RHSA-2013:0833High

Red Hat Security Advisory: JBoss Enterprise Application Platform 6.1.0 update

Published
May 20, 2013
Last Modified
November 7, 2026

🔗 CVE IDs covered (7)

CVE-2012-4529 →CVE-2012-4572 →CVE-2012-5575 →CVE-2013-0166 →CVE-2013-0169 →CVE-2013-0218 →CVE-2013-2067 →

📋 Description

CVE-2012-4529 — Web: jsessionid exposed via encoded url when using cookie based session tracking CVE-2012-4572 — JBoss: custom authorization module implementations shared between applications CVE-2012-5575 — apache-cxf: XML encryption backwards compatibility attacks CVE-2013-0166 — openssl: DoS due to improper handling of OCSP response verification CVE-2013-0169 — SSL/TLS: CBC padding timing attack (lucky-13) CVE-2013-0218 — Installer: Generated auto-install xml is world readable CVE-2013-2067 — tomcat: Session fixation in form authenticator

🎯 Affected products1

  • Red Hat JBoss Enterprise Application Platform 6.1

✅ Remediation

The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing JBoss Enterprise Application Platform installation and deployed applications. Workaround: On OpenShift Container Platform 3.11 it's possible to edit the list of cipher suites offered by the router when performing 'edge', or 're-encrypt' TLS modes. Please follow the documentation [1], and [2] to remove the vulnerable CBC ciphers use the modern, or intermediate cipher suites outlined by Mozilla instead [3]. In 'passthrough' mode TLS termination occurs in the application so that is another way to mitigate the vulnerability. [1] https://docs.openshift.com/container-platform/3.11/install_config/router/customized_haproxy_router.html#obtaining-router-configuration-template [2] https://docs.openshift.com/container-platform/3.11/install_config/router/customized_haproxy_router.html#using-configmap-replace-template [3] https://wiki.mozilla.org/Security/Server_Side_TLS

🔗 References (12)