RHSA-2013:0533High

Red Hat Security Advisory: JBoss Enterprise SOA Platform 5.3.1 update

Published
February 20, 2013
Last Modified
November 7, 2026

🔗 CVE IDs covered (11)

CVE-2009-5066 →CVE-2011-2487 →CVE-2011-2730 →CVE-2011-4575 →CVE-2012-0034 →CVE-2012-0874 →CVE-2012-3369 →CVE-2012-3370 →CVE-2012-5370 →CVE-2012-5478 →CVE-2012-5629 →

📋 Description

CVE-2009-5066 — JBoss: twiddle.sh accepts credentials as command line arguments, exposing them to other local users via a process listing CVE-2011-2487 — jbossws: Prone to Bleichenbacher attack against to be distributed symmetric key CVE-2011-2730 — Framework: Information (internal server information, classpath, local working directories, session IDs) disclosure CVE-2011-4575 — Console: XSS in invoke operation CVE-2012-0034 — Cache: NonManagedConnectionFactory will log password in clear text when an exception occurs CVE-2012-0874 — JBoss invoker servlets do not require authentication CVE-2012-3369 — JBoss: CallerIdentityLoginModule retaining password from previous call if a null password is provided CVE-2012-3370 — JBoss: SecurityAssociation.getCredential() will return the previous credential if no security context is provided CVE-2012-5370 — jruby: Murmur hash function collisions (oCERT-2012-001) CVE-2012-5478 — JBoss: AuthorizationInterceptor allows JMX operation to proceed despite authorization failure CVE-2012-5629 — JBoss: allows empty password to authenticate against LDAP

🎯 Affected products1

  • Red Hat JBoss SOA Platform 5.3

✅ Remediation

The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing JBoss Enterprise SOA Platform installation (including its databases, applications, configuration files, and so on).

🔗 References (15)