Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2014-0227 (GCVE-0-2014-0227)
Vulnerability from cvelistv5 – Published: 2015-02-16 00:00 – Updated: 2024-08-06 09:05
VLAI
EPSS
Summary
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
37 references
Date Public
2015-02-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:05:39.451Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html"
},
{
"name": "USN-2654-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-2654-1"
},
{
"name": "RHSA-2015:0765",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0765.html"
},
{
"name": "RHSA-2015:0675",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0675.html"
},
{
"name": "MDVSA-2015:052",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:052"
},
{
"name": "HPSBUX03341",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=143393515412274\u0026w=2"
},
{
"name": "RHSA-2015:0720",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0720.html"
},
{
"name": "SSRT102068",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=143393515412274\u0026w=2"
},
{
"name": "72717",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/72717"
},
{
"name": "RHSA-2015:0991",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0991.html"
},
{
"name": "MDVSA-2015:084",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:084"
},
{
"name": "DSA-3530",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"name": "1032791",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1032791"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://tomcat.apache.org/security-7.html"
},
{
"name": "RHSA-2015:0983",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0983.html"
},
{
"name": "SSRT102066",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=143403519711434\u0026w=2"
},
{
"name": "MDVSA-2015:053",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:053"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"name": "FEDORA-2015-2109",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://tomcat.apache.org/security-8.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://source.jboss.org/changelog/JBossWeb?cs=2455"
},
{
"name": "20150209 [SECURITY] CVE-2014-0227 Apache Tomcat Request Smuggling",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2015-02/0067.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://advisories.mageia.org/MGASA-2015-0081.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://tomcat.apache.org/security-6.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
},
{
"name": "USN-2655-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-2655-1"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1600984"
},
{
"name": "HPSBUX03337",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=143403519711434\u0026w=2"
},
{
"name": "DSA-3447",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3447"
},
{
"name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-02-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-13T16:09:57.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html"
},
{
"name": "USN-2654-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-2654-1"
},
{
"name": "RHSA-2015:0765",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0765.html"
},
{
"name": "RHSA-2015:0675",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0675.html"
},
{
"name": "MDVSA-2015:052",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:052"
},
{
"name": "HPSBUX03341",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "http://marc.info/?l=bugtraq\u0026m=143393515412274\u0026w=2"
},
{
"name": "RHSA-2015:0720",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0720.html"
},
{
"name": "SSRT102068",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "http://marc.info/?l=bugtraq\u0026m=143393515412274\u0026w=2"
},
{
"name": "72717",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/72717"
},
{
"name": "RHSA-2015:0991",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0991.html"
},
{
"name": "MDVSA-2015:084",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:084"
},
{
"name": "DSA-3530",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"name": "1032791",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1032791"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://tomcat.apache.org/security-7.html"
},
{
"name": "RHSA-2015:0983",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0983.html"
},
{
"name": "SSRT102066",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "http://marc.info/?l=bugtraq\u0026m=143403519711434\u0026w=2"
},
{
"name": "MDVSA-2015:053",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:053"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"name": "FEDORA-2015-2109",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://tomcat.apache.org/security-8.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://source.jboss.org/changelog/JBossWeb?cs=2455"
},
{
"name": "20150209 [SECURITY] CVE-2014-0227 Apache Tomcat Request Smuggling",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2015-02/0067.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://advisories.mageia.org/MGASA-2015-0081.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://tomcat.apache.org/security-6.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
},
{
"name": "USN-2655-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-2655-1"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1600984"
},
{
"name": "HPSBUX03337",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "http://marc.info/?l=bugtraq\u0026m=143403519711434\u0026w=2"
},
{
"name": "DSA-3447",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3447"
},
{
"name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2014-0227",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html"
},
{
"name": "USN-2654-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-2654-1"
},
{
"name": "RHSA-2015:0765",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0765.html"
},
{
"name": "RHSA-2015:0675",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0675.html"
},
{
"name": "MDVSA-2015:052",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:052"
},
{
"name": "HPSBUX03341",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=143393515412274\u0026w=2"
},
{
"name": "RHSA-2015:0720",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0720.html"
},
{
"name": "SSRT102068",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=143393515412274\u0026w=2"
},
{
"name": "72717",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/72717"
},
{
"name": "RHSA-2015:0991",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0991.html"
},
{
"name": "MDVSA-2015:084",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:084"
},
{
"name": "DSA-3530",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"name": "1032791",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1032791"
},
{
"name": "http://tomcat.apache.org/security-7.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-7.html"
},
{
"name": "RHSA-2015:0983",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0983.html"
},
{
"name": "SSRT102066",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=143403519711434\u0026w=2"
},
{
"name": "MDVSA-2015:053",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:053"
},
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"name": "FEDORA-2015-2109",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html"
},
{
"name": "http://tomcat.apache.org/security-8.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-8.html"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"name": "https://source.jboss.org/changelog/JBossWeb?cs=2455",
"refsource": "CONFIRM",
"url": "https://source.jboss.org/changelog/JBossWeb?cs=2455"
},
{
"name": "20150209 [SECURITY] CVE-2014-0227 Apache Tomcat Request Smuggling",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2015-02/0067.html"
},
{
"name": "http://advisories.mageia.org/MGASA-2015-0081.html",
"refsource": "CONFIRM",
"url": "http://advisories.mageia.org/MGASA-2015-0081.html"
},
{
"name": "http://tomcat.apache.org/security-6.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-6.html"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
},
{
"name": "USN-2655-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-2655-1"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1600984",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1600984"
},
{
"name": "HPSBUX03337",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=143403519711434\u0026w=2"
},
{
"name": "DSA-3447",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3447"
},
{
"name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2014-0227",
"datePublished": "2015-02-16T00:00:00.000Z",
"dateReserved": "2013-12-03T00:00:00.000Z",
"dateUpdated": "2024-08-06T09:05:39.451Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2014-0227",
"date": "2026-05-29",
"epss": "0.78235",
"percentile": "0.99042"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2014-0227\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2015-02-16T00:59:00.057\",\"lastModified\":\"2026-05-06T22:30:45.220\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.\"},{\"lang\":\"es\",\"value\":\"java/org/apache/coyote/http11/filters/ChunkedInputFilter.java en Apache Tomcat 6.x anterior a 6.0.42, 7.x anterior a 7.0.55, y 8.x anterior a 8.0.9 no maneja correctamente los intentos de seguir leyendo datos despu\u00e9s de un error haya ocurrido, lo que permite a atacantes remotos realizar ataques de la infiltraci\u00f3n de solicitudes HTTP o causar una denegaci\u00f3n de servicio (consumo de recursos) mediante la transmisi\u00f3n de datos con la codificaci\u00f3n malformada de transferencias fragmentadas.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:P/A:P\",\"baseScore\":6.4,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-19\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49E3C039-A949-4F1B-892A-57147EECB249\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:*\",\"matchCriteriaId\":\"0A354C34-A3FE-4B8A-9985-8874A0634BC7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F28C7801-41B9-4552-BA1E-577967BCBBEE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:*\",\"matchCriteriaId\":\"CFE300CC-FD4A-444E-8506-E5E269D0A0A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25B21085-7259-4685-9D1F-FF98E6489E10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:*\",\"matchCriteriaId\":\"F50A3EC9-516E-48A7-839B-A73F491B5B9F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C28F09D-5CAA-4CA7-A2B5-3B2820F5F409\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"635EE321-2A1F-4FF8-95BE-0C26591969D9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9A81B035-8598-4D2C-B45F-C6C9D4B10C2F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.4:alpha:*:*:*:*:*:*\",\"matchCriteriaId\":\"FAC2FC75-97D2-4EA1-A1A0-F592A6D7C1F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E1096947-82A6-4EA8-A4F2-00D91E3F7DAF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0EBFA1D3-16A6-4041-BB30-51D2EE0F2AF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.6:alpha:*:*:*:*:*:*\",\"matchCriteriaId\":\"C4871FD1-7F8C-4677-A80B-4A0BBC71DD7C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B70B372F-EFFD-4AF7-99B5-7D1B23A0C54C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.7:alpha:*:*:*:*:*:*\",\"matchCriteriaId\":\"31AB969A-9ACE-44EF-B2E5-CEC008F47C46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.7:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"06217215-72E4-4478-BACB-628A0836A645\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9C95ADA4-66F5-45C4-A677-ACE22367A75A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.8:alpha:*:*:*:*:*:*\",\"matchCriteriaId\":\"EA810F3F-ADD3-4D3F-9DFC-DBDD87B3079C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"11951A10-39A2-4FF5-8C43-DF94730FB794\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.9:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B79F2EA-C893-4359-80EC-24AE38D982E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"351E5BCF-A56B-4D91-BA3C-21A4B77D529A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2DC2BBB4-171E-4EFF-A575-A5B7FF031755\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6B6B0504-27C1-4824-A928-A878CBBAB32D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CE81AD36-ACD1-4C6C-8E7C-5326D1DA3045\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D903956B-14F5-4177-AF12-0A5F1846D3C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"81F847DC-A2F5-456C-9038-16A0E85F4C3B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF3EBD00-1E1E-452D-AFFB-08A6BD111DDD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C6B93A3A-D487-4CA1-8257-26F8FE287B8B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BD8802B2-57E0-4AA6-BC8E-00DE60468569\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8461DF95-18DC-4BF5-A703-7F19DA88DC30\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F4C9BCF-9C73-4991-B02F-E08C5DA06EBA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2823789C-2CB6-4300-94DB-BDBE83ABA8E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C5416C76-46ED-4CB1-A7F8-F24EA16DE7F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A61429EE-4331-430C-9830-58DCCBCBCB58\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31B3593F-CEDF-423C-90F8-F88EED87DC3E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AE7862B2-E1FA-4E16-92CD-8918AB461D9A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A9E03BE3-60CC-4415-B993-D0BB00F87A30\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CE92E59A-FF0D-4D1A-8B12-CC41A7E1FD3C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BFD64FE7-ABAF-49F3-B8D0-91C37C822F4B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"48E5E8C3-21AD-4230-B945-AB7DE66307B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4945C8C1-C71B-448B-9075-07C6C92599CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.36:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ED4730B0-2E09-408B-AFD4-FE00F73700FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8DE8A8A-7643-4292-BCC1-758AE0940207\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.39:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E9B54FCD-CF7C-47E2-8513-40419E47AF49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.41:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D87EFB6D-B626-469F-907C-40C771A55833\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0F8C62EF-1B67-456A-9C66-755439CF8556\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"33E9607B-4D28-460D-896B-E4B7FA22441E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A819E245-D641-4F19-9139-6C940504F6E7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C381275-10C5-4939-BCE3-0D1F3B3CB2EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"81A31CA0-A209-4C49-AA06-C38E165E5B68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7205475A-6D04-4042-B24E-1DA5A57029B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"08022987-B36B-4F63-88A5-A8F59195DF4A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"0AA563BF-A67A-477D-956A-167ABEF885C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF4B7557-EF35-451E-B55D-3296966695AC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8980E61E-27BE-4858-82B3-C0E8128AF521\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8756BF9B-3E24-4677-87AE-31CE776541F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"88CE057E-2092-4C98-8D0C-75CF439D0A9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F194580-EE6D-4E38-87F3-F0661262256B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A9731BAA-4C6C-4259-B786-F577D8A90FA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F74A421-D019-4248-84B8-C70D4D9A8A95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BA27FF9-4C66-4E17-95C0-1CB2DAA6AFC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"05346F5A-FB52-4376-AAC7-9A5308216545\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"305688F2-50A6-41FB-8614-BC589DB9A789\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D24AA431-C436-4AA5-85DF-B9AAFF2548FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25966344-15D5-4101-9346-B06BFD2DFFF5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"11F4CBAC-27B1-4EFF-955A-A63B457D0578\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD55B338-9DBE-4643-ABED-A08964D3AF7C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D4F710E-06EA-48F4-AC6A-6F143950F015\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C4936C2-0B2D-4C44-98C3-443090965F5E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"48453405-2319-4327-9F4C-6F70B49452C6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49DD9544-6424-41A6-AEC0-EC19B8A10E71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E4670E65-2E11-49A4-B661-57C2F60D411F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5E8FF71D-4710-4FBB-9925-A6A26C450F7D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31002A23-4788-4BC7-AE11-A3C2AA31716D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7144EDDF-8265-4642-8EEB-ED52527E0A26\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF06B5C1-B9DD-4673-A101-56E1E593ACDD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7D731065-626B-4425-8E49-F708DD457824\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3D850EA-E537-42C8-93B9-96E15CB26747\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E037DA05-2BEF-4F64-B8BB-307247B6A05C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BCAF1EB5-FB34-40FC-96ED-9D073890D8BF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D395D95B-1F4A-420E-A0F6-609360AF7B69\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BD221BA-0AB6-4972-8AD9-5D37AC07762F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E55B6565-96CB-4F6A-9A80-C3FB82F30546\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3300AFE-49A4-4904-B9A0-5679F09FA01E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ED5125CC-05F9-4678-90DB-A5C7CD24AE6F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7BD93669-1B30-4BF8-AD7D-F60DD8D63CC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1B904C74-B92E-4EAE-AE6C-78E2B844C3DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8C8C97F-6C9D-4647-AB8A-ADAA5536DDE2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C6109D1-BC36-40C5-A02A-7AEBC949BAC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA8A7333-B4C3-4876-AE01-62F2FD315504\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"92993E23-D805-407B-8B87-11CEEE8B212F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7A11BD74-305C-41E2-95B1-5008EEF5FA5F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"595442D0-9DB7-475A-AE30-8535B70E122E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4B0BA92A-0BD3-4CE4-9465-95E949104BAC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F944B72-B9EB-4EB8-AEA3-E0D7ADBE1305\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AA28D3A-3EE5-4F90-B8F5-4943F7607DA6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BFD3EB84-2ED2-49D4-8BC9-6398C2E46F0A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEDF6E1A-0DD6-42AB-9510-F6F4B6002C91\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C947E549-2459-4AFB-84A7-36BDA30B5F29\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D55DF79-F9BE-4907-A4D8-96C4B11189ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.53:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"14AB5787-82D7-4F78-BE93-4556AB7A7D0E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.54:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F8E9453E-BC9B-4F77-85FA-BA15AC55C245\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"4752862B-7D26-4285-B8A0-CF082C758353\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*\",\"matchCriteriaId\":\"58EA7199-3373-4F97-9907-3A479A02155E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4693BD36-E522-4C8E-9667-8F3E14A05EF3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BBBC5EA-012C-4C5D-A61B-BAF134B300DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2A358FDF-C249-4D7A-9445-8B9E7D9D40AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AFF96F96-34DB-4EB3-BF59-11220673FA26\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EDF3E379-47D2-4C86-8C6D-8B3C25A0E1C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"61E008F8-2F01-4DD8-853A-337B4B4163C6\"}]}]}],\"references\":[{\"url\":\"http://advisories.mageia.org/MGASA-2015-0081.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://archives.neohapsis.com/archives/bugtraq/2015-02/0067.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=143393515412274\u0026w=2\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=143403519711434\u0026w=2\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0675.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0720.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0765.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0983.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0991.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://svn.apache.org/viewvc?view=revision\u0026revision=1600984\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://tomcat.apache.org/security-6.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://tomcat.apache.org/security-7.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://tomcat.apache.org/security-8.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.debian.org/security/2016/dsa-3447\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.debian.org/security/2016/dsa-3530\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2015:052\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2015:053\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2015:084\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securityfocus.com/bid/72717\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securitytracker.com/id/1032791\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.ubuntu.com/usn/USN-2654-1\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.ubuntu.com/usn/USN-2655-1\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1109196\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://source.jboss.org/changelog/JBossWeb?cs=2455\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://advisories.mageia.org/MGASA-2015-0081.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://archives.neohapsis.com/archives/bugtraq/2015-02/0067.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=143393515412274\u0026w=2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=143403519711434\u0026w=2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0675.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0720.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0765.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0983.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0991.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://svn.apache.org/viewvc?view=revision\u0026revision=1600984\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://tomcat.apache.org/security-6.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://tomcat.apache.org/security-7.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://tomcat.apache.org/security-8.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.debian.org/security/2016/dsa-3447\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2016/dsa-3530\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2015:052\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2015:053\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2015:084\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/72717\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id/1032791\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.ubuntu.com/usn/USN-2654-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.ubuntu.com/usn/USN-2655-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1109196\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://source.jboss.org/changelog/JBossWeb?cs=2455\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
RHSA-2014:1021
Vulnerability from csaf_redhat - Published: 2014-08-06 14:52 - Updated: 2026-05-14 22:17Summary
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 update
Severity
Important
Notes
Topic: Updated packages that provide Red Hat JBoss Enterprise Application Platform
6.3.0 and fix multiple security issues, several bugs, and add various
enhancements are now available from the Red Hat Customer Portal.
