Red Hat Security Advisory: JBoss Enterprise SOA Platform 4.3.CP04 and 5.0.2 security update
🔗 CVE IDs covered (1)
📋 Description
CVE-2010-4476 — JDK Double.parseDouble Denial-Of-Service
🎯 Affected products2
- Red Hat JBoss SOA Platform 4.3
- Red Hat JBoss SOA Platform 5.0
✅ Remediation
Updated jbossweb-2.0.0.jar (for 4.3.CP04) and jbossweb-2.1.10.jar (for 5.0.2) files that fix CVE-2010-4476 for JBoss Enterprise SOA Platform 4.3.CP04 and 5.0.2 are available from the Red Hat Customer Portal. To download and install the updated files: 1) Log into the Customer Portal: https://access.redhat.com/login 2) Navigate to https://access.redhat.com/jbossnetwork/restricted/listSoftware.html 3) On the left-hand side menu, under "JBoss Enterprise Platforms" click "SOA Platform". Then, using the "Version:" drop down menu, select the SOA Platform version you are using, such as "4.3.0.GA_CP04" or "5.0.2 GA". 4) From the "Security Advisories" tab, click the "CVE-2010-4476 JBossweb update fixing JDK double bug..." link in the "Download File" column. The "Software Details" page is displayed, where you can download the update and view installation instructions. 5) Backup your existing jbossweb.jar file (refer to the "Software Details" page, from step 4, for the location of this file). 6) After downloading the update, ensure you backed up your existing jbossweb.jar file as per step 5, and then follow the manual installation step on the "Software Details" page. Note that it is recommended to halt the JBoss Enterprise SOA Platform server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the JBoss Enterprise SOA Platform server by starting the JBoss Application Server process.