Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.6 update

🔗 CVE IDs covered (1)

📋 Description

🎯 Affected products1

• Red Hat JBoss Enterprise Application Platform 6.4

✅ Remediation

The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. Workaround: Users should upgrade to Apache Standard Taglibs 1.2.3 or later. This version uses JAXP’s FEATURE_SECURE_PROCESSING to restrict XML processing. Depending on the Java runtime version in use, additional configuration may be required: Java8: External entity access is automatically disabled if a SecurityManager is active. Java7: JAXP properties may need to be used to disable external access. See http://docs.oracle.com/javase/tutorial/jaxp/properties/properties.html Java6 and earlier: A new system property org.apache.taglibs.standard.xml.accessExternalEntity may be used to specify the protocols that can be used to access external entities. This defaults to "all" if no SecurityManager is present and to "" (thereby disabling access) if a SecurityManager is detected.

🔗 References (7)

• selfhttps://access.redhat.com/errata/RHSA-2016:0125
• externalhttps://access.redhat.com/security/updates/classification/#important
• externalhttps://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/6.4/index.html
• externalhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=6.4
• externalhttps://access.redhat.com/solutions/1584363
• externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1198606
• selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0125.json