The Red Hat Security Response Team has rated this update as having
Important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
Details: Red Hat JBoss Enterprise Application Platform 6 is a platform for Java
applications based on JBoss Application Server 7.
A race condition flaw, leading to heap-based buffer overflows, was found in
the mod_status httpd module. A remote attacker able to access a status page
served by mod_status on a server using a threaded Multi-Processing Module
(MPM) could send a specially crafted request that would cause the httpd
child process to crash or, possibly, allow the attacker to execute
arbitrary code with the privileges of the "apache" user. (CVE-2014-0226)
A denial of service flaw was found in the way httpd's mod_deflate module
handled request body decompression (configured via the "DEFLATE" input
filter). A remote attacker able to send a request whose body would be
decompressed could use this flaw to consume an excessive amount of system
memory and CPU on the target system. (CVE-2014-0118)
A denial of service flaw was found in the way OpenSSL handled certain DTLS
ServerHello requests. A specially crafted DTLS handshake packet could cause
a DTLS client using OpenSSL to crash. (CVE-2014-0221)
Note: This update provides a fix for the CVE-2014-0221 issue in openssl
packages for Solaris, HP-UX, and Microsoft Windows.
A denial of service flaw was found in the way httpd's mod_cgid module
executed CGI scripts that did not read data from the standard input.
A remote attacker could submit a specially crafted request that would cause
the httpd child process to hang indefinitely. (CVE-2014-0231)
A flaw was found in the WebSocket08FrameDecoder implementation that could
allow a remote attacker to trigger an Out Of Memory Exception by issuing a
series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on
the server configuration, this could lead to a denial of service.
(CVE-2014-0193)
It was found that the isCallerInRole() method of the SimpleSecurityManager
did not correctly check caller roles. A remote, authenticated attacker
could use this flaw to circumvent the caller check in applications that use
black list access control based on caller roles. (CVE-2014-3472)
Red Hat would like to thank the OpenSSL project for reporting
CVE-2014-0221; upstream acknowledges Imre Rad of Search-Lab as the original
reporter of this issue. Red Hat would also like to thank James Roper of
Typesafe for reporting CVE-2014-0193, and CA Technologies for reporting
CVE-2014-3472.
This release of JBoss Enterprise Application Platform also includes bug
fixes and enhancements. Documentation for these changes will be available
shortly from the JBoss Enterprise Application Platform 6.3.0 Release Notes,
linked to in the References.
All users of Red Hat JBoss Enterprise Application Platform 6.2 as provided
from the Red Hat Customer Portal are advised to apply this update.
The JBoss server process must be restarted for the update to take effect.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A denial of service flaw was found in the way httpd's mod_deflate module handled request body decompression (configured via the "DEFLATE" input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 6.3
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:6.3
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 6.3
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:6.3
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
A denial of service flaw was found in the way OpenSSL handled certain DTLS ServerHello requests. A specially crafted DTLS handshake packet could cause a DTLS client using OpenSSL to crash.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 6.3
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:6.3
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the "apache" user.
6.8 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 6.3
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:6.3
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 6.3
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:6.3
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
A denial of service flaw was found in the way httpd's mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 6.3
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:6.3
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that the fix for CVE-2013-2133 was incomplete: the JAX-WS handlers were being executed for outbound messages even when authorization had failed. A remote attacker who is authorized to access the EJB class, could invoke a JAX-WS handler which they were not authorized to invoke.
4.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 6.3
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:6.3
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
It was found that the isCallerInRole() method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles.
2.1 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 6.3
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:6.3
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
References
47 references
Acknowledgments
Typesafe
James Roper
OpenSSL project
Search-Lab
Imre Rad
Red Hat Quality Engineering Team
Tomas Kyjovsky
CA Technologies
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated packages that provide Red Hat JBoss Enterprise Application Platform\n6.3.0 and fix multiple security issues, several bugs, and add various\nenhancements are now available from the Red Hat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nImportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Enterprise Application Platform 6 is a platform for Java\napplications based on JBoss Application Server 7.\n\nA race condition flaw, leading to heap-based buffer overflows, was found in\nthe mod_status httpd module. A remote attacker able to access a status page\nserved by mod_status on a server using a threaded Multi-Processing Module\n(MPM) could send a specially crafted request that would cause the httpd\nchild process to crash or, possibly, allow the attacker to execute\narbitrary code with the privileges of the \"apache\" user. (CVE-2014-0226)\n\nA denial of service flaw was found in the way httpd\u0027s mod_deflate module\nhandled request body decompression (configured via the \"DEFLATE\" input\nfilter). A remote attacker able to send a request whose body would be\ndecompressed could use this flaw to consume an excessive amount of system\nmemory and CPU on the target system. (CVE-2014-0118)\n\nA denial of service flaw was found in the way OpenSSL handled certain DTLS\nServerHello requests. A specially crafted DTLS handshake packet could cause\na DTLS client using OpenSSL to crash. (CVE-2014-0221)\n\nNote: This update provides a fix for the CVE-2014-0221 issue in openssl\npackages for Solaris, HP-UX, and Microsoft Windows.\n\nA denial of service flaw was found in the way httpd\u0027s mod_cgid module\nexecuted CGI scripts that did not read data from the standard input.\nA remote attacker could submit a specially crafted request that would cause\nthe httpd child process to hang indefinitely. (CVE-2014-0231)\n\nA flaw was found in the WebSocket08FrameDecoder implementation that could\nallow a remote attacker to trigger an Out Of Memory Exception by issuing a\nseries of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on\nthe server configuration, this could lead to a denial of service.\n(CVE-2014-0193)\n\nIt was found that the isCallerInRole() method of the SimpleSecurityManager\ndid not correctly check caller roles. A remote, authenticated attacker\ncould use this flaw to circumvent the caller check in applications that use\nblack list access control based on caller roles. (CVE-2014-3472)\n\nRed Hat would like to thank the OpenSSL project for reporting\nCVE-2014-0221; upstream acknowledges Imre Rad of Search-Lab as the original\nreporter of this issue. Red Hat would also like to thank James Roper of\nTypesafe for reporting CVE-2014-0193, and CA Technologies for reporting\nCVE-2014-3472.\n\nThis release of JBoss Enterprise Application Platform also includes bug\nfixes and enhancements. Documentation for these changes will be available\nshortly from the JBoss Enterprise Application Platform 6.3.0 Release Notes,\nlinked to in the References.\n\nAll users of Red Hat JBoss Enterprise Application Platform 6.2 as provided\nfrom the Red Hat Customer Portal are advised to apply this update.\nThe JBoss server process must be restarted for the update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:1021",
"url": "https://access.redhat.com/errata/RHSA-2014:1021"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform\u0026downloadType=distributions\u0026version=6.3",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform\u0026downloadType=distributions\u0026version=6.3"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/6.3/html/6.3.0_Release_Notes/index.html",
"url": "https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/6.3/html/6.3.0_Release_Notes/index.html"
},
{
"category": "external",
"summary": "1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "1103593",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103593"
},
{
"category": "external",
"summary": "1103815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103815"
},
{
"category": "external",
"summary": "1120596",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120596"
},
{
"category": "external",
"summary": "1120601",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120601"
},
{
"category": "external",
"summary": "1120603",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120603"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1021.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 update",
"tracking": {
"current_release_date": "2026-05-14T22:17:20+00:00",
"generator": {
"date": "2026-05-14T22:17:20+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.0"
}
},
"id": "RHSA-2014:1021",
"initial_release_date": "2014-08-06T14:52:25+00:00",
"revision_history": [
{
"date": "2014-08-06T14:52:25+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2014-08-06T14:52:25+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-14T22:17:20+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Application Platform 6.3",
"product": {
"name": "Red Hat JBoss Enterprise Application Platform 6.3",
"product_id": "Red Hat JBoss Enterprise Application Platform 6.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6.3"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Enterprise Application Platform"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2014-0118",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-07-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1120601"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in the way httpd\u0027s mod_deflate module handled request body decompression (configured via the \"DEFLATE\" input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: mod_deflate denial of service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0118"
},
{
"category": "external",
"summary": "RHBZ#1120601",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120601"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0118",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0118"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0118",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0118"
},
{
"category": "external",
"summary": "http://httpd.apache.org/security/vulnerabilities_24.html",
"url": "http://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2014-07-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-06T14:52:25+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting Red Hat JBoss Enterprise Application Platform installation and\ndeployed applications.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1021"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "httpd: mod_deflate denial of service"
},
{
"acknowledgments": [
{
"names": [
"James Roper"
],
"organization": "Typesafe"
}
],
"cve": "CVE-2014-0193",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-04-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1092783"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: DoS via memory exhaustion during data aggregation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0193"
},
{
"category": "external",
"summary": "RHBZ#1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0193",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193"
}
],
"release_date": "2014-05-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-06T14:52:25+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting Red Hat JBoss Enterprise Application Platform installation and\ndeployed applications.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1021"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "netty: DoS via memory exhaustion during data aggregation"
},
{
"acknowledgments": [
{
"names": [
"OpenSSL project"
]
},
{
"names": [
"Imre Rad"
],
"organization": "Search-Lab",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2014-0221",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-06-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1103593"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in the way OpenSSL handled certain DTLS ServerHello requests. A specially crafted DTLS handshake packet could cause a DTLS client using OpenSSL to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: DoS when sending invalid DTLS handshake",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0221"
},
{
"category": "external",
"summary": "RHBZ#1103593",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103593"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0221",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0221"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0221",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0221"
},
{
"category": "external",
"summary": "https://www.openssl.org/news/secadv_20140605.txt",
"url": "https://www.openssl.org/news/secadv_20140605.txt"
}
],
"release_date": "2014-06-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-06T14:52:25+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting Red Hat JBoss Enterprise Application Platform installation and\ndeployed applications.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1021"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: DoS when sending invalid DTLS handshake"
},
{
"cve": "CVE-2014-0226",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2014-07-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1120603"
}
],
"notes": [
{
"category": "description",
"text": "A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the \"apache\" user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: mod_status heap-based buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0226"
},
{
"category": "external",
"summary": "RHBZ#1120603",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120603"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0226",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0226"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0226",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0226"
},
{
"category": "external",
"summary": "http://httpd.apache.org/security/vulnerabilities_24.html",
"url": "http://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2014-07-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-06T14:52:25+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting Red Hat JBoss Enterprise Application Platform installation and\ndeployed applications.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1021"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpd: mod_status heap-based buffer overflow"
},
{
"cve": "CVE-2014-0227",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109196"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0227"
},
{
"category": "external",
"summary": "RHBZ#1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0227",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43",
"url": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55",
"url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55"
}
],
"release_date": "2015-02-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-06T14:52:25+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting Red Hat JBoss Enterprise Application Platform installation and\ndeployed applications.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1021"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter"
},
{
"cve": "CVE-2014-0231",
"discovery_date": "2014-07-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1120596"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in the way httpd\u0027s mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: mod_cgid denial of service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0231"
},
{
"category": "external",
"summary": "RHBZ#1120596",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120596"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0231",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0231"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0231",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0231"
},
{
"category": "external",
"summary": "http://httpd.apache.org/security/vulnerabilities_24.html",
"url": "http://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2014-07-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-06T14:52:25+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting Red Hat JBoss Enterprise Application Platform installation and\ndeployed applications.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1021"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "httpd: mod_cgid denial of service"
},
{
"acknowledgments": [
{
"names": [
"Tomas Kyjovsky"
],
"organization": "Red Hat Quality Engineering Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3464",
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102317"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2013-2133 was incomplete: the JAX-WS handlers were being executed for outbound messages even when authorization had failed. A remote attacker who is authorized to access the EJB class, could invoke a JAX-WS handler which they were not authorized to invoke.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "WS: Incomplete fix for CVE-2013-2133",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3464"
},
{
"category": "external",
"summary": "RHBZ#1102317",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102317"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3464",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3464"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3464",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3464"
}
],
"release_date": "2014-08-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-06T14:52:25+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting Red Hat JBoss Enterprise Application Platform installation and\ndeployed applications.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1021"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "WS: Incomplete fix for CVE-2013-2133"
},
{
"acknowledgments": [
{
"names": [
"CA Technologies"
]
}
],
"cve": "CVE-2014-3472",
"cwe": {
"id": "CWE-184",
"name": "Incomplete List of Disallowed Inputs"
},
"discovery_date": "2014-05-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1103815"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the isCallerInRole() method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Security: Invalid EJB caller role check implementation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3472"
},
{
"category": "external",
"summary": "RHBZ#1103815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3472",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3472"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3472",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3472"
}
],
"release_date": "2014-08-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-06T14:52:25+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting Red Hat JBoss Enterprise Application Platform installation and\ndeployed applications.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1021"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Security: Invalid EJB caller role check implementation"
}
]
}
RHSA-2014:1086
Vulnerability from csaf_redhat - Published: 2014-08-21 15:30 - Updated: 2026-05-14 22:17Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.0 update
Severity
Important
Notes
Topic: Red Hat JBoss Web Server 2.1.0, which fixes multiple security issues and
several bugs, is now available from the Red Hat Customer Portal for Red Hat
Enterprise Linux 5 and 6, Solaris, and Microsoft Windows.
Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details: Red Hat JBoss Web Server is a fully integrated and certified set of
components for hosting Java web applications. It is comprised of the Apache
HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector
(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat
Native library.
This release serves as a replacement for Red Hat JBoss Web Server 2.0.1,
and includes several bug fixes. Refer to the Red Hat JBoss Web Server 2.1.0
Release Notes, linked to in the References section, for information on the
most significant of these changes.
The following security issues are also fixed with this release:
A race condition flaw, leading to heap-based buffer overflows, was found in
the mod_status httpd module. A remote attacker able to access a status page
served by mod_status on a server using a threaded Multi-Processing Module
(MPM) could send a specially crafted request that would cause the httpd
child process to crash or, possibly, allow the attacker to execute
arbitrary code with the privileges of the "apache" user. (CVE-2014-0226)
A denial of service flaw was found in the way httpd's mod_deflate module
handled request body decompression (configured via the "DEFLATE" input
filter). A remote attacker able to send a request whose body would be
decompressed could use this flaw to consume an excessive amount of system
memory and CPU on the target system. (CVE-2014-0118)
A denial of service flaw was found in the way OpenSSL handled certain DTLS
ServerHello requests. A specially crafted DTLS handshake packet could cause
a DTLS client using OpenSSL to crash. (CVE-2014-0221)
Note: This update provides a fix for the CVE-2014-0221 issue in openssl
packages for Solaris and Microsoft Windows.
A denial of service flaw was found in the way httpd's mod_cgid module
executed CGI scripts that did not read data from the standard input.
