RHSA-2013:1437High

Red Hat Security Advisory: Red Hat JBoss Portal 6.1.0 update

Published
October 16, 2013
Last Modified
November 7, 2026

🔗 CVE IDs covered (13)

CVE-2012-4431 →CVE-2012-4529 →CVE-2012-4572 →CVE-2012-5575 →CVE-2013-1921 →CVE-2013-2067 →CVE-2013-2102 →CVE-2013-2160 →CVE-2013-2172 →CVE-2013-4112 →CVE-2013-4128 →CVE-2013-4213 →CVE-2013-6495 →

📋 Description

CVE-2012-4431 — Tomcat/JBoss Web - Bypass of CSRF prevention filter CVE-2012-4529 — Web: jsessionid exposed via encoded url when using cookie based session tracking CVE-2012-4572 — JBoss: custom authorization module implementations shared between applications CVE-2012-5575 — apache-cxf: XML encryption backwards compatibility attacks CVE-2013-1921 — PicketBox: Insecure storage of masked passwords CVE-2013-2067 — tomcat: Session fixation in form authenticator CVE-2013-2102 — Gatein: JGroups configurations enable diagnostics without authentication CVE-2013-2160 — apache-cxf: Multiple denial of service flaws in the StAX parser CVE-2013-2172 — Java: XML signature spoofing CVE-2013-4112 — JGroups: Authentication via cached credentials CVE-2013-4128 — remote-naming: Session fixation due improper connection caching CVE-2013-4213 — ejb-client: Session fixation due improper connection caching CVE-2013-6495 — Bayeux: Reflected Cross-Site Scripting (XSS)

🎯 Affected products1

  • Red Hat JBoss Portal Platform 6.1

✅ Remediation

Red Hat would like to thank Tibor Jager, Kenneth G. Paterson and Juraj Somorovsky of Ruhr-University Bochum for reporting CVE-2012-5575; and Andreas Falkenberg of SEC Consult Deutschland GmbH, and Christian Mainka, Juraj Somorovsky, and Joerg Schwenk of Ruhr-University Bochum for reporting CVE-2013-2160. CVE-2012-4572 was discovered by Josef Cacek of the Red Hat JBoss EAP Quality Engineering team; CVE-2013-4128 and CVE-2013-4213 were discovered by Wolf-Dieter Fink of the Red Hat GSS Team; and CVE-2013-2102 was discovered by Red Hat. All users of Red Hat JBoss Portal 6.0.0 as provided from the Red Hat Customer Portal are advised to upgrade to Red Hat JBoss Portal 6.1.0. The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up all applications deployed on JBoss Enterprise Portal Platform, along with all customized configuration files, and any databases and database settings.

🔗 References (16)