RHSA-2013:0191High

Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 update

Published
January 24, 2013
Last Modified
November 7, 2026

🔗 CVE IDs covered (14)

CVE-2009-5066 →CVE-2011-1096 →CVE-2011-2487 →CVE-2011-2730 →CVE-2011-2908 →CVE-2011-4575 →CVE-2012-0034 →CVE-2012-0874 →CVE-2012-2377 →CVE-2012-2379 →CVE-2012-3369 →CVE-2012-3370 →CVE-2012-3546 →CVE-2012-5478 →

📋 Description

CVE-2009-5066 — JBoss: twiddle.sh accepts credentials as command line arguments, exposing them to other local users via a process listing CVE-2011-1096 — jbossws: Prone to character encoding pattern attack (XML Encryption flaw) CVE-2011-2487 — jbossws: Prone to Bleichenbacher attack against to be distributed symmetric key CVE-2011-2730 — Framework: Information (internal server information, classpath, local working directories, session IDs) disclosure CVE-2011-2908 — CSRF on jmx-console allows invocation of operations on mbeans CVE-2011-4575 — Console: XSS in invoke operation CVE-2012-0034 — Cache: NonManagedConnectionFactory will log password in clear text when an exception occurs CVE-2012-0874 — JBoss invoker servlets do not require authentication CVE-2012-2377 — JGroups diagnostics service enabled by default with no authentication when a JGroups channel is started CVE-2012-2379 — apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token CVE-2012-3369 — JBoss: CallerIdentityLoginModule retaining password from previous call if a null password is provided CVE-2012-3370 — JBoss: SecurityAssociation.getCredential() will return the previous credential if no security context is provided CVE-2012-3546 — Web: Bypass of security constraints CVE-2012-5478 — JBoss: AuthorizationInterceptor allows JMX operation to proceed despite authorization failure

🎯 Affected products200

  • Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • aopalliance-0:1.0-5.3.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • aopalliance-0:1.0-5.3.ep5.el6.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • apache-cxf-0:2.2.12-6.1.patch_04.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • apache-cxf-0:2.2.12-6.1.patch_04.ep5.el6.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • bsh2-0:2.0-0.b4.15.patch01.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • bsh2-0:2.0-0.b4.15.patch01.ep5.el6.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • bsh2-bsf-0:2.0-0.b4.15.patch01.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • glassfish-jaxb-0:2.1.12-12_patch_03.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • glassfish-jaxb-0:2.1.12-12_patch_03.ep5.el6.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • google-guice-0:2.0-3.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • google-guice-0:2.0-3.ep5.el6.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • hibernate3-1:3.3.2-1.9.GA_CP05.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • hibernate3-1:3.3.2-1.9.GA_CP05.ep5.el6.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • hibernate3-annotations-0:3.4.0-3.6.GA_CP05.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • hibernate3-annotations-0:3.4.0-3.6.GA_CP05.ep5.el6.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • hibernate3-annotations-javadoc-0:3.4.0-3.6.GA_CP05.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • hibernate3-entitymanager-0:3.4.0-4.5.GA_CP05.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • hibernate3-entitymanager-0:3.4.0-4.5.GA_CP05.ep5.el6.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • hibernate3-entitymanager-javadoc-0:3.4.0-4.5.GA_CP05.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • hibernate3-javadoc-1:3.3.2-1.9.GA_CP05.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • hibernate3-search-0:3.1.1-2.5.GA_CP05.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • hibernate3-search-0:3.1.1-2.5.GA_CP05.ep5.el6.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • hibernate3-search-javadoc-0:3.1.1-2.5.GA_CP05.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • hornetq-0:2.2.24-1.EAP.GA.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • hornetq-0:2.2.24-1.EAP.GA.ep5.el6.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • hornetq-native-0:2.2.20-1.EAP.GA.ep5.el6.i386 as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • hornetq-native-0:2.2.20-1.EAP.GA.ep5.el6.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • hornetq-native-0:2.2.20-1.EAP.GA.ep5.el6.x86_64 as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • hsqldb-2:1.8.0.10-11_patch_01.1.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server
  • +170 more not shown

✅ Remediation

Note: Manual action is required to apply the fix for CVE-2011-2730. If your system has deployed applications which use Spring framework, the context parameter "springJspExpressionSupport" must be set to "false" to mitigate this flaw, for example, in the application's web.xml file. This will prevent the double-evaluation of EL expressions that led to this flaw. CVE-2012-2379 has been addressed by disabling the affected configuration in this release. If you use the affected configuration, an exception will be thrown and the relevant application will not deploy to the server. A patch that allows the affected configuration to be used without this vulnerability is available in JBoss Enterprise Application Platform 6.0.1. Warning: Before applying this update, back up your existing JBoss Enterprise Application Platform installation (including all applications and configuration files). All users of JBoss Enterprise Application Platform 5.1.2 on Red Hat Enterprise Linux 6 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect. Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258

🔗 References (19)