A remote attacker could submit a specially crafted request that would cause
the httpd child process to hang indefinitely. (CVE-2014-0231)
It was found that several application-provided XML files, such as web.xml,
content.xml, *.tld, *.tagx, and *.jspx, resolved external entities,
permitting XML External Entity (XXE) attacks. An attacker able to deploy
malicious applications to Tomcat could use this flaw to circumvent security
restrictions set by the JSM, and gain access to sensitive information on
the system. Note that this flaw only affected deployments in which Tomcat
is running applications from untrusted sources, such as in a shared hosting
environment. (CVE-2013-4590)
It was found that, in certain circumstances, it was possible for a
malicious web application to replace the XML parsers used by Tomcat to
process XSLTs for the default servlet, JSP documents, tag library
descriptors (TLDs), and tag plug-in configuration files. The injected XML
parser(s) could then bypass the limits imposed on XML external entities
and/or gain access to the XML files processed for other web applications
deployed on the same Tomcat instance. (CVE-2014-0119)
Red Hat would like to thank the OpenSSL project for reporting
CVE-2014-0221. Upstream acknowledges Imre Rad of Search-Lab as the original
reporter of this issue.
All users of Red Hat JBoss Web Server 2.0.1 as provided from the Red Hat
Customer Portal are advised to upgrade to Red Hat JBoss Web Server 2.1.0.
The JBoss server process must be restarted for this update to take effect.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
It was found that several application-provided XML files, such as web.xml, content.xml, *.tld, *.tagx, and *.jspx, resolved external entities, permitting XML External Entity (XXE) attacks. An attacker able to deploy malicious applications to Tomcat could use this flaw to circumvent security restrictions set by the JSM, and gain access to sensitive information on the system. Note that this flaw only affected deployments in which Tomcat is running applications from untrusted sources, such as in a shared hosting environment.
1.2 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 2.1
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:2.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
A denial of service flaw was found in the way httpd's mod_deflate module handled request body decompression (configured via the "DEFLATE" input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 2.1
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:2.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.
2.1 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 2.1
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:2.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
A denial of service flaw was found in the way OpenSSL handled certain DTLS ServerHello requests. A specially crafted DTLS handshake packet could cause a DTLS client using OpenSSL to crash.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 2.1
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:2.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the "apache" user.
6.8 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 2.1
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:2.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 2.1
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:2.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
A denial of service flaw was found in the way httpd's mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 2.1
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:2.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
43 references
Acknowledgments
OpenSSL project
Search-Lab
Imre Rad
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Web Server 2.1.0, which fixes multiple security issues and\nseveral bugs, is now available from the Red Hat Customer Portal for Red Hat\nEnterprise Linux 5 and 6, Solaris, and Microsoft Windows.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of\ncomponents for hosting Java web applications. It is comprised of the Apache\nHTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector\n(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat\nNative library.\n\nThis release serves as a replacement for Red Hat JBoss Web Server 2.0.1,\nand includes several bug fixes. Refer to the Red Hat JBoss Web Server 2.1.0\nRelease Notes, linked to in the References section, for information on the\nmost significant of these changes.\n\nThe following security issues are also fixed with this release:\n\nA race condition flaw, leading to heap-based buffer overflows, was found in\nthe mod_status httpd module. A remote attacker able to access a status page\nserved by mod_status on a server using a threaded Multi-Processing Module\n(MPM) could send a specially crafted request that would cause the httpd\nchild process to crash or, possibly, allow the attacker to execute\narbitrary code with the privileges of the \"apache\" user. (CVE-2014-0226)\n\nA denial of service flaw was found in the way httpd\u0027s mod_deflate module\nhandled request body decompression (configured via the \"DEFLATE\" input\nfilter). A remote attacker able to send a request whose body would be\ndecompressed could use this flaw to consume an excessive amount of system\nmemory and CPU on the target system. (CVE-2014-0118)\n\nA denial of service flaw was found in the way OpenSSL handled certain DTLS\nServerHello requests. A specially crafted DTLS handshake packet could cause\na DTLS client using OpenSSL to crash. (CVE-2014-0221)\n\nNote: This update provides a fix for the CVE-2014-0221 issue in openssl\npackages for Solaris and Microsoft Windows.\n\nA denial of service flaw was found in the way httpd\u0027s mod_cgid module\nexecuted CGI scripts that did not read data from the standard input.\nA remote attacker could submit a specially crafted request that would cause\nthe httpd child process to hang indefinitely. (CVE-2014-0231)\n\nIt was found that several application-provided XML files, such as web.xml,\ncontent.xml, *.tld, *.tagx, and *.jspx, resolved external entities,\npermitting XML External Entity (XXE) attacks. An attacker able to deploy\nmalicious applications to Tomcat could use this flaw to circumvent security\nrestrictions set by the JSM, and gain access to sensitive information on\nthe system. Note that this flaw only affected deployments in which Tomcat\nis running applications from untrusted sources, such as in a shared hosting\nenvironment. (CVE-2013-4590)\n\nIt was found that, in certain circumstances, it was possible for a\nmalicious web application to replace the XML parsers used by Tomcat to\nprocess XSLTs for the default servlet, JSP documents, tag library\ndescriptors (TLDs), and tag plug-in configuration files. The injected XML\nparser(s) could then bypass the limits imposed on XML external entities\nand/or gain access to the XML files processed for other web applications\ndeployed on the same Tomcat instance. (CVE-2014-0119)\n\nRed Hat would like to thank the OpenSSL project for reporting\nCVE-2014-0221. Upstream acknowledges Imre Rad of Search-Lab as the original\nreporter of this issue.\n\nAll users of Red Hat JBoss Web Server 2.0.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Web Server 2.1.0.\nThe JBoss server process must be restarted for this update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:1086",
"url": "https://access.redhat.com/errata/RHSA-2014:1086"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=webserver\u0026version=2.1.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=webserver\u0026version=2.1.0"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Web_Server/2.1/html/2.1.0_Release_Notes/index.html",
"url": "https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Web_Server/2.1/html/2.1.0_Release_Notes/index.html"
},
{
"category": "external",
"summary": "1069911",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069911"
},
{
"category": "external",
"summary": "1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "1103593",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103593"
},
{
"category": "external",
"summary": "1120596",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120596"
},
{
"category": "external",
"summary": "1120601",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120601"
},
{
"category": "external",
"summary": "1120603",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120603"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1086.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.0 update",
"tracking": {
"current_release_date": "2026-05-14T22:17:21+00:00",
"generator": {
"date": "2026-05-14T22:17:21+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.0"
}
},
"id": "RHSA-2014:1086",
"initial_release_date": "2014-08-21T15:30:27+00:00",
"revision_history": [
{
"date": "2014-08-21T15:30:27+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2014-08-21T15:30:27+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-14T22:17:21+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 2.1",
"product": {
"name": "Red Hat JBoss Web Server 2.1",
"product_id": "Red Hat JBoss Web Server 2.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2.1"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2013-4590",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-02-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1069911"
}
],
"notes": [
{
"category": "description",
"text": "It was found that several application-provided XML files, such as web.xml, content.xml, *.tld, *.tagx, and *.jspx, resolved external entities, permitting XML External Entity (XXE) attacks. An attacker able to deploy malicious applications to Tomcat could use this flaw to circumvent security restrictions set by the JSM, and gain access to sensitive information on the system. Note that this flaw only affected deployments in which Tomcat is running applications from untrusted sources, such as in a shared hosting environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: information disclosure via XXE when running untrusted web applications",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect JBoss Web, as shipped with various Red Hat JBoss products.\n\nThis issue does affect Tomcat 5 as shipped by Red Hat Enterprise Linux 5. The risks in breaking compatibility associated with fixing this flaw outweigh the benefits of the fix, therefore Red Hat does not plan to fix this flaw in Red Hat Enterprise Linux 5. Additionally, note that Red Hat Enterprise Linux 5 is currently in reduced support phase, receiving only Critical security updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/site/support/policy/updates/errata#Production_3_Phase",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4590"
},
{
"category": "external",
"summary": "RHBZ#1069911",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069911"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4590",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4590"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4590",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4590"
}
],
"release_date": "2014-02-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-21T15:30:27+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files).",
"product_ids": [
"Red Hat JBoss Web Server 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1086"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 1.2,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:H/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 2.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: information disclosure via XXE when running untrusted web applications"
},
{
"cve": "CVE-2014-0118",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-07-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1120601"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in the way httpd\u0027s mod_deflate module handled request body decompression (configured via the \"DEFLATE\" input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: mod_deflate denial of service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0118"
},
{
"category": "external",
"summary": "RHBZ#1120601",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120601"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0118",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0118"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0118",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0118"
},
{
"category": "external",
"summary": "http://httpd.apache.org/security/vulnerabilities_24.html",
"url": "http://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2014-07-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-21T15:30:27+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files).",
"product_ids": [
"Red Hat JBoss Web Server 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1086"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 2.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "httpd: mod_deflate denial of service"
},
{
"cve": "CVE-2014-0119",
"cwe": {
"id": "CWE-470",
"name": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102038"
}
],
"notes": [
{
"category": "description",
"text": "It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XML parser hijack by malicious web application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0119"
},
{
"category": "external",
"summary": "RHBZ#1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0119",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0119"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-21T15:30:27+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files).",
"product_ids": [
"Red Hat JBoss Web Server 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1086"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 2.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XML parser hijack by malicious web application"
},
{
"acknowledgments": [
{
"names": [
"OpenSSL project"
]
},
{
"names": [
"Imre Rad"
],
"organization": "Search-Lab",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2014-0221",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-06-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1103593"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in the way OpenSSL handled certain DTLS ServerHello requests. A specially crafted DTLS handshake packet could cause a DTLS client using OpenSSL to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: DoS when sending invalid DTLS handshake",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0221"
},
{
"category": "external",
"summary": "RHBZ#1103593",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103593"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0221",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0221"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0221",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0221"
},
{
"category": "external",
"summary": "https://www.openssl.org/news/secadv_20140605.txt",
"url": "https://www.openssl.org/news/secadv_20140605.txt"
}
],
"release_date": "2014-06-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-21T15:30:27+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files).",
"product_ids": [
"Red Hat JBoss Web Server 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1086"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 2.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: DoS when sending invalid DTLS handshake"
},
{
"cve": "CVE-2014-0226",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2014-07-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1120603"
}
],
"notes": [
{
"category": "description",
"text": "A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the \"apache\" user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: mod_status heap-based buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0226"
},
{
"category": "external",
"summary": "RHBZ#1120603",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120603"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0226",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0226"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0226",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0226"
},
{
"category": "external",
"summary": "http://httpd.apache.org/security/vulnerabilities_24.html",
"url": "http://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2014-07-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-21T15:30:27+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files).",
"product_ids": [
"Red Hat JBoss Web Server 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1086"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 2.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpd: mod_status heap-based buffer overflow"
},
{
"cve": "CVE-2014-0227",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109196"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0227"
},
{
"category": "external",
"summary": "RHBZ#1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0227",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43",
"url": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55",
"url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55"
}
],
"release_date": "2015-02-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-21T15:30:27+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files).",
"product_ids": [
"Red Hat JBoss Web Server 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1086"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 2.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter"
},
{
"cve": "CVE-2014-0231",
"discovery_date": "2014-07-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1120596"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in the way httpd\u0027s mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: mod_cgid denial of service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0231"
},
{
"category": "external",
"summary": "RHBZ#1120596",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120596"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0231",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0231"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0231",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0231"
},
{
"category": "external",
"summary": "http://httpd.apache.org/security/vulnerabilities_24.html",
"url": "http://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2014-07-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-21T15:30:27+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files).",
"product_ids": [
"Red Hat JBoss Web Server 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1086"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 2.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "httpd: mod_cgid denial of service"
}
]
}
RHSA-2014:1087
Vulnerability from csaf_redhat - Published: 2014-08-21 15:29 - Updated: 2026-05-14 22:17Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.0 update
Severity
Important
Notes
Topic: Red Hat JBoss Web Server 2.1.0, which fixes multiple security issues and
several bugs, is now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details: Red Hat JBoss Web Server is a fully integrated and certified set of
components for hosting Java web applications. It is comprised of the Apache
HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector
(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat
Native library.
This release serves as a replacement for Red Hat JBoss Web Server 2.0.1,
and includes several bug fixes. Refer to the Red Hat JBoss Web Server 2.1.0
Release Notes, linked to in the References section, for information on the
most significant of these changes.
The following security issues are also fixed with this release:
A race condition flaw, leading to heap-based buffer overflows, was found in
the mod_status httpd module. A remote attacker able to access a status page
served by mod_status on a server using a threaded Multi-Processing Module
(MPM) could send a specially crafted request that would cause the httpd
child process to crash or, possibly, allow the attacker to execute
arbitrary code with the privileges of the "apache" user. (CVE-2014-0226)
A denial of service flaw was found in the way httpd's mod_deflate module
handled request body decompression (configured via the "DEFLATE" input
filter). A remote attacker able to send a request whose body would be
decompressed could use this flaw to consume an excessive amount of system
memory and CPU on the target system. (CVE-2014-0118)
A denial of service flaw was found in the way httpd's mod_cgid module
executed CGI scripts that did not read data from the standard input.
A remote attacker could submit a specially crafted request that would cause
the httpd child process to hang indefinitely. (CVE-2014-0231)
It was found that several application-provided XML files, such as web.xml,
content.xml, *.tld, *.tagx, and *.jspx, resolved external entities,
permitting XML External Entity (XXE) attacks. An attacker able to deploy
malicious applications to Tomcat could use this flaw to circumvent security
restrictions set by the JSM, and gain access to sensitive information on
the system. Note that this flaw only affected deployments in which Tomcat
is running applications from untrusted sources, such as in a shared hosting
environment. (CVE-2013-4590)
It was found that, in certain circumstances, it was possible for a
malicious web application to replace the XML parsers used by Tomcat to
process XSLTs for the default servlet, JSP documents, tag library
descriptors (TLDs), and tag plug-in configuration files. The injected XML
parser(s) could then bypass the limits imposed on XML external entities
and/or gain access to the XML files processed for other web applications
deployed on the same Tomcat instance. (CVE-2014-0119)
All users of Red Hat JBoss Web Server 2.0.1 on Red Hat Enterprise Linux 6
are advised to upgrade to Red Hat JBoss Web Server 2.1.0. The JBoss server
process must be restarted for this update to take effect.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
It was found that several application-provided XML files, such as web.xml, content.xml, *.tld, *.tagx, and *.jspx, resolved external entities, permitting XML External Entity (XXE) attacks. An attacker able to deploy malicious applications to Tomcat could use this flaw to circumvent security restrictions set by the JSM, and gain access to sensitive information on the system. Note that this flaw only affected deployments in which Tomcat is running applications from untrusted sources, such as in a shared hosting environment.
1.2 ()
Affected products
Fixed
105 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Low
A denial of service flaw was found in the way httpd's mod_deflate module handled request body decompression (configured via the "DEFLATE" input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system.
5.0 ()
Affected products
Fixed
105 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.
2.1 ()
Affected products
Fixed
105 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Low
A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the "apache" user.
6.8 ()
Affected products
Fixed
105 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Important
It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.
4.3 ()
Affected products
Fixed
105 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A denial of service flaw was found in the way httpd's mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely.
