7rxR8B0cTlZU= =0OF/ -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Jun 29 16:55:14 2016 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 29 Jun 2016 12:55:14 -0400 Subject: [RHSA-2016:1374-01] Critical: Red Hat JBoss Portal 6.2.0 security update Message-ID: <201606291655.u5TGtEo8028140@int-mx10.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: Red Hat JBoss Portal 6.2.0 security update Advisory ID: RHSA-2016:1374-01 Product: Red Hat JBoss Portal Advisory URL: https://access.redhat.com/errata/RHSA-2016:1374 Issue date: 2016-06-29 CVE Names: CVE-2016-2141 ===================================================================== 1. Summary: A security update is now available for Red Hat JBoss Portal Platform from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: JBoss Portal Platform provides an integrated open source platform for hosting and serving a portal's web interface, aggregating, publishing, and managing its content, and personalizing its experience. This asynchronous patch is a security update for JGroups package in Red Hat JBoss Portal Platform 6.2. More information about this vulnerability is available at: https://access.redhat.com/articles/2360521 Security Fix(es): * It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141) The CVE-2016-2141 issue was discovered by Dennis Reed (Red Hat). 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up all applications deployed on JBoss Enterprise Portal Platform, along with all customized configuration files, and any databases and database settings. The JBoss server process must be restarted for the update to take effect. 4. Bugs fixed (https://bugzilla.redhat.com/): 1313589 - CVE-2016-2141 Authorization bypass in JGroups 5. References: https://access.redhat.com/security/cve/CVE-2016-2141 https://access.redhat.com/security/updates/classification/#critical https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal&downloadType=securityPatches&version=6.2.0 https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Portal/ 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXc/1wXlSAg2UNWIIRAp3NAJ9omsaG22jSszriiVfsY+Vbqe4/HgCffFAz gXKTMcIn/rGkQivqVsy1ee8= =f2XW -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Jun 30 21:07:58 2016 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 30 Jun 2016 17:07:58 -0400 Subject: [RHSA-2016:1376-01] Critical: Red Hat JBoss SOA Platform security update Message-ID: <201606302107.u5UL7wYF025770@int-mx09.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: Red Hat JBoss SOA Platform security update Advisory ID: RHSA-2016:1376-01 Product: Red Hat JBoss SOA Platform Advisory URL: https://access.redhat.com/errata/RHSA-2016:1376 Issue date: 2016-06-30 CVE Names: CVE-2015-0226 CVE-2015-0254 CVE-2015-3253 CVE-2016-2141 CVE-2016-2510 ===================================================================== 1. Summary: An update is now available for Red Hat JBoss SOA Platform 5.3.1. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat JBoss SOA Platform is the next-generation ESB and business process automation infrastructure. Red Hat JBoss SOA Platform allows IT to leverage existing (MoM and EAI), modern (SOA and BPM-Rules), and future (EDA and CEP) integration methodologies to dramatically improve business process execution speed and quality. Security Fix(es): * It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141) * It was found that a prior countermeasure in Apache WSS4J for Bleichenbacher's attack on XML Encryption (CVE-2011-2487) threw an exception that permitted an attacker to determine the failure of the attempted attack, thereby leaving WSS4J vulnerable to the attack. The original flaw allowed a remote attacker to recover the entire plain text form of a symmetric key. (CVE-2015-0226) * It was found that the Java Standard Tag Library (JSTL) allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution. (CVE-2015-0254) * A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability. (CVE-2015-3253) * A deserialization flaw allowing remote code execution was found in the BeanShell library. If BeanShell was on the classpath, it could permit code execution if another part of the application deserialized objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the BeanShell library. (CVE-2016-2510) The CVE-2016-2141 issue was discovered by Dennis Reed (Red Hat). 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss SOA Platform installation (including its databases, applications, configuration files, and so on). Note that it is recommended to halt the Red Hat JBoss SOA Platform server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the Red Hat JBoss SOA Platform server by starting the JBoss Application Server process. 4. Bugs fixed (https://bugzilla.redhat.com/): 1191446 - CVE-2015-0226 wss4j: Apache WSS4J is vulnerable to Bleichenbacher's attack (incomplete fix for CVE-2011-2487) 1198606 - CVE-2015-0254 jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags 1243934 - CVE-2015-3253 groovy: remote execution of untrusted code in class MethodClosure 1310647 - CVE-2016-2510 bsh2: remote code execution via deserialization 1313589 - CVE-2016-2141 Authorization bypass in JGroups 5. References: https://access.redhat.com/security/cve/CVE-2015-0226 https://access.redhat.com/security/cve/CVE-2015-0254 https://access.redhat.com/security/cve/CVE-2015-3253 https://access.redhat.com/security/cve/CVE-2016-2141 https://access.redhat.com/security/cve/CVE-2016-2510 https://access.redhat.com/security/updates/classification/#critical https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=soaplatform&downloadType=securityPatches&version=5.3.1+GA https://access.redhat.com/articles/2360521 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXdYosXlSAg2UNWIIRAvQXAJ9sqyexqCNFRPwTUvZP8DjHoPb1GACeNjjK ghsSsTq0X4mvGrxzRYoZLCY= =Eyu4 -----END PGP SIGNATURE-----