RHSA-2013:0221High

Red Hat Security Advisory: JBoss Enterprise BRMS Platform 5.3.1 update

Published
January 31, 2013
Last Modified
November 7, 2026

🔗 CVE IDs covered (11)

CVE-2009-5066 →CVE-2011-1096 →CVE-2011-2487 →CVE-2011-2730 →CVE-2011-4575 →CVE-2012-0034 →CVE-2012-0874 →CVE-2012-3369 →CVE-2012-3370 →CVE-2012-3546 →CVE-2012-5478 →

📋 Description

CVE-2009-5066 — JBoss: twiddle.sh accepts credentials as command line arguments, exposing them to other local users via a process listing CVE-2011-1096 — jbossws: Prone to character encoding pattern attack (XML Encryption flaw) CVE-2011-2487 — jbossws: Prone to Bleichenbacher attack against to be distributed symmetric key CVE-2011-2730 — Framework: Information (internal server information, classpath, local working directories, session IDs) disclosure CVE-2011-4575 — Console: XSS in invoke operation CVE-2012-0034 — Cache: NonManagedConnectionFactory will log password in clear text when an exception occurs CVE-2012-0874 — JBoss invoker servlets do not require authentication CVE-2012-3369 — JBoss: CallerIdentityLoginModule retaining password from previous call if a null password is provided CVE-2012-3370 — JBoss: SecurityAssociation.getCredential() will return the previous credential if no security context is provided CVE-2012-3546 — Web: Bypass of security constraints CVE-2012-5478 — JBoss: AuthorizationInterceptor allows JMX operation to proceed despite authorization failure

🎯 Affected products1

  • JBoss Enterprise BRMS Platform 5.3

✅ Remediation

Note: Manual action is required to apply the fix for CVE-2011-2730. If your system has deployed applications which use Spring framework, the context parameter "springJspExpressionSupport" must be set to "false" to mitigate this flaw, for example, in the application's web.xml file. This will prevent the double-evaluation of EL expressions that led to this flaw. Warning: Before applying the update, back up your existing JBoss Enterprise BRMS Platform installation (including its databases, applications, configuration files, and so on). The References section of this erratum contains a download link (you must log in to download the update). Warning: Before applying the update, back up your existing JBoss Enterprise BRMS Platform installation (including its databases, applications, configuration files, and so on). All users of JBoss Enterprise BRMS Platform 5.3.0 as provided from the Red Hat Customer Portal are advised to upgrade to JBoss Enterprise BRMS Platform 5.3.1.

🔗 References (17)