5.0 ()
Affected products
Fixed
105 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
36 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Web Server 2.1.0, which fixes multiple security issues and\nseveral bugs, is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of\ncomponents for hosting Java web applications. It is comprised of the Apache\nHTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector\n(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat\nNative library.\n\nThis release serves as a replacement for Red Hat JBoss Web Server 2.0.1,\nand includes several bug fixes. Refer to the Red Hat JBoss Web Server 2.1.0\nRelease Notes, linked to in the References section, for information on the\nmost significant of these changes.\n\nThe following security issues are also fixed with this release:\n\nA race condition flaw, leading to heap-based buffer overflows, was found in\nthe mod_status httpd module. A remote attacker able to access a status page\nserved by mod_status on a server using a threaded Multi-Processing Module\n(MPM) could send a specially crafted request that would cause the httpd\nchild process to crash or, possibly, allow the attacker to execute\narbitrary code with the privileges of the \"apache\" user. (CVE-2014-0226)\n\nA denial of service flaw was found in the way httpd\u0027s mod_deflate module\nhandled request body decompression (configured via the \"DEFLATE\" input\nfilter). A remote attacker able to send a request whose body would be\ndecompressed could use this flaw to consume an excessive amount of system\nmemory and CPU on the target system. (CVE-2014-0118)\n\nA denial of service flaw was found in the way httpd\u0027s mod_cgid module\nexecuted CGI scripts that did not read data from the standard input.\nA remote attacker could submit a specially crafted request that would cause\nthe httpd child process to hang indefinitely. (CVE-2014-0231)\n\nIt was found that several application-provided XML files, such as web.xml,\ncontent.xml, *.tld, *.tagx, and *.jspx, resolved external entities,\npermitting XML External Entity (XXE) attacks. An attacker able to deploy\nmalicious applications to Tomcat could use this flaw to circumvent security\nrestrictions set by the JSM, and gain access to sensitive information on\nthe system. Note that this flaw only affected deployments in which Tomcat\nis running applications from untrusted sources, such as in a shared hosting\nenvironment. (CVE-2013-4590)\n\nIt was found that, in certain circumstances, it was possible for a\nmalicious web application to replace the XML parsers used by Tomcat to\nprocess XSLTs for the default servlet, JSP documents, tag library\ndescriptors (TLDs), and tag plug-in configuration files. The injected XML\nparser(s) could then bypass the limits imposed on XML external entities\nand/or gain access to the XML files processed for other web applications\ndeployed on the same Tomcat instance. (CVE-2014-0119)\n\nAll users of Red Hat JBoss Web Server 2.0.1 on Red Hat Enterprise Linux 6\nare advised to upgrade to Red Hat JBoss Web Server 2.1.0. The JBoss server\nprocess must be restarted for this update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:1087",
"url": "https://access.redhat.com/errata/RHSA-2014:1087"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Web_Server/2.1/html/2.1.0_Release_Notes/index.html",
"url": "https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Web_Server/2.1/html/2.1.0_Release_Notes/index.html"
},
{
"category": "external",
"summary": "1069911",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069911"
},
{
"category": "external",
"summary": "1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "1120596",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120596"
},
{
"category": "external",
"summary": "1120601",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120601"
},
{
"category": "external",
"summary": "1120603",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120603"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1087.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.0 update",
"tracking": {
"current_release_date": "2026-05-14T22:17:22+00:00",
"generator": {
"date": "2026-05-14T22:17:22+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.0"
}
},
"id": "RHSA-2014:1087",
"initial_release_date": "2014-08-21T15:29:44+00:00",
"revision_history": [
{
"date": "2014-08-21T15:29:44+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2014-08-21T15:29:44+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-14T22:17:22+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product": {
"name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
},
{
"branches": [
{
"category": "product_version",
"name": "apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"product": {
"name": "apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"product_id": "apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-pool-tomcat-eap6@1.6-7.redhat_6.1.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"product": {
"name": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"product_id": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-pool-eap6@1.6-7.redhat_6.1.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"product": {
"name": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"product_id": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-daemon-eap6@1.0.15-5.redhat_1.ep6.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"product": {
"name": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"product_id": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/antlr-eap6@2.7.7-17.redhat_4.1.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"product": {
"name": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"product_id": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/javassist-eap6@3.18.1-1.GA_redhat_1.1.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"product": {
"name": "apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"product_id": "apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-collections-tomcat-eap6@3.2.1-15.redhat_3.1.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"product": {
"name": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"product_id": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-collections-eap6@3.2.1-15.redhat_3.1.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"product": {
"name": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"product_id": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jboss-logging@3.1.4-1.GA_redhat_1.1.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"product": {
"name": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"product_id": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dom4j-eap6@1.6.1-20.redhat_6.1.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"product": {
"name": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"product_id": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ecj3@3.7.2-9.redhat_3.1.ep6.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"product": {
"name": "mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"product_id": "mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_cluster-tomcat6@1.2.9-1.Final_redhat_1.1.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"product": {
"name": "mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"product_id": "mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_cluster-tomcat7@1.2.9-1.Final_redhat_1.1.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"product": {
"name": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"product_id": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_cluster@1.2.9-1.Final_redhat_1.1.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"product": {
"name": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"product_id": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/storeconfig-tc7@0.0.1-7.Alpha3_redhat_12.5.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"product": {
"name": "apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"product_id": "apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-logging-tomcat-eap6@1.1.1-7.9_redhat_1.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"product": {
"name": "apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"product_id": "apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-logging-eap6@1.1.1-7.9_redhat_1.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"product": {
"name": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"product_id": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/storeconfig-tc6@0.0.1-7.Alpha3_redhat_12.3.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product": {
"name": "tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product_id": "tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-servlet-3.0-api@7.0.54-6_patch_02.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product": {
"name": "tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product_id": "tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-lib@7.0.54-6_patch_02.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product": {
"name": "tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product_id": "tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-log4j@7.0.54-6_patch_02.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product": {
"name": "tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product_id": "tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-admin-webapps@7.0.54-6_patch_02.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product": {
"name": "tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product_id": "tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-docs-webapp@7.0.54-6_patch_02.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product": {
"name": "tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product_id": "tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-jsp-2.2-api@7.0.54-6_patch_02.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product": {
"name": "tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product_id": "tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.54-6_patch_02.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product": {
"name": "tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product_id": "tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-webapps@7.0.54-6_patch_02.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product": {
"name": "tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product_id": "tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-javadoc@7.0.54-6_patch_02.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product": {
"name": "tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product_id": "tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-el-2.2-api@7.0.54-6_patch_02.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product": {
"name": "tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product_id": "tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-webapps@6.0.41-5_patch_02.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product": {
"name": "tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product_id": "tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-lib@6.0.41-5_patch_02.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product": {
"name": "tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product_id": "tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-log4j@6.0.41-5_patch_02.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product": {
"name": "tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product_id": "tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6@6.0.41-5_patch_02.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product": {
"name": "tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product_id": "tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-el-2.1-api@6.0.41-5_patch_02.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product": {
"name": "tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product_id": "tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-admin-webapps@6.0.41-5_patch_02.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product": {
"name": "tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product_id": "tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-servlet-2.5-api@6.0.41-5_patch_02.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product": {
"name": "tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product_id": "tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-jsp-2.1-api@6.0.41-5_patch_02.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product": {
"name": "tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product_id": "tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-javadoc@6.0.41-5_patch_02.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product": {
"name": "tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product_id": "tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-docs-webapp@6.0.41-5_patch_02.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"product": {
"name": "hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"product_id": "hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hibernate4-entitymanager-eap6@4.2.14-3.SP1_redhat_1.1.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"product": {
"name": "hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"product_id": "hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hibernate4-core-eap6@4.2.14-3.SP1_redhat_1.1.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"product": {
"name": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"product_id": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hibernate4-eap6@4.2.14-3.SP1_redhat_1.1.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"product": {
"name": "hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"product_id": "hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hibernate4-c3p0-eap6@4.2.14-3.SP1_redhat_1.1.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"product": {
"name": "hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"product_id": "hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hibernate4-infinispan-eap6@4.2.14-3.SP1_redhat_1.1.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"product": {
"name": "hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"product_id": "hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hibernate4-envers-eap6@4.2.14-3.SP1_redhat_1.1.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"product": {
"name": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"product_id": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jboss-transaction-api_1.1_spec@1.0.1-12.Final_redhat_2.2.ep6.el6?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"product": {
"name": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"product_id": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-pool-eap6@1.6-7.redhat_6.1.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"product": {
"name": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"product_id": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-daemon-eap6@1.0.15-5.redhat_1.ep6.el6?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"product": {
"name": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"product_id": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/antlr-eap6@2.7.7-17.redhat_4.1.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"product": {
"name": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"product_id": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/javassist-eap6@3.18.1-1.GA_redhat_1.1.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"product": {
"name": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"product_id": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-collections-eap6@3.2.1-15.redhat_3.1.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"product": {
"name": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"product_id": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jboss-logging@3.1.4-1.GA_redhat_1.1.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"product": {
"name": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"product_id": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dom4j-eap6@1.6.1-20.redhat_6.1.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"product": {
"name": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"product_id": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ecj3@3.7.2-9.redhat_3.1.ep6.el6?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"product": {
"name": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"product_id": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_cluster@1.2.9-1.Final_redhat_1.1.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"product": {
"name": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"product_id": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/storeconfig-tc7@0.0.1-7.Alpha3_redhat_12.5.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"product": {
"name": "apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"product_id": "apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-logging-eap6@1.1.1-7.9_redhat_1.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"product": {
"name": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"product_id": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/storeconfig-tc6@0.0.1-7.Alpha3_redhat_12.3.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "httpd-0:2.2.26-35.ep6.el6.src",
"product": {
"name": "httpd-0:2.2.26-35.ep6.el6.src",
"product_id": "httpd-0:2.2.26-35.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd@2.2.26-35.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"product": {
"name": "tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"product_id": "tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.54-6_patch_02.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"product": {
"name": "mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"product_id": "mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_rt@2.4.1-6.GA.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"product": {
"name": "tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"product_id": "tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6@6.0.41-5_patch_02.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"product": {
"name": "mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"product_id": "mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_snmp@2.4.1-13.GA.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"product": {
"name": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"product_id": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hibernate4-eap6@4.2.14-3.SP1_redhat_1.1.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"product": {
"name": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"product_id": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_cluster-native@1.2.9-3.Final_redhat_2.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"product": {
"name": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"product_id": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-native@1.1.30-2.redhat_1.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"product": {
"name": "mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"product_id": "mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_jk@1.2.40-2.redhat_1.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"product": {
"name": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"product_id": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-daemon-jsvc-eap6@1.0.15-6.redhat_2.ep6.el6?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"product": {
"name": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"product_id": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jboss-transaction-api_1.1_spec@1.0.1-12.Final_redhat_2.2.ep6.el6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"product": {
"name": "mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"product_id": "mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ssl@2.2.26-35.ep6.el6?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"product": {
"name": "httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"product_id": "httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-devel@2.2.26-35.ep6.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"product": {
"name": "httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"product_id": "httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-tools@2.2.26-35.ep6.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"product": {
"name": "httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"product_id": "httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-debuginfo@2.2.26-35.ep6.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"product": {
"name": "httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"product_id": "httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-manual@2.2.26-35.ep6.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "httpd-0:2.2.26-35.ep6.el6.x86_64",
"product": {
"name": "httpd-0:2.2.26-35.ep6.el6.x86_64",
"product_id": "httpd-0:2.2.26-35.ep6.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd@2.2.26-35.ep6.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"product": {
"name": "mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"product_id": "mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_rt-debuginfo@2.4.1-6.GA.ep6.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"product": {
"name": "mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"product_id": "mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_rt@2.4.1-6.GA.ep6.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"product": {
"name": "mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"product_id": "mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_snmp-debuginfo@2.4.1-13.GA.ep6.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"product": {
"name": "mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"product_id": "mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_snmp@2.4.1-13.GA.ep6.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"product": {
"name": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"product_id": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_cluster-native@1.2.9-3.Final_redhat_2.ep6.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"product": {
"name": "mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"product_id": "mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_cluster-native-debuginfo@1.2.9-3.Final_redhat_2.ep6.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"product": {
"name": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"product_id": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-native@1.1.30-2.redhat_1.ep6.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"product": {
"name": "tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"product_id": "tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-native-debuginfo@1.1.30-2.redhat_1.ep6.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"product": {
"name": "mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"product_id": "mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_jk-manual@1.2.40-2.redhat_1.ep6.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"product": {
"name": "mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"product_id": "mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_jk-ap22@1.2.40-2.redhat_1.ep6.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"product": {
"name": "mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"product_id": "mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_jk-debuginfo@1.2.40-2.redhat_1.ep6.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"product": {
"name": "apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"product_id": "apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-daemon-jsvc-eap6-debuginfo@1.0.15-6.redhat_2.ep6.el6?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"product": {
"name": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"product_id": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-daemon-jsvc-eap6@1.0.15-6.redhat_2.ep6.el6?arch=x86_64\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "mod_ssl-1:2.2.26-35.ep6.el6.i386",
"product": {
"name": "mod_ssl-1:2.2.26-35.ep6.el6.i386",
"product_id": "mod_ssl-1:2.2.26-35.ep6.el6.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ssl@2.2.26-35.ep6.el6?arch=i386\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "httpd-devel-0:2.2.26-35.ep6.el6.i386",
"product": {
"name": "httpd-devel-0:2.2.26-35.ep6.el6.i386",
"product_id": "httpd-devel-0:2.2.26-35.ep6.el6.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-devel@2.2.26-35.ep6.el6?arch=i386"
}
}
},
{
"category": "product_version",
"name": "httpd-tools-0:2.2.26-35.ep6.el6.i386",
"product": {
"name": "httpd-tools-0:2.2.26-35.ep6.el6.i386",
"product_id": "httpd-tools-0:2.2.26-35.ep6.el6.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-tools@2.2.26-35.ep6.el6?arch=i386"
}
}
},
{
"category": "product_version",
"name": "httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"product": {
"name": "httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"product_id": "httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-debuginfo@2.2.26-35.ep6.el6?arch=i386"
}
}
},
{
"category": "product_version",
"name": "httpd-manual-0:2.2.26-35.ep6.el6.i386",
"product": {
"name": "httpd-manual-0:2.2.26-35.ep6.el6.i386",
"product_id": "httpd-manual-0:2.2.26-35.ep6.el6.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-manual@2.2.26-35.ep6.el6?arch=i386"
}
}
},
{
"category": "product_version",
"name": "httpd-0:2.2.26-35.ep6.el6.i386",
"product": {
"name": "httpd-0:2.2.26-35.ep6.el6.i386",
"product_id": "httpd-0:2.2.26-35.ep6.el6.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd@2.2.26-35.ep6.el6?arch=i386"
}
}
},
{
"category": "product_version",
"name": "mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"product": {
"name": "mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"product_id": "mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_rt-debuginfo@2.4.1-6.GA.ep6.el6?arch=i386"
}
}
},
{
"category": "product_version",
"name": "mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"product": {
"name": "mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"product_id": "mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_rt@2.4.1-6.GA.ep6.el6?arch=i386"
}
}
},
{
"category": "product_version",
"name": "mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"product": {
"name": "mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"product_id": "mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_snmp-debuginfo@2.4.1-13.GA.ep6.el6?arch=i386"
