RHSA-2012:1125High

Red Hat Security Advisory: JBoss Enterprise SOA Platform 5.3.0 update

Published
July 31, 2012
Last Modified
November 7, 2026

🔗 CVE IDs covered (9)

CVE-2011-3506 →CVE-2011-3517 →CVE-2011-4605 →CVE-2011-4838 →CVE-2011-5245 →CVE-2012-0079 →CVE-2012-0818 →CVE-2012-1167 →CVE-2012-2377 →

📋 Description

CVE-2011-3506 — OpenSSO: unspecified vulnerability in the authentication component CVE-2011-3517 — OpenSSO: unspecified vulnerability in the authentication component CVE-2011-4605 — JNDI: unauthenticated remote write access is permitted by default CVE-2011-4838 — jruby: hash table collisions DoS (oCERT-2011-003) CVE-2011-5245 — RESTEasy: XML eXternal Entity (XXE) flaw CVE-2012-0079 — OpenSSO: Unspecified vulnerability allows remote attackers to affect integrity via unknown vectors CVE-2012-0818 — RESTEasy: XML eXternal Entity (XXE) flaw CVE-2012-1167 — JBoss: authentication bypass when running under JACC with ignoreBaseDecision on JBossWebRealm CVE-2012-2377 — JGroups diagnostics service enabled by default with no authentication when a JGroups channel is started

🎯 Affected products1

  • Red Hat JBoss SOA Platform 5.3

✅ Remediation

All users of JBoss Enterprise SOA Platform 5.2.0 as provided from the Red Hat Customer Portal are advised to upgrade to JBoss Enterprise SOA Platform 5.3.0. The References section of this erratum contains a download link (you must log in to download the new version). Before installing version 5.3.0, back up your existing JBoss Enterprise SOA Platform installation (including its databases, applications, configuration files, and so on). The fix for CVE-2012-0818 is not enabled by default. This update adds a new configuration option to disable entity expansion in RESTEasy. If applications on your server expose RESTEasy XML endpoints, a resteasy.document.expand.entity.references configuration snippet must be added to their web.xml file to disable entity expansion in RESTEasy. Refer to Red Hat Bugzilla bug 785631 for details.

🔗 References (14)