RHSA-2013:0649High
Red Hat Security Advisory: Fuse ESB Enterprise 7.1.0 update
🔗 CVE IDs covered (3)
📋 Description
CVE-2012-5055 — Security: Ability to determine if username is valid via DaoAuthenticationProvider CVE-2012-5633 — apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor CVE-2013-0239 — apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate
🎯 Affected products1
- Fuse ESB Enterprise 7.1.0
✅ Remediation
The References section of this erratum contains a download link (you must log in to download the update).
🔗 References (10)
- selfhttps://access.redhat.com/errata/RHSA-2013:0649
- externalhttps://access.redhat.com/security/updates/classification/#important
- externalhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.esb.enterprise&downloadType=securityPatches&version=7.1.0
- externalhttp://cxf.apache.org/cve-2012-5633.html
- externalhttp://cxf.apache.org/cve-2013-0239.html
- externalhttp://support.springsource.com/security/cve-2012-5055
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=886031
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=889008
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=905722
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0649.json