}
}
},
{
"category": "product_version",
"name": "mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"product": {
"name": "mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"product_id": "mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_snmp@2.4.1-13.GA.ep6.el6?arch=i386"
}
}
},
{
"category": "product_version",
"name": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"product": {
"name": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"product_id": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_cluster-native@1.2.9-3.Final_redhat_2.ep6.el6?arch=i386"
}
}
},
{
"category": "product_version",
"name": "mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"product": {
"name": "mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"product_id": "mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_cluster-native-debuginfo@1.2.9-3.Final_redhat_2.ep6.el6?arch=i386"
}
}
},
{
"category": "product_version",
"name": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"product": {
"name": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"product_id": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-native@1.1.30-2.redhat_1.ep6.el6?arch=i386"
}
}
},
{
"category": "product_version",
"name": "tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"product": {
"name": "tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"product_id": "tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-native-debuginfo@1.1.30-2.redhat_1.ep6.el6?arch=i386"
}
}
},
{
"category": "product_version",
"name": "mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"product": {
"name": "mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"product_id": "mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_jk-manual@1.2.40-2.redhat_1.ep6.el6?arch=i386"
}
}
},
{
"category": "product_version",
"name": "mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"product": {
"name": "mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"product_id": "mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_jk-ap22@1.2.40-2.redhat_1.ep6.el6?arch=i386"
}
}
},
{
"category": "product_version",
"name": "mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"product": {
"name": "mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"product_id": "mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_jk-debuginfo@1.2.40-2.redhat_1.ep6.el6?arch=i386"
}
}
},
{
"category": "product_version",
"name": "apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"product": {
"name": "apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"product_id": "apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-daemon-jsvc-eap6-debuginfo@1.0.15-6.redhat_2.ep6.el6?arch=i386\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"product": {
"name": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"product_id": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-daemon-jsvc-eap6@1.0.15-6.redhat_2.ep6.el6?arch=i386\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "i386"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch"
},
"product_reference": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src"
},
"product_reference": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch"
},
"product_reference": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src"
},
"product_reference": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch"
},
"product_reference": "apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch"
},
"product_reference": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src"
},
"product_reference": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386"
},
"product_reference": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src"
},
"product_reference": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64"
},
"product_reference": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386"
},
"product_reference": "apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64"
},
"product_reference": "apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch"
},
"product_reference": "apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src"
},
"product_reference": "apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch"
},
"product_reference": "apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch"
},
"product_reference": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src"
},
"product_reference": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch"
},
"product_reference": "apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch"
},
"product_reference": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src"
},
"product_reference": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch"
},
"product_reference": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src"
},
"product_reference": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch"
},
"product_reference": "hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch"
},
"product_reference": "hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch"
},
"product_reference": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src"
},
"product_reference": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch"
},
"product_reference": "hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch"
},
"product_reference": "hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch"
},
"product_reference": "hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-0:2.2.26-35.ep6.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386"
},
"product_reference": "httpd-0:2.2.26-35.ep6.el6.i386",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-0:2.2.26-35.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src"
},
"product_reference": "httpd-0:2.2.26-35.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-0:2.2.26-35.ep6.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64"
},
"product_reference": "httpd-0:2.2.26-35.ep6.el6.x86_64",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-debuginfo-0:2.2.26-35.ep6.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386"
},
"product_reference": "httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64"
},
"product_reference": "httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-devel-0:2.2.26-35.ep6.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386"
},
"product_reference": "httpd-devel-0:2.2.26-35.ep6.el6.i386",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-devel-0:2.2.26-35.ep6.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64"
},
"product_reference": "httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-manual-0:2.2.26-35.ep6.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386"
},
"product_reference": "httpd-manual-0:2.2.26-35.ep6.el6.i386",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-manual-0:2.2.26-35.ep6.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64"
},
"product_reference": "httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-tools-0:2.2.26-35.ep6.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386"
},
"product_reference": "httpd-tools-0:2.2.26-35.ep6.el6.i386",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-tools-0:2.2.26-35.ep6.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64"
},
"product_reference": "httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch"
},
"product_reference": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src"
},
"product_reference": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch"
},
"product_reference": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src"
},
"product_reference": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch"
},
"product_reference": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src"
},
"product_reference": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch"
},
"product_reference": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src"
},
"product_reference": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386"
},
"product_reference": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src"
},
"product_reference": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64"
},
"product_reference": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386"
},
"product_reference": "mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64"
},
"product_reference": "mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch"
},
"product_reference": "mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch"
},
"product_reference": "mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src"
},
"product_reference": "mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386"
},
"product_reference": "mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64"
},
"product_reference": "mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386"
},
"product_reference": "mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64"
},
"product_reference": "mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386"
},
"product_reference": "mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64"
},
"product_reference": "mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_rt-0:2.4.1-6.GA.ep6.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386"
},
"product_reference": "mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_rt-0:2.4.1-6.GA.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src"
},
"product_reference": "mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64"
},
"product_reference": "mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386"
},
"product_reference": "mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64"
},
"product_reference": "mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_snmp-0:2.4.1-13.GA.ep6.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386"
},
"product_reference": "mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_snmp-0:2.4.1-13.GA.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src"
},
"product_reference": "mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64"
},
"product_reference": "mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386"
},
"product_reference": "mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64"
},
"product_reference": "mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ssl-1:2.2.26-35.ep6.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386"
},
"product_reference": "mod_ssl-1:2.2.26-35.ep6.el6.i386",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ssl-1:2.2.26-35.ep6.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64"
},
"product_reference": "mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch"
},
"product_reference": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src"
},
"product_reference": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch"
},
"product_reference": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src"
},
"product_reference": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386"
},
"product_reference": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src"
},
"product_reference": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64"
},
"product_reference": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386"
},
"product_reference": "tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64"
},
"product_reference": "tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch"
},
"product_reference": "tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.41-5_patch_02.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src"
},
"product_reference": "tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch"
},
"product_reference": "tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch"
},
"product_reference": "tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch"
},
"product_reference": "tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch"
},
"product_reference": "tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch"
},
"product_reference": "tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch"
},
"product_reference": "tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch"
},
"product_reference": "tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch"
},
"product_reference": "tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch"
},
"product_reference": "tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch"
},
"product_reference": "tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.54-6_patch_02.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src"
},
"product_reference": "tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch"
},
"product_reference": "tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch"
},
"product_reference": "tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch"
},
"product_reference": "tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch"
},
"product_reference": "tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch"
},
"product_reference": "tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch"
},
"product_reference": "tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch"
},
"product_reference": "tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch"
},
"product_reference": "tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch"
},
"product_reference": "tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2013-4590",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-02-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1069911"
}
],
"notes": [
{
"category": "description",
"text": "It was found that several application-provided XML files, such as web.xml, content.xml, *.tld, *.tagx, and *.jspx, resolved external entities, permitting XML External Entity (XXE) attacks. An attacker able to deploy malicious applications to Tomcat could use this flaw to circumvent security restrictions set by the JSM, and gain access to sensitive information on the system. Note that this flaw only affected deployments in which Tomcat is running applications from untrusted sources, such as in a shared hosting environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: information disclosure via XXE when running untrusted web applications",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect JBoss Web, as shipped with various Red Hat JBoss products.\n\nThis issue does affect Tomcat 5 as shipped by Red Hat Enterprise Linux 5. The risks in breaking compatibility associated with fixing this flaw outweigh the benefits of the fix, therefore Red Hat does not plan to fix this flaw in Red Hat Enterprise Linux 5. Additionally, note that Red Hat Enterprise Linux 5 is currently in reduced support phase, receiving only Critical security updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/site/support/policy/updates/errata#Production_3_Phase",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4590"
},
{
"category": "external",
"summary": "RHBZ#1069911",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069911"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4590",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4590"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4590",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4590"
}
],
"release_date": "2014-02-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-21T15:29:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1087"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 1.2,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:H/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: information disclosure via XXE when running untrusted web applications"
},
{
"cve": "CVE-2014-0118",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-07-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1120601"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in the way httpd\u0027s mod_deflate module handled request body decompression (configured via the \"DEFLATE\" input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: mod_deflate denial of service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0118"
},
{
"category": "external",
"summary": "RHBZ#1120601",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120601"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0118",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0118"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0118",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0118"
},
{
"category": "external",
"summary": "http://httpd.apache.org/security/vulnerabilities_24.html",
"url": "http://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2014-07-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-21T15:29:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1087"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "httpd: mod_deflate denial of service"
},
{
"cve": "CVE-2014-0119",
"cwe": {
"id": "CWE-470",
"name": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102038"
}
],
"notes": [
{
"category": "description",
"text": "It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XML parser hijack by malicious web application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0119"
},
{
"category": "external",
"summary": "RHBZ#1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0119",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0119"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-21T15:29:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1087"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XML parser hijack by malicious web application"
},
{
"cve": "CVE-2014-0226",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2014-07-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1120603"
}
],
"notes": [
{
"category": "description",
"text": "A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the \"apache\" user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: mod_status heap-based buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0226"
},
{
"category": "external",
"summary": "RHBZ#1120603",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120603"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0226",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0226"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0226",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0226"
},
{
"category": "external",
"summary": "http://httpd.apache.org/security/vulnerabilities_24.html",
"url": "http://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2014-07-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-21T15:29:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1087"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpd: mod_status heap-based buffer overflow"
},
{
"cve": "CVE-2014-0227",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109196"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0227"
},
{
"category": "external",
"summary": "RHBZ#1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0227",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43",
"url": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55",
"url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55"
}
],
"release_date": "2015-02-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-21T15:29:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1087"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter"
},
{
"cve": "CVE-2014-0231",
"discovery_date": "2014-07-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1120596"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in the way httpd\u0027s mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: mod_cgid denial of service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0231"
},
{
"category": "external",
"summary": "RHBZ#1120596",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120596"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0231",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0231"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0231",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0231"
},
{
"category": "external",
"summary": "http://httpd.apache.org/security/vulnerabilities_24.html",
"url": "http://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2014-07-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-21T15:29:44+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1087"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.noarch",
"6Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-debuginfo-1:1.0.15-6.redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-logging-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-logging-tomcat-eap6-0:1.1.1-7.9_redhat_1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.noarch",
"6Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el6.src",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.noarch",
"6Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.src",
"6Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-debuginfo-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.noarch",
"6Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.src",
"6Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.i386",
"6Server-JBEWS-2:mod_cluster-native-debuginfo-0:1.2.9-3.Final_redhat_2.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el6.noarch",
"6Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-debuginfo-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_rt-debuginfo-0:2.4.1-6.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.src",
"6Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.i386",
"6Server-JBEWS-2:mod_snmp-debuginfo-0:2.4.1-13.GA.ep6.el6.x86_64",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.i386",
"6Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el6.x86_64",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6.src",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.noarch",
"6Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.src",
"6Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.i386",
"6Server-JBEWS-2:tomcat-native-debuginfo-0:1.1.30-2.redhat_1.ep6.el6.x86_64",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.41-5_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.41-5_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "httpd: mod_cgid denial of service"
}
]
}
RHSA-2014:1088
Vulnerability from csaf_redhat - Published: 2014-08-21 15:29 - Updated: 2026-05-14 22:17Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.0 update
Severity
Important
Notes
Topic: Red Hat JBoss Web Server 2.1.0, which fixes multiple security issues and
several bugs, is now available for Red Hat Enterprise Linux 5.
Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details: Red Hat JBoss Web Server is a fully integrated and certified set of
components for hosting Java web applications. It is comprised of the Apache
HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector
(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat
Native library.
This release serves as a replacement for Red Hat JBoss Web Server 2.0.1,
and includes several bug fixes. Refer to the Red Hat JBoss Web Server 2.1.0
Release Notes, linked to in the References section, for information on the
most significant of these changes.
The following security issues are also fixed with this release:
A race condition flaw, leading to heap-based buffer overflows, was found in
the mod_status httpd module. A remote attacker able to access a status page
served by mod_status on a server using a threaded Multi-Processing Module
(MPM) could send a specially crafted request that would cause the httpd
child process to crash or, possibly, allow the attacker to execute
arbitrary code with the privileges of the "apache" user. (CVE-2014-0226)
A denial of service flaw was found in the way httpd's mod_deflate module
handled request body decompression (configured via the "DEFLATE" input
filter). A remote attacker able to send a request whose body would be
decompressed could use this flaw to consume an excessive amount of system
memory and CPU on the target system. (CVE-2014-0118)
A denial of service flaw was found in the way httpd's mod_cgid module
executed CGI scripts that did not read data from the standard input.
A remote attacker could submit a specially crafted request that would cause
the httpd child process to hang indefinitely. (CVE-2014-0231)
It was found that several application-provided XML files, such as web.xml,
content.xml, *.tld, *.tagx, and *.jspx, resolved external entities,
permitting XML External Entity (XXE) attacks. An attacker able to deploy
malicious applications to Tomcat could use this flaw to circumvent security
restrictions set by the JSM, and gain access to sensitive information on
the system. Note that this flaw only affected deployments in which Tomcat
is running applications from untrusted sources, such as in a shared hosting
environment. (CVE-2013-4590)
It was found that, in certain circumstances, it was possible for a
malicious web application to replace the XML parsers used by Tomcat to
process XSLTs for the default servlet, JSP documents, tag library
descriptors (TLDs), and tag plug-in configuration files. The injected XML
parser(s) could then bypass the limits imposed on XML external entities
and/or gain access to the XML files processed for other web applications
deployed on the same Tomcat instance. (CVE-2014-0119)
All users of Red Hat JBoss Web Server 2.0.1 on Red Hat Enterprise Linux 5
are advised to upgrade to Red Hat JBoss Web Server 2.1.0. The JBoss server
process must be restarted for this update to take effect.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
It was found that several application-provided XML files, such as web.xml, content.xml, *.tld, *.tagx, and *.jspx, resolved external entities, permitting XML External Entity (XXE) attacks. An attacker able to deploy malicious applications to Tomcat could use this flaw to circumvent security restrictions set by the JSM, and gain access to sensitive information on the system. Note that this flaw only affected deployments in which Tomcat is running applications from untrusted sources, such as in a shared hosting environment.
1.2 ()
Affected products
Fixed
88 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Low
A denial of service flaw was found in the way httpd's mod_deflate module handled request body decompression (configured via the "DEFLATE" input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system.
5.0 ()
Affected products
Fixed
88 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.
2.1 ()
Affected products
Fixed
88 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Low
A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the "apache" user.
6.8 ()
Affected products
Fixed
88 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Important
It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.
4.3 ()
Affected products
Fixed
88 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A denial of service flaw was found in the way httpd's mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely.
