RHSA-2012:1028High
Red Hat Security Advisory: JBoss Enterprise BRMS Platform 5.3.0 update
🔗 CVE IDs covered (4)
📋 Description
CVE-2011-4085 — Invoker servlets authentication bypass (HTTP verb tampering) CVE-2011-4605 — JNDI: unauthenticated remote write access is permitted by default CVE-2012-1167 — JBoss: authentication bypass when running under JACC with ignoreBaseDecision on JBossWebRealm CVE-2012-2377 — JGroups diagnostics service enabled by default with no authentication when a JGroups channel is started
🎯 Affected products1
- JBoss Enterprise BRMS Platform 5.3
✅ Remediation
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing JBoss Enterprise BRMS Platform installation (including its databases, applications, configuration files, and so on).
🔗 References (8)
- selfhttps://access.redhat.com/errata/RHSA-2012:1028
- externalhttps://access.redhat.com/security/updates/classification/#important
- externalhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms&downloadType=distributions
- externalhttps://docs.redhat.com/docs/en-US/index.html
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=750422
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=766469
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=823392
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1028.json