RHSA-2014:0910High

Red Hat Security Advisory: Red Hat JBoss Operations Network 3.2.2 update

Published
July 21, 2014
Last Modified
November 7, 2026

🔗 CVE IDs covered (4)

CVE-2013-5855 →CVE-2014-0058 →CVE-2014-0193 →CVE-2014-3530 →

📋 Description

CVE-2013-5855 — JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions CVE-2014-0058 — EAP6: Plain text password logging during security audit CVE-2014-0193 — netty: DoS via memory exhaustion during data aggregation CVE-2014-3530 — PicketLink: XXE via insecure DocumentBuilderFactory usage

🎯 Affected products1

  • Red Hat JBoss Operations Network 3.2

✅ Remediation

The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing JBoss Operations Network installation (including its databases, applications, configuration files, the JBoss Operations Network server's file system directory, and so on). Refer to the JBoss Operations Network 3.2.2 Release Notes for installation information. The provided patch to fix CVE-2014-0058 also allows greater control over which of the following components of web requests are captured in audit logs: - parameters - cookies - headers - attributes It is also possible to selectively mask some elements of headers, parameters, cookies, and attributes using masks. This capability is provided by two system properties, which are introduced by this patch: 1) org.jboss.security.web.audit Description: This property controls the granularity of the security auditing of web requests. Possible values: off = Disables auditing of web requests headers = Audits only the headers of web requests cookies = Audits only the cookies of web requests parameters = Audits only the parameters of web requests attributes = Audits only the attributes of web requests headers,cookies,parameters = Audits the headers, cookies, and parameters of web requests headers,cookies = Audits the headers and cookies of web requests Default Value: headers, parameters Examples: Setting "org.jboss.security.web.audit=off" disables security auditing of web requests entirely. Setting "org.jboss.security.web.audit=headers" enables security auditing of only headers in web requests. 2) org.jboss.security.web.audit.mask Description: This property can be used to specify a list of strings to be matched against headers, parameters, cookies, and attributes of web requests. Any element matching the specified masks will be excluded from security audit logging. Possible values: Any comma separated string indicating keys of headers, parameters, cookies, and attributes. Default Value: j_password, authorization Note that currently the matching of the masks is fuzzy rather than strict. For example, a mask of "authorization" will mask both the header called authorization and the parameter called "custom_authorization". A future release may introduce strict masks.

🔗 References (9)