[RHSA-2014:0896-01] Moderate: Red Hat JBoss Web Framework Kit 2.6.0 update

[bugzilla at redhat.com]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat JBoss Web Framework Kit 2.6.0 update
Advisory ID:       RHSA-2014:0896-01
Product:           Red Hat JBoss Web Framework Kit
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2014-0896.html
Issue date:        2014-07-16
CVE Names:         CVE-2013-1624 CVE-2013-5855 
=====================================================================

1. Summary:

Red Hat JBoss Web Framework Kit 2.6.0, which fixes two security issues,
various bugs, and adds enhancements, is now available from the Red Hat
Customer Portal.

The Red Hat Security Response Team has rated this update as having Moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Description:

Red Hat JBoss Web Framework Kit combines popular open source web frameworks
into a single solution for Java applications.

This release serves as a replacement for Red Hat JBoss Web Framework Kit
2.5.0, and includes bug fixes and enhancements. Refer to the 2.6.0 Release
Notes for information on the most significant of these changes, available
shortly from https://access.redhat.com/documentation/

This release also fixes the following security issues:

It was discovered that bouncycastle leaked timing information when
decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites
were used. A remote attacker could possibly use this flaw to retrieve plain
text from the encrypted packets by using a TLS/SSL server as a padding
oracle. (CVE-2013-1624)

It was found that Mojarra JavaServer Faces did not properly escape
user-supplied content in certain circumstances. Contents of outputText tags
and raw EL expressions that immediately follow script or style elements
were not escaped. A remote attacker could use a specially crafted URL to
execute arbitrary web script in the user's browser. (CVE-2013-5855)

All users of Red Hat JBoss Web Framework Kit 2.5.0 as provided from the Red
Hat Customer Portal are advised to upgrade to Red Hat JBoss Web Framework
Kit 2.6.0.

3. Solution:

The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing installation of Red Hat JBoss Enterprise Application Platform or
Red Hat JBoss Web Server, and applications deployed to it.

The JBoss server process must be restarted for this update to take effect.

4. Bugs fixed (https://bugzilla.redhat.com/):

908428 - CVE-2013-1624 bouncycastle: TLS CBC padding timing attack
1065139 - CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions

5. References:

https://www.redhat.com/security/data/cve/CVE-2013-1624.html
https://www.redhat.com/security/data/cve/CVE-2013-5855.html
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=web.framework.kit&downloadType=distributions
https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Framework_Kit/

6. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2014 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFTxsPAXlSAg2UNWIIRArBpAJ9CFsYsDVtMXL5opx1bRUBGqyEggACgn4b9
BnECFIZSnyUdmuoYw3/3J+Y=
=KSgo
-----END PGP SIGNATURE-----