5.0 ()
Affected products
Fixed
88 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
36 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Web Server 2.1.0, which fixes multiple security issues and\nseveral bugs, is now available for Red Hat Enterprise Linux 5.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of\ncomponents for hosting Java web applications. It is comprised of the Apache\nHTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector\n(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat\nNative library.\n\nThis release serves as a replacement for Red Hat JBoss Web Server 2.0.1,\nand includes several bug fixes. Refer to the Red Hat JBoss Web Server 2.1.0\nRelease Notes, linked to in the References section, for information on the\nmost significant of these changes.\n\nThe following security issues are also fixed with this release:\n\nA race condition flaw, leading to heap-based buffer overflows, was found in\nthe mod_status httpd module. A remote attacker able to access a status page\nserved by mod_status on a server using a threaded Multi-Processing Module\n(MPM) could send a specially crafted request that would cause the httpd\nchild process to crash or, possibly, allow the attacker to execute\narbitrary code with the privileges of the \"apache\" user. (CVE-2014-0226)\n\nA denial of service flaw was found in the way httpd\u0027s mod_deflate module\nhandled request body decompression (configured via the \"DEFLATE\" input\nfilter). A remote attacker able to send a request whose body would be\ndecompressed could use this flaw to consume an excessive amount of system\nmemory and CPU on the target system. (CVE-2014-0118)\n\nA denial of service flaw was found in the way httpd\u0027s mod_cgid module\nexecuted CGI scripts that did not read data from the standard input.\nA remote attacker could submit a specially crafted request that would cause\nthe httpd child process to hang indefinitely. (CVE-2014-0231)\n\nIt was found that several application-provided XML files, such as web.xml,\ncontent.xml, *.tld, *.tagx, and *.jspx, resolved external entities,\npermitting XML External Entity (XXE) attacks. An attacker able to deploy\nmalicious applications to Tomcat could use this flaw to circumvent security\nrestrictions set by the JSM, and gain access to sensitive information on\nthe system. Note that this flaw only affected deployments in which Tomcat\nis running applications from untrusted sources, such as in a shared hosting\nenvironment. (CVE-2013-4590)\n\nIt was found that, in certain circumstances, it was possible for a\nmalicious web application to replace the XML parsers used by Tomcat to\nprocess XSLTs for the default servlet, JSP documents, tag library\ndescriptors (TLDs), and tag plug-in configuration files. The injected XML\nparser(s) could then bypass the limits imposed on XML external entities\nand/or gain access to the XML files processed for other web applications\ndeployed on the same Tomcat instance. (CVE-2014-0119)\n\nAll users of Red Hat JBoss Web Server 2.0.1 on Red Hat Enterprise Linux 5\nare advised to upgrade to Red Hat JBoss Web Server 2.1.0. The JBoss server\nprocess must be restarted for this update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:1088",
"url": "https://access.redhat.com/errata/RHSA-2014:1088"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Web_Server/2.1/html/2.1.0_Release_Notes/index.html",
"url": "https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Web_Server/2.1/html/2.1.0_Release_Notes/index.html"
},
{
"category": "external",
"summary": "1069911",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069911"
},
{
"category": "external",
"summary": "1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "1120596",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120596"
},
{
"category": "external",
"summary": "1120601",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120601"
},
{
"category": "external",
"summary": "1120603",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120603"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1088.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.0 update",
"tracking": {
"current_release_date": "2026-05-14T22:17:23+00:00",
"generator": {
"date": "2026-05-14T22:17:23+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.0"
}
},
"id": "RHSA-2014:1088",
"initial_release_date": "2014-08-21T15:29:13+00:00",
"revision_history": [
{
"date": "2014-08-21T15:29:13+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2014-08-21T15:29:14+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-14T22:17:23+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product": {
"name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
},
{
"branches": [
{
"category": "product_version",
"name": "apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"product": {
"name": "apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"product_id": "apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-pool-tomcat-eap6@1.6-7.redhat_6.1.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"product": {
"name": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"product_id": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-pool-eap6@1.6-7.redhat_6.1.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"product": {
"name": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"product_id": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-daemon-eap6@1.0.15-5.redhat_1.ep6.el5?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"product": {
"name": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"product_id": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/antlr-eap6@2.7.7-17.redhat_4.1.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"product": {
"name": "apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"product_id": "apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-collections-tomcat-eap6@3.2.1-15.redhat_3.1.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"product": {
"name": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"product_id": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-collections-eap6@3.2.1-15.redhat_3.1.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"product": {
"name": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"product_id": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/javassist-eap6@3.18.1-1.GA_redhat_1.1.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"product": {
"name": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"product_id": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jboss-logging@3.1.4-1.GA_redhat_1.1.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"product": {
"name": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"product_id": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dom4j-eap6@1.6.1-20.redhat_6.1.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"product": {
"name": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"product_id": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ecj3@3.7.2-9.redhat_3.1.ep6.el5?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"product": {
"name": "mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"product_id": "mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_cluster-tomcat6@1.2.9-1.Final_redhat_1.1.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"product": {
"name": "mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"product_id": "mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_cluster-tomcat7@1.2.9-1.Final_redhat_1.1.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"product": {
"name": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"product_id": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_cluster@1.2.9-1.Final_redhat_1.1.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"product": {
"name": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"product_id": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/storeconfig-tc7@0.0.1-7.Alpha3_redhat_12.5.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product": {
"name": "tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product_id": "tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-servlet-3.0-api@7.0.54-6_patch_02.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product": {
"name": "tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product_id": "tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-lib@7.0.54-6_patch_02.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product": {
"name": "tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product_id": "tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-log4j@7.0.54-6_patch_02.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product": {
"name": "tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product_id": "tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-admin-webapps@7.0.54-6_patch_02.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product": {
"name": "tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product_id": "tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-docs-webapp@7.0.54-6_patch_02.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product": {
"name": "tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product_id": "tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-jsp-2.2-api@7.0.54-6_patch_02.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product": {
"name": "tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product_id": "tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.54-6_patch_02.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product": {
"name": "tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product_id": "tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-webapps@7.0.54-6_patch_02.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product": {
"name": "tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product_id": "tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-javadoc@7.0.54-6_patch_02.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product": {
"name": "tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product_id": "tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-el-2.2-api@7.0.54-6_patch_02.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product": {
"name": "tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product_id": "tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-servlet-2.5-api@6.0.41-6_patch_02.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product": {
"name": "tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product_id": "tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-lib@6.0.41-6_patch_02.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product": {
"name": "tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product_id": "tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-el-2.1-api@6.0.41-6_patch_02.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product": {
"name": "tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product_id": "tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6@6.0.41-6_patch_02.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product": {
"name": "tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product_id": "tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-jsp-2.1-api@6.0.41-6_patch_02.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product": {
"name": "tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product_id": "tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-javadoc@6.0.41-6_patch_02.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product": {
"name": "tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product_id": "tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-webapps@6.0.41-6_patch_02.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product": {
"name": "tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product_id": "tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-log4j@6.0.41-6_patch_02.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product": {
"name": "tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product_id": "tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-admin-webapps@6.0.41-6_patch_02.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product": {
"name": "tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product_id": "tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-docs-webapp@6.0.41-6_patch_02.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"product": {
"name": "hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"product_id": "hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hibernate4-entitymanager-eap6@4.2.14-3.SP1_redhat_1.1.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"product": {
"name": "hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"product_id": "hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hibernate4-core-eap6@4.2.14-3.SP1_redhat_1.1.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"product": {
"name": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"product_id": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hibernate4-eap6@4.2.14-3.SP1_redhat_1.1.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"product": {
"name": "hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"product_id": "hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hibernate4-c3p0-eap6@4.2.14-3.SP1_redhat_1.1.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"product": {
"name": "hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"product_id": "hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hibernate4-infinispan-eap6@4.2.14-3.SP1_redhat_1.1.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"product": {
"name": "hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"product_id": "hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hibernate4-envers-eap6@4.2.14-3.SP1_redhat_1.1.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"product": {
"name": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"product_id": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/storeconfig-tc6@0.0.1-7.Alpha3_redhat_12.3.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"product": {
"name": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"product_id": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jboss-transaction-api_1.1_spec@1.0.1-12.Final_redhat_2.2.ep6.el5?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"product": {
"name": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"product_id": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-pool-eap6@1.6-7.redhat_6.1.ep6.el5?arch=src"
}
}
},
{
"category": "product_version",
"name": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"product": {
"name": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"product_id": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-daemon-eap6@1.0.15-5.redhat_1.ep6.el5?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"product": {
"name": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"product_id": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/antlr-eap6@2.7.7-17.redhat_4.1.ep6.el5?arch=src"
}
}
},
{
"category": "product_version",
"name": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"product": {
"name": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"product_id": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-collections-eap6@3.2.1-15.redhat_3.1.ep6.el5?arch=src"
}
}
},
{
"category": "product_version",
"name": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"product": {
"name": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"product_id": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/javassist-eap6@3.18.1-1.GA_redhat_1.1.ep6.el5?arch=src"
}
}
},
{
"category": "product_version",
"name": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"product": {
"name": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"product_id": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jboss-logging@3.1.4-1.GA_redhat_1.1.ep6.el5?arch=src"
}
}
},
{
"category": "product_version",
"name": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"product": {
"name": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"product_id": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dom4j-eap6@1.6.1-20.redhat_6.1.ep6.el5?arch=src"
}
}
},
{
"category": "product_version",
"name": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"product": {
"name": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"product_id": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ecj3@3.7.2-9.redhat_3.1.ep6.el5?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"product": {
"name": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"product_id": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_cluster@1.2.9-1.Final_redhat_1.1.ep6.el5?arch=src"
}
}
},
{
"category": "product_version",
"name": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"product": {
"name": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"product_id": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/storeconfig-tc7@0.0.1-7.Alpha3_redhat_12.5.ep6.el5?arch=src"
}
}
},
{
"category": "product_version",
"name": "httpd-0:2.2.26-35.ep6.el5.src",
"product": {
"name": "httpd-0:2.2.26-35.ep6.el5.src",
"product_id": "httpd-0:2.2.26-35.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd@2.2.26-35.ep6.el5?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"product": {
"name": "tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"product_id": "tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.54-6_patch_02.ep6.el5?arch=src"
}
}
},
{
"category": "product_version",
"name": "mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"product": {
"name": "mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"product_id": "mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_rt@2.4.1-6.GA.ep6.el5?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"product": {
"name": "tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"product_id": "tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6@6.0.41-6_patch_02.ep6.el5?arch=src"
}
}
},
{
"category": "product_version",
"name": "mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"product": {
"name": "mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"product_id": "mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_snmp@2.4.1-13.GA.ep6.el5?arch=src"
}
}
},
{
"category": "product_version",
"name": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"product": {
"name": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"product_id": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hibernate4-eap6@4.2.14-3.SP1_redhat_1.1.ep6.el5?arch=src"
}
}
},
{
"category": "product_version",
"name": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"product": {
"name": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"product_id": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/storeconfig-tc6@0.0.1-7.Alpha3_redhat_12.3.ep6.el5?arch=src"
}
}
},
{
"category": "product_version",
"name": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"product": {
"name": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"product_id": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_cluster-native@1.2.9-3.Final_redhat_2.ep6.el5?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"product": {
"name": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"product_id": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-native@1.1.30-2.redhat_1.ep6.el5?arch=src"
}
}
},
{
"category": "product_version",
"name": "mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"product": {
"name": "mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"product_id": "mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_jk@1.2.40-2.redhat_1.ep6.el5?arch=src"
}
}
},
{
"category": "product_version",
"name": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"product": {
"name": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"product_id": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-daemon-jsvc-eap6@1.0.15-6.redhat_2.ep6.el5?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"product": {
"name": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"product_id": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jboss-transaction-api_1.1_spec@1.0.1-12.Final_redhat_2.2.ep6.el5?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"product": {
"name": "mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"product_id": "mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ssl@2.2.26-35.ep6.el5?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"product": {
"name": "httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"product_id": "httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-devel@2.2.26-35.ep6.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"product": {
"name": "httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"product_id": "httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-tools@2.2.26-35.ep6.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"product": {
"name": "httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"product_id": "httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-manual@2.2.26-35.ep6.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "httpd-0:2.2.26-35.ep6.el5.x86_64",
"product": {
"name": "httpd-0:2.2.26-35.ep6.el5.x86_64",
"product_id": "httpd-0:2.2.26-35.ep6.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd@2.2.26-35.ep6.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"product": {
"name": "mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"product_id": "mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_rt@2.4.1-6.GA.ep6.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"product": {
"name": "mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"product_id": "mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_snmp@2.4.1-13.GA.ep6.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"product": {
"name": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"product_id": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_cluster-native@1.2.9-3.Final_redhat_2.ep6.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"product": {
"name": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"product_id": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-native@1.1.30-2.redhat_1.ep6.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"product": {
"name": "mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"product_id": "mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_jk-manual@1.2.40-2.redhat_1.ep6.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"product": {
"name": "mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"product_id": "mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_jk-ap22@1.2.40-2.redhat_1.ep6.el5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"product": {
"name": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"product_id": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-daemon-jsvc-eap6@1.0.15-6.redhat_2.ep6.el5?arch=x86_64\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "mod_ssl-1:2.2.26-35.ep6.el5.i386",
"product": {
"name": "mod_ssl-1:2.2.26-35.ep6.el5.i386",
"product_id": "mod_ssl-1:2.2.26-35.ep6.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ssl@2.2.26-35.ep6.el5?arch=i386\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "httpd-devel-0:2.2.26-35.ep6.el5.i386",
"product": {
"name": "httpd-devel-0:2.2.26-35.ep6.el5.i386",
"product_id": "httpd-devel-0:2.2.26-35.ep6.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-devel@2.2.26-35.ep6.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "httpd-tools-0:2.2.26-35.ep6.el5.i386",
"product": {
"name": "httpd-tools-0:2.2.26-35.ep6.el5.i386",
"product_id": "httpd-tools-0:2.2.26-35.ep6.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-tools@2.2.26-35.ep6.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "httpd-manual-0:2.2.26-35.ep6.el5.i386",
"product": {
"name": "httpd-manual-0:2.2.26-35.ep6.el5.i386",
"product_id": "httpd-manual-0:2.2.26-35.ep6.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd-manual@2.2.26-35.ep6.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "httpd-0:2.2.26-35.ep6.el5.i386",
"product": {
"name": "httpd-0:2.2.26-35.ep6.el5.i386",
"product_id": "httpd-0:2.2.26-35.ep6.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd@2.2.26-35.ep6.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"product": {
"name": "mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"product_id": "mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_rt@2.4.1-6.GA.ep6.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"product": {
"name": "mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"product_id": "mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_snmp@2.4.1-13.GA.ep6.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"product": {
"name": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"product_id": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_cluster-native@1.2.9-3.Final_redhat_2.ep6.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"product": {
"name": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"product_id": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-native@1.1.30-2.redhat_1.ep6.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"product": {
