RHSA-2013:0198High

Red Hat Security Advisory: JBoss Enterprise Web Platform 5.2.0 update

Published
January 24, 2013
Last Modified
November 7, 2026

🔗 CVE IDs covered (13)

CVE-2009-5066 →CVE-2011-1096 →CVE-2011-2487 →CVE-2011-2730 →CVE-2011-2908 →CVE-2011-4575 →CVE-2012-0874 →CVE-2012-2377 →CVE-2012-2379 →CVE-2012-3369 →CVE-2012-3370 →CVE-2012-3546 →CVE-2012-5478 →

📋 Description

CVE-2009-5066 — JBoss: twiddle.sh accepts credentials as command line arguments, exposing them to other local users via a process listing CVE-2011-1096 — jbossws: Prone to character encoding pattern attack (XML Encryption flaw) CVE-2011-2487 — jbossws: Prone to Bleichenbacher attack against to be distributed symmetric key CVE-2011-2730 — Framework: Information (internal server information, classpath, local working directories, session IDs) disclosure CVE-2011-2908 — CSRF on jmx-console allows invocation of operations on mbeans CVE-2011-4575 — Console: XSS in invoke operation CVE-2012-0874 — JBoss invoker servlets do not require authentication CVE-2012-2377 — JGroups diagnostics service enabled by default with no authentication when a JGroups channel is started CVE-2012-2379 — apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token CVE-2012-3369 — JBoss: CallerIdentityLoginModule retaining password from previous call if a null password is provided CVE-2012-3370 — JBoss: SecurityAssociation.getCredential() will return the previous credential if no security context is provided CVE-2012-3546 — Web: Bypass of security constraints CVE-2012-5478 — JBoss: AuthorizationInterceptor allows JMX operation to proceed despite authorization failure

🎯 Affected products1

  • Red Hat JBoss Web Platform 5.2

✅ Remediation

Note: Manual action is required to apply the fix for CVE-2011-2730. If your system has deployed applications which use Spring framework, the context parameter "springJspExpressionSupport" must be set to "false" to mitigate this flaw, for example, in the application's web.xml file. This will prevent the double-evaluation of EL expressions that led to this flaw. CVE-2012-2379 has been addressed by disabling the affected configuration in this release. If you use the affected configuration, an exception will be thrown and the relevant application will not deploy to the server. A patch that allows the affected configuration to be used without this vulnerability is available in JBoss Enterprise Application Platform 6.0.1. The References section of this erratum contains a download link (you must log in to download the update). Warning: Before applying this update, back up your existing JBoss Enterprise Web Platform installation (including all applications and configuration files). All users of JBoss Enterprise Web Platform 5.1.2 as provided from the Red Hat Customer Portal are advised to upgrade to JBoss Enterprise Web Platform 5.2.0.

🔗 References (18)