RHSA-2013:1013Medium

Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 update

Published
July 3, 2013
Last Modified
November 7, 2026

🔗 CVE IDs covered (7)

CVE-2012-3499 →CVE-2012-3544 →CVE-2012-4558 →CVE-2013-0166 →CVE-2013-0169 →CVE-2013-2067 →CVE-2013-2071 →

📋 Description

CVE-2012-3499 — httpd: multiple XSS flaws due to unescaped hostnames CVE-2012-3544 — tomcat: Limited DoS in chunked transfer encoding input filter CVE-2012-4558 — httpd: XSS flaw in mod_proxy_balancer manager interface CVE-2013-0166 — openssl: DoS due to improper handling of OCSP response verification CVE-2013-0169 — SSL/TLS: CBC padding timing attack (lucky-13) CVE-2013-2067 — tomcat: Session fixation in form authenticator CVE-2013-2071 — tomcat: Information disclosure in asynchronous context when using AsyncListeners that threw RuntimeExceptions

🎯 Affected products1

  • Red Hat JBoss Web Server 2.0

✅ Remediation

The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). Workaround: On OpenShift Container Platform 3.11 it's possible to edit the list of cipher suites offered by the router when performing 'edge', or 're-encrypt' TLS modes. Please follow the documentation [1], and [2] to remove the vulnerable CBC ciphers use the modern, or intermediate cipher suites outlined by Mozilla instead [3]. In 'passthrough' mode TLS termination occurs in the application so that is another way to mitigate the vulnerability. [1] https://docs.openshift.com/container-platform/3.11/install_config/router/customized_haproxy_router.html#obtaining-router-configuration-template [2] https://docs.openshift.com/container-platform/3.11/install_config/router/customized_haproxy_router.html#using-configmap-replace-template [3] https://wiki.mozilla.org/Security/Server_Side_TLS

🔗 References (13)