"name": "mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"product_id": "mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_jk-manual@1.2.40-2.redhat_1.ep6.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"product": {
"name": "mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"product_id": "mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_jk-ap22@1.2.40-2.redhat_1.ep6.el5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"product": {
"name": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"product_id": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-commons-daemon-jsvc-eap6@1.0.15-6.redhat_2.ep6.el5?arch=i386\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "i386"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch"
},
"product_reference": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src"
},
"product_reference": "antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch"
},
"product_reference": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src"
},
"product_reference": "apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch"
},
"product_reference": "apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch"
},
"product_reference": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src"
},
"product_reference": "apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386"
},
"product_reference": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src"
},
"product_reference": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64"
},
"product_reference": "apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch"
},
"product_reference": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src"
},
"product_reference": "apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch"
},
"product_reference": "apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch"
},
"product_reference": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src"
},
"product_reference": "dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch"
},
"product_reference": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src"
},
"product_reference": "ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch"
},
"product_reference": "hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch"
},
"product_reference": "hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch"
},
"product_reference": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src"
},
"product_reference": "hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch"
},
"product_reference": "hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch"
},
"product_reference": "hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch"
},
"product_reference": "hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-0:2.2.26-35.ep6.el5.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386"
},
"product_reference": "httpd-0:2.2.26-35.ep6.el5.i386",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-0:2.2.26-35.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src"
},
"product_reference": "httpd-0:2.2.26-35.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-0:2.2.26-35.ep6.el5.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64"
},
"product_reference": "httpd-0:2.2.26-35.ep6.el5.x86_64",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-devel-0:2.2.26-35.ep6.el5.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386"
},
"product_reference": "httpd-devel-0:2.2.26-35.ep6.el5.i386",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-devel-0:2.2.26-35.ep6.el5.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64"
},
"product_reference": "httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-manual-0:2.2.26-35.ep6.el5.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386"
},
"product_reference": "httpd-manual-0:2.2.26-35.ep6.el5.i386",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-manual-0:2.2.26-35.ep6.el5.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64"
},
"product_reference": "httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-tools-0:2.2.26-35.ep6.el5.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386"
},
"product_reference": "httpd-tools-0:2.2.26-35.ep6.el5.i386",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-tools-0:2.2.26-35.ep6.el5.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64"
},
"product_reference": "httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch"
},
"product_reference": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src"
},
"product_reference": "javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch"
},
"product_reference": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src"
},
"product_reference": "jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch"
},
"product_reference": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src"
},
"product_reference": "jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch"
},
"product_reference": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src"
},
"product_reference": "mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386"
},
"product_reference": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src"
},
"product_reference": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64"
},
"product_reference": "mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch"
},
"product_reference": "mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch"
},
"product_reference": "mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src"
},
"product_reference": "mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386"
},
"product_reference": "mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64"
},
"product_reference": "mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386"
},
"product_reference": "mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64"
},
"product_reference": "mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_rt-0:2.4.1-6.GA.ep6.el5.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386"
},
"product_reference": "mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_rt-0:2.4.1-6.GA.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src"
},
"product_reference": "mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64"
},
"product_reference": "mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_snmp-0:2.4.1-13.GA.ep6.el5.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386"
},
"product_reference": "mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_snmp-0:2.4.1-13.GA.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src"
},
"product_reference": "mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64"
},
"product_reference": "mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ssl-1:2.2.26-35.ep6.el5.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386"
},
"product_reference": "mod_ssl-1:2.2.26-35.ep6.el5.i386",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ssl-1:2.2.26-35.ep6.el5.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64"
},
"product_reference": "mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch"
},
"product_reference": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src"
},
"product_reference": "storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch"
},
"product_reference": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src"
},
"product_reference": "storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386"
},
"product_reference": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src"
},
"product_reference": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64 as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64"
},
"product_reference": "tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch"
},
"product_reference": "tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.41-6_patch_02.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src"
},
"product_reference": "tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch"
},
"product_reference": "tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch"
},
"product_reference": "tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch"
},
"product_reference": "tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch"
},
"product_reference": "tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch"
},
"product_reference": "tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch"
},
"product_reference": "tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch"
},
"product_reference": "tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch"
},
"product_reference": "tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch"
},
"product_reference": "tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch"
},
"product_reference": "tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.54-6_patch_02.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src"
},
"product_reference": "tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch"
},
"product_reference": "tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch"
},
"product_reference": "tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch"
},
"product_reference": "tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch"
},
"product_reference": "tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch"
},
"product_reference": "tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch"
},
"product_reference": "tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch"
},
"product_reference": "tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch"
},
"product_reference": "tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch"
},
"product_reference": "tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2013-4590",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-02-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1069911"
}
],
"notes": [
{
"category": "description",
"text": "It was found that several application-provided XML files, such as web.xml, content.xml, *.tld, *.tagx, and *.jspx, resolved external entities, permitting XML External Entity (XXE) attacks. An attacker able to deploy malicious applications to Tomcat could use this flaw to circumvent security restrictions set by the JSM, and gain access to sensitive information on the system. Note that this flaw only affected deployments in which Tomcat is running applications from untrusted sources, such as in a shared hosting environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: information disclosure via XXE when running untrusted web applications",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect JBoss Web, as shipped with various Red Hat JBoss products.\n\nThis issue does affect Tomcat 5 as shipped by Red Hat Enterprise Linux 5. The risks in breaking compatibility associated with fixing this flaw outweigh the benefits of the fix, therefore Red Hat does not plan to fix this flaw in Red Hat Enterprise Linux 5. Additionally, note that Red Hat Enterprise Linux 5 is currently in reduced support phase, receiving only Critical security updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/site/support/policy/updates/errata#Production_3_Phase",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4590"
},
{
"category": "external",
"summary": "RHBZ#1069911",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069911"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4590",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4590"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4590",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4590"
}
],
"release_date": "2014-02-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-21T15:29:13+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1088"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 1.2,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:H/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: information disclosure via XXE when running untrusted web applications"
},
{
"cve": "CVE-2014-0118",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-07-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1120601"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in the way httpd\u0027s mod_deflate module handled request body decompression (configured via the \"DEFLATE\" input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: mod_deflate denial of service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0118"
},
{
"category": "external",
"summary": "RHBZ#1120601",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120601"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0118",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0118"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0118",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0118"
},
{
"category": "external",
"summary": "http://httpd.apache.org/security/vulnerabilities_24.html",
"url": "http://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2014-07-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-21T15:29:13+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1088"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "httpd: mod_deflate denial of service"
},
{
"cve": "CVE-2014-0119",
"cwe": {
"id": "CWE-470",
"name": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102038"
}
],
"notes": [
{
"category": "description",
"text": "It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XML parser hijack by malicious web application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0119"
},
{
"category": "external",
"summary": "RHBZ#1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0119",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0119"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-21T15:29:13+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1088"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XML parser hijack by malicious web application"
},
{
"cve": "CVE-2014-0226",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2014-07-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1120603"
}
],
"notes": [
{
"category": "description",
"text": "A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the \"apache\" user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: mod_status heap-based buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0226"
},
{
"category": "external",
"summary": "RHBZ#1120603",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120603"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0226",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0226"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0226",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0226"
},
{
"category": "external",
"summary": "http://httpd.apache.org/security/vulnerabilities_24.html",
"url": "http://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2014-07-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-21T15:29:13+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1088"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpd: mod_status heap-based buffer overflow"
},
{
"cve": "CVE-2014-0227",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109196"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0227"
},
{
"category": "external",
"summary": "RHBZ#1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0227",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43",
"url": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55",
"url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55"
}
],
"release_date": "2015-02-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-21T15:29:13+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1088"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter"
},
{
"cve": "CVE-2014-0231",
"discovery_date": "2014-07-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1120596"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in the way httpd\u0027s mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpd: mod_cgid denial of service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0231"
},
{
"category": "external",
"summary": "RHBZ#1120596",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120596"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0231",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0231"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0231",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0231"
},
{
"category": "external",
"summary": "http://httpd.apache.org/security/vulnerabilities_24.html",
"url": "http://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"release_date": "2014-07-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-08-21T15:29:13+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1088"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.noarch",
"5Server-JBEWS-2:antlr-eap6-0:2.7.7-17.redhat_4.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-collections-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-collections-tomcat-eap6-0:3.2.1-15.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-daemon-eap6-1:1.0.15-5.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-daemon-jsvc-eap6-1:1.0.15-6.redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:apache-commons-pool-eap6-0:1.6-7.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:apache-commons-pool-tomcat-eap6-0:1.6-7.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.noarch",
"5Server-JBEWS-2:dom4j-eap6-0:1.6.1-20.redhat_6.1.ep6.el5.src",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.noarch",
"5Server-JBEWS-2:ecj3-1:3.7.2-9.redhat_3.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-c3p0-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-core-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:hibernate4-entitymanager-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-envers-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:hibernate4-infinispan-eap6-0:4.2.14-3.SP1_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.src",
"5Server-JBEWS-2:httpd-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-devel-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-manual-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:httpd-tools-0:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:javassist-eap6-0:3.18.1-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-logging-0:3.1.4-1.GA_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.noarch",
"5Server-JBEWS-2:jboss-transaction-api_1.1_spec-0:1.0.1-12.Final_redhat_2.2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-0:1.2.9-1.Final_redhat_1.1.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.i386",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.src",
"5Server-JBEWS-2:mod_cluster-native-0:1.2.9-3.Final_redhat_2.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_cluster-tomcat6-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_cluster-tomcat7-0:1.2.9-1.Final_redhat_1.1.ep6.el5.noarch",
"5Server-JBEWS-2:mod_jk-0:1.2.40-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-ap22-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:mod_jk-manual-0:1.2.40-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_rt-0:2.4.1-6.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.i386",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.src",
"5Server-JBEWS-2:mod_snmp-0:2.4.1-13.GA.ep6.el5.x86_64",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.i386",
"5Server-JBEWS-2:mod_ssl-1:2.2.26-35.ep6.el5.x86_64",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc6-0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5.src",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.noarch",
"5Server-JBEWS-2:storeconfig-tc7-0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.i386",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.src",
"5Server-JBEWS-2:tomcat-native-0:1.1.30-2.redhat_1.ep6.el5.x86_64",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.41-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.41-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.54-6_patch_02.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-6_patch_02.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.54-6_patch_02.ep6.el5.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "httpd: mod_cgid denial of service"
}
]
}
RHSA-2014:1904
Vulnerability from csaf_redhat - Published: 2014-11-25 16:48 - Updated: 2026-05-14 22:17Summary
Red Hat Security Advisory: Red Hat JBoss Operations Network 3.3.0 update
Severity
Important
Notes
Topic: Red Hat JBoss Operations Network 3.2.3, which fixes multiple security
issues and several bugs, is now available from the Red Hat Customer Portal.
Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details: Red Hat JBoss Operations Network is a middleware management solution that
provides a single point of control to deploy, manage, and monitor JBoss
Enterprise Middleware, applications, and services.
This JBoss Operations Network 3.3.0 release serves as a replacement for
JBoss Operations Network 3.2.3, and includes several bug fixes. Refer to
the JBoss Operations Network 3.3.0 Release Notes for information on the
most significant of these changes. The Release Notes will be available
shortly from https://access.redhat.com/documentation/en-US/
The following security issues are also fixed with this release:
It was found that the fix for CVE-2012-5783 was incomplete: the code added
to check that the server host name matches the domain name in a subject's
Common Name (CN) field in X.509 certificates was flawed. A
man-in-the-middle attacker could use this flaw to spoof an SSL server
using a specially crafted X.509 certificate. (CVE-2012-6153, CVE-2014-3577)
It was found that the default context parameters as provided to RESTEasy
deployments by JBoss EAP did not explicitly disable external entity
expansion for RESTEasy. A remote attacker could use this flaw to perform
XML External Entity (XXE) attacks on RESTEasy applications accepting XML
input. (CVE-2014-3481)
It was found that the fix for CVE-2012-0818 was incomplete: external
parameter entities were not disabled when the
resteasy.document.expand.entity.references parameter was set to false.
A remote attacker able to send XML requests to a RESTEasy endpoint could
use this flaw to read files accessible to the user running the application
server, and potentially perform other more advanced XXE attacks.
(CVE-2014-3490)
The HawtJNI Library class wrote native libraries to a predictable file name
in /tmp when the native libraries were bundled in a JAR file, and no custom
library path was specified. A local attacker could overwrite these native
libraries with malicious versions during the window between when HawtJNI
writes them and when they are executed. (CVE-2013-2035)
It was found that the security auditing functionality provided by PicketBox
and JBossSX, both security frameworks for Java applications, used a
world-readable audit.log file to record sensitive information. A local user
could possibly use this flaw to gain access to the sensitive information in
the audit.log file. (CVE-2014-0059)
The CVE-2013-2035 and CVE-2012-6153 issues were discovered by Florian
Weimer of Red Hat Product Security. The CVE-2014-3481 issue was discovered
by the Red Hat JBoss Enterprise Application Platform QE team. The
CVE-2014-3490 issue was discovered by David Jorm of Red Hat Product
Security.
All users of JBoss Operations Network 3.2.3 as provided from the Red Hat
Customer Portal are advised to upgrade to JBoss Operations Network 3.3.0.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.
5.8 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Operations Network 3.3
Red Hat / Red Hat JBoss Operations Network
|
cpe:/a:redhat:jboss_operations_network:3.3
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
The HawtJNI Library class wrote native libraries to a predictable file name in /tmp when the native libraries were bundled in a JAR file, and no custom library path was specified. A local attacker could overwrite these native libraries with malicious versions during the window between when HawtJNI writes them and when they are executed.
3.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Operations Network 3.3
Red Hat / Red Hat JBoss Operations Network
|
cpe:/a:redhat:jboss_operations_network:3.3
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
It was found that the security auditing functionality provided by PicketBox and JBossSX, both security frameworks for Java applications, used a world-readable audit.log file to record sensitive information. A local user could possibly use this flaw to gain access to the sensitive information in the audit.log file.
2.1 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Operations Network 3.3
Red Hat / Red Hat JBoss Operations Network
|
cpe:/a:redhat:jboss_operations_network:3.3
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Operations Network 3.3
Red Hat / Red Hat JBoss Operations Network
|
cpe:/a:redhat:jboss_operations_network:3.3
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that the default context parameters as provided to RESTEasy deployments by JBoss EAP did not explicitly disable external entity expansion for RESTEasy. A remote attacker could use this flaw to perform XML External Entity (XXE) attacks on RESTEasy applications accepting XML input.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Operations Network 3.3
Red Hat / Red Hat JBoss Operations Network
|
cpe:/a:redhat:jboss_operations_network:3.3
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Operations Network 3.3
Red Hat / Red Hat JBoss Operations Network
|
cpe:/a:redhat:jboss_operations_network:3.3
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.
4.8 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Operations Network 3.3
Red Hat / Red Hat JBoss Operations Network
|
cpe:/a:redhat:jboss_operations_network:3.3
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
References
41 references
Acknowledgments
Red Hat Product Security
Florian Weimer
Red Hat Product Security Team
Florian Weimer
Red Hat Product Security
David Jorm
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Operations Network 3.2.3, which fixes multiple security\nissues and several bugs, is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Operations Network is a middleware management solution that\nprovides a single point of control to deploy, manage, and monitor JBoss\nEnterprise Middleware, applications, and services.\n\nThis JBoss Operations Network 3.3.0 release serves as a replacement for\nJBoss Operations Network 3.2.3, and includes several bug fixes. Refer to\nthe JBoss Operations Network 3.3.0 Release Notes for information on the\nmost significant of these changes. The Release Notes will be available\nshortly from https://access.redhat.com/documentation/en-US/\n\nThe following security issues are also fixed with this release:\n\nIt was found that the fix for CVE-2012-5783 was incomplete: the code added\nto check that the server host name matches the domain name in a subject\u0027s\nCommon Name (CN) field in X.509 certificates was flawed. A\nman-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2012-6153, CVE-2014-3577)\n\nIt was found that the default context parameters as provided to RESTEasy\ndeployments by JBoss EAP did not explicitly disable external entity\nexpansion for RESTEasy. A remote attacker could use this flaw to perform\nXML External Entity (XXE) attacks on RESTEasy applications accepting XML\ninput. (CVE-2014-3481)\n\nIt was found that the fix for CVE-2012-0818 was incomplete: external\nparameter entities were not disabled when the\nresteasy.document.expand.entity.references parameter was set to false.\nA remote attacker able to send XML requests to a RESTEasy endpoint could\nuse this flaw to read files accessible to the user running the application\nserver, and potentially perform other more advanced XXE attacks.\n(CVE-2014-3490)\n\nThe HawtJNI Library class wrote native libraries to a predictable file name\nin /tmp when the native libraries were bundled in a JAR file, and no custom\nlibrary path was specified. A local attacker could overwrite these native\nlibraries with malicious versions during the window between when HawtJNI\nwrites them and when they are executed. (CVE-2013-2035)\n\nIt was found that the security auditing functionality provided by PicketBox\nand JBossSX, both security frameworks for Java applications, used a\nworld-readable audit.log file to record sensitive information. A local user\ncould possibly use this flaw to gain access to the sensitive information in\nthe audit.log file. (CVE-2014-0059)\n\nThe CVE-2013-2035 and CVE-2012-6153 issues were discovered by Florian\nWeimer of Red Hat Product Security. The CVE-2014-3481 issue was discovered\nby the Red Hat JBoss Enterprise Application Platform QE team. The\nCVE-2014-3490 issue was discovered by David Jorm of Red Hat Product\nSecurity.\n\nAll users of JBoss Operations Network 3.2.3 as provided from the Red Hat\nCustomer Portal are advised to upgrade to JBoss Operations Network 3.3.0.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:1904",
"url": "https://access.redhat.com/errata/RHSA-2014:1904"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=em\u0026downloadType=securityPatches\u0026version=3.3.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=em\u0026downloadType=securityPatches\u0026version=3.3.0"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Operations_Network/",
"url": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Operations_Network/"
},
{
"category": "external",
"summary": "958618",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=958618"
},
{
"category": "external",
"summary": "1063642",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063642"
},
{
"category": "external",
"summary": "1105242",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1105242"
},
{
"category": "external",
"summary": "1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1904.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Operations Network 3.3.0 update",
"tracking": {
"current_release_date": "2026-05-14T22:17:53+00:00",
"generator": {
"date": "2026-05-14T22:17:53+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.0"
}
},
"id": "RHSA-2014:1904",
"initial_release_date": "2014-11-25T16:48:32+00:00",
"revision_history": [
{
"date": "2014-11-25T16:48:32+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:33:48+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-14T22:17:53+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Operations Network 3.3",
"product": {
"name": "Red Hat JBoss Operations Network 3.3",
"product_id": "Red Hat JBoss Operations Network 3.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_operations_network:3.3"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Operations Network"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Florian Weimer"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2012-6153",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2012-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129916"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Operations Network 3.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-6153"
},
{
"category": "external",
"summary": "RHBZ#1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
}
],
"release_date": "2014-08-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-11-25T16:48:32+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nRefer to the JBoss Operations Network 3.3.0 Release Notes for\ninstallation information.",
"product_ids": [
"Red Hat JBoss Operations Network 3.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1904"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Operations Network 3.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
},
{
"acknowledgments": [
{
"names": [
"Florian Weimer"
],
"organization": "Red Hat Product Security Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2013-2035",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2013-04-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "958618"
}
],
"notes": [
{
"category": "description",
"text": "The HawtJNI Library class wrote native libraries to a predictable file name in /tmp when the native libraries were bundled in a JAR file, and no custom library path was specified. A local attacker could overwrite these native libraries with malicious versions during the window between when HawtJNI writes them and when they are executed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "HawtJNI: predictable temporary file name leading to local arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Operations Network 3.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-2035"
},
{
"category": "external",
"summary": "RHBZ#958618",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=958618"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-2035",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-2035"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-2035",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2035"
}
],
"release_date": "2013-05-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-11-25T16:48:32+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nRefer to the JBoss Operations Network 3.3.0 Release Notes for\ninstallation information.",
"product_ids": [
"Red Hat JBoss Operations Network 3.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1904"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Operations Network 3.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "HawtJNI: predictable temporary file name leading to local arbitrary code execution"
},
{
"cve": "CVE-2014-0059",
"cwe": {
"id": "CWE-532",
"name": "Insertion of Sensitive Information into Log File"
},
"discovery_date": "2014-02-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1063642"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the security auditing functionality provided by PicketBox and JBossSX, both security frameworks for Java applications, used a world-readable audit.log file to record sensitive information. A local user could possibly use this flaw to gain access to the sensitive information in the audit.log file.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JBossSX/PicketBox: World readable audit.log file",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Operations Network 3.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0059"
},
{
"category": "external",
"summary": "RHBZ#1063642",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063642"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0059",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0059"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0059",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0059"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-11-25T16:48:32+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nRefer to the JBoss Operations Network 3.3.0 Release Notes for\ninstallation information.",
"product_ids": [
"Red Hat JBoss Operations Network 3.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1904"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Operations Network 3.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "JBossSX/PicketBox: World readable audit.log file"
},
{
"cve": "CVE-2014-0227",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109196"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Operations Network 3.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0227"
},
{
"category": "external",
"summary": "RHBZ#1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0227",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43",
"url": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55",
"url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55"
}
],
"release_date": "2015-02-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-11-25T16:48:32+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nRefer to the JBoss Operations Network 3.3.0 Release Notes for\ninstallation information.",
"product_ids": [
"Red Hat JBoss Operations Network 3.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1904"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Operations Network 3.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter"
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3481",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1105242"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the default context parameters as provided to RESTEasy deployments by JBoss EAP did not explicitly disable external entity expansion for RESTEasy. A remote attacker could use this flaw to perform XML External Entity (XXE) attacks on RESTEasy applications accepting XML input.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JAX-RS: Information disclosure via XML eXternal Entity (XXE)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Operations Network 3.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3481"
},
{
"category": "external",
"summary": "RHBZ#1105242",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1105242"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3481",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3481"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3481",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3481"
}
],
"release_date": "2014-06-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-11-25T16:48:32+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nRefer to the JBoss Operations Network 3.3.0 Release Notes for\ninstallation information.",
"product_ids": [
"Red Hat JBoss Operations Network 3.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1904"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Operations Network 3.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "JAX-RS: Information disclosure via XML eXternal Entity (XXE)"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3490",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1107901"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTEasy: XXE via parameter entities",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Operations Network 3.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3490"
},
{
"category": "external",
"summary": "RHBZ#1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3490",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3490"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490"
}
],
"release_date": "2014-07-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-11-25T16:48:32+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nRefer to the JBoss Operations Network 3.3.0 Release Notes for\ninstallation information.",
"product_ids": [
"Red Hat JBoss Operations Network 3.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1904"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Operations Network 3.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTEasy: XXE via parameter entities"
},
{
"cve": "CVE-2014-3577",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2014-08-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129074"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Operations Network 3.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3577"
},
{
"category": "external",
"summary": "RHBZ#1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
}
],
"release_date": "2014-08-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-11-25T16:48:32+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nRefer to the JBoss Operations Network 3.3.0 Release Notes for\ninstallation information.",
"product_ids": [
"Red Hat JBoss Operations Network 3.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:1904"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss Operations Network 3.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
}
]
}
RHSA-2015:0091
Vulnerability from csaf_redhat - Published: 2015-01-27 16:22 - Updated: 2026-01-28 22:38Summary
Red Hat Security Advisory: Red Hat JBoss Data Grid 6.4.0 update
Severity
Important
Notes
Topic: Red Hat JBoss Data Grid 6.4.0, which fixes one security issue, multiple
bugs, and adds various enhancements, is now available from the Red Hat
Customer Portal.
Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details: Red Hat JBoss Data Grid is a distributed in-memory data grid, based on
Infinispan.
This release of Red Hat JBoss Data Grid 6.4.0 serves as a replacement for
Red Hat JBoss Data Grid 6.3.1. It includes various bug fixes and
enhancements, which are detailed in the Red Hat JBoss Data Grid 6.4.0
Release Notes. The Release Notes are available at:
https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Data_Grid/
This update also fixes the following security issue:
It was found that the implementation of the
org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method
provided a DocumentBuilderFactory that would expand entity references.
A remote, unauthenticated attacker could use this flaw to read files
accessible to the user running the application server, and potentially
perform other more advanced XXE attacks. (CVE-2014-3530)
Red Hat would like to thank Alexander Papadakis for reporting
CVE-2014-3530.
All users of Red Hat JBoss Data Grid 6.3.1 as provided from the Red Hat
Customer Portal are advised to upgrade to Red Hat JBoss Data Grid 6.4.0.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Data Grid 6.4
Red Hat / Red Hat JBoss Data Grid
|
cpe:/a:redhat:jboss_data_grid:6.4.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
7.5 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Data Grid 6.4
Red Hat / Red Hat JBoss Data Grid
|
cpe:/a:redhat:jboss_data_grid:6.4.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
References
16 references
Acknowledgments
Alexander Papadakis
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Data Grid 6.4.0, which fixes one security issue, multiple\nbugs, and adds various enhancements, is now available from the Red Hat\nCustomer Portal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Data Grid is a distributed in-memory data grid, based on\nInfinispan.\n\nThis release of Red Hat JBoss Data Grid 6.4.0 serves as a replacement for\nRed Hat JBoss Data Grid 6.3.1. It includes various bug fixes and\nenhancements, which are detailed in the Red Hat JBoss Data Grid 6.4.0\nRelease Notes. The Release Notes are available at:\nhttps://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Data_Grid/\n\nThis update also fixes the following security issue:\n\nIt was found that the implementation of the\norg.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method\nprovided a DocumentBuilderFactory that would expand entity references.\nA remote, unauthenticated attacker could use this flaw to read files\naccessible to the user running the application server, and potentially\nperform other more advanced XXE attacks. (CVE-2014-3530)\n\nRed Hat would like to thank Alexander Papadakis for reporting\nCVE-2014-3530.\n\nAll users of Red Hat JBoss Data Grid 6.3.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Data Grid 6.4.0.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:0091",
"url": "https://access.redhat.com/errata/RHSA-2015:0091"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=data.grid\u0026version=6.4.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=data.grid\u0026version=6.4.0"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Data_Grid/",
"url": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Data_Grid/"
},
{
"category": "external",
"summary": "1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0091.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Data Grid 6.4.0 update",
"tracking": {
"current_release_date": "2026-01-28T22:38:26+00:00",
"generator": {
"date": "2026-01-28T22:38:26+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.16"
}
},
"id": "RHSA-2015:0091",
"initial_release_date": "2015-01-27T16:22:37+00:00",
"revision_history": [
{
"date": "2015-01-27T16:22:37+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:34:02+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-01-28T22:38:26+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Data Grid 6.4",
"product": {
"name": "Red Hat JBoss Data Grid 6.4",
"product_id": "Red Hat JBoss Data Grid 6.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_data_grid:6.4.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Data Grid"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2014-0227",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109196"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Grid 6.4"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0227"
},
{
"category": "external",
"summary": "RHBZ#1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0227",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43",
"url": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55",
"url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55"
}
],
"release_date": "2015-02-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-01-27T16:22:37+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Data Grid installation.",
"product_ids": [
"Red Hat JBoss Data Grid 6.4"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0091"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Grid 6.4"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter"
},
{
"acknowledgments": [
{
"names": [
"Alexander Papadakis"
]
}
],
"cve": "CVE-2014-3530",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1112987"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "PicketLink: XXE via insecure DocumentBuilderFactory usage",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw could allow remote, unauthenticated attackers to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. All systems hosting PicketLink applications using SAML Identity Providers and Service Providers may be affected. It is strongly advised that anyone running an affected system applies patches to address this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Grid 6.4"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3530"
},
{
"category": "external",
"summary": "RHBZ#1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3530",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3530"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530"
}
],
"release_date": "2014-07-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-01-27T16:22:37+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Data Grid installation.",
"product_ids": [
"Red Hat JBoss Data Grid 6.4"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0091"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Grid 6.4"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "PicketLink: XXE via insecure DocumentBuilderFactory usage"
}
]
}
RHSA-2015:0234
Vulnerability from csaf_redhat - Published: 2015-02-17 22:27 - Updated: 2026-05-14 22:17Summary
Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.0.3 security update
Severity
Important
Notes
Topic: Red Hat JBoss BPM Suite 6.0.3 roll up patch 2, which fixes multiple
security issues, several bugs, and adds various enhancements, is now
available from the Red Hat Customer Portal.
Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details: Red Hat JBoss BPM Suite is a business rules and processes management system
for the management, storage, creation, modification, and deployment of
JBoss rules and BPMN2-compliant business processes.
This roll up patch serves as a cumulative upgrade for Red Hat JBoss BPM
Suite 6.0.3, and includes bug fixes and enhancements. It includes various
bug fixes, which are listed in the README file included with the patch
files.
The following security issues are also fixed with this release,
descriptions of which can be found on the respective CVE pages linked in
the References section.
CVE-2012-6153 Apache HttpComponents client: SSL hostname verification
bypass, incomplete CVE-2012-5783 fix
CVE-2014-3577 Apache HttpComponents client: SSL hostname verification
bypass, incomplete CVE-2012-6153 fix
CVE-2013-4002 xerces-j2: Xerces-J2 OpenJDK: XML parsing Denial of Service
(JAXP, 8017298)
CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of
user-supplied content in outputText tags and EL expressions
CVE-2014-0005 security: PicketBox/JBossSX: Unauthorized access to and
modification of application server configuration and state by application
CVE-2014-0075 jbossweb: tomcat: Limited DoS in chunked transfer encoding
input filter
CVE-2014-0096 jbossweb: Apache Tomcat: XXE vulnerability via user supplied
XSLTs
CVE-2014-0099 jbossweb: Apache Tomcat: Request smuggling via malicious
content length header
CVE-2014-0119 jbossweb: Apache Tomcat 6: XML parser hijack by malicious web
application
CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation
CVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter
CVE-2014-3472 jboss-as-controller: JBoss AS Security: Invalid EJB caller
role check implementation
CVE-2014-3490 RESTEasy: XXE via parameter entities
CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage
CVE-2014-3558 hibernate-validator: Hibernate Validator: JSM bypass via
ReflectionHelper
CVE-2014-3578 spring: Spring Framework: Directory traversal
CVE-2014-3625 spring: Spring Framework: directory traversal flaw
CVE-2014-3682 jbpm-designer: XXE in BPMN2 import
CVE-2014-8114 UberFire: Information disclosure and RCE via insecure file
upload/download servlets
CVE-2014-8115 KIE Workbench: Insufficient authorization constraints
Red Hat would like to thank James Roper of Typesafe for reporting the
CVE-2014-0193 issue, CA Technologies for reporting the CVE-2014-3472 issue,
Alexander Papadakis for reporting the CVE-2014-3530 issue, and David Jorm
for reporting the CVE-2014-8114 and CVE-2014-8115 issues. The CVE-2012-6153
issue was discovered by Florian Weimer of Red Hat Product Security; the
CVE-2014-0005 issue was discovered by Josef Cacek of the Red Hat JBoss EAP
Quality Engineering team; the CVE-2014-0075, CVE-2014-3490, and
CVE-2014-3682 issues were discovered by David Jorm of Red Hat Product
Security.
All users of Red Hat JBoss BPM Suite 6.0.3 as provided from the Red Hat
Customer Portal are advised to apply this roll up patch.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.
5.8 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BPMS 6.0
Red Hat / Red Hat Process Automation Manager
|
cpe:/a:redhat:jboss_bpms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BPMS 6.0
Red Hat / Red Hat Process Automation Manager
|
cpe:/a:redhat:jboss_bpms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that Mojarra JavaServer Faces did not properly escape user-supplied content in certain circumstances. Contents of outputText tags and raw EL expressions that immediately follow script or style elements were not escaped. A remote attacker could use a specially crafted URL to execute arbitrary web script in the user's browser.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BPMS 6.0
Red Hat / Red Hat Process Automation Manager
|
cpe:/a:redhat:jboss_bpms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was identified that PicketBox/JBossSX allowed any deployed application to alter or read the underlying application server configuration and state without any authorization checks. An attacker able to deploy applications could use this flaw to circumvent security constraints applied to other applications deployed on the same system, disclose privileged information, and in certain cases allow arbitrary code execution.
3.6 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BPMS 6.0
Red Hat / Red Hat Process Automation Manager
|
cpe:/a:redhat:jboss_bpms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BPMS 6.0
Red Hat / Red Hat Process Automation Manager
|
cpe:/a:redhat:jboss_bpms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.
2.1 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BPMS 6.0
Red Hat / Red Hat Process Automation Manager
|
cpe:/a:redhat:jboss_bpms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.
5.8 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BPMS 6.0
Red Hat / Red Hat Process Automation Manager
|
cpe:/a:redhat:jboss_bpms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.
2.1 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BPMS 6.0
Red Hat / Red Hat Process Automation Manager
|
cpe:/a:redhat:jboss_bpms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BPMS 6.0
Red Hat / Red Hat Process Automation Manager
|
cpe:/a:redhat:jboss_bpms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BPMS 6.0
Red Hat / Red Hat Process Automation Manager
|
cpe:/a:redhat:jboss_bpms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that the isCallerInRole() method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles.
2.1 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BPMS 6.0
Red Hat / Red Hat Process Automation Manager
|
cpe:/a:redhat:jboss_bpms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BPMS 6.0
Red Hat / Red Hat Process Automation Manager
|
cpe:/a:redhat:jboss_bpms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
7.5 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BPMS 6.0
Red Hat / Red Hat Process Automation Manager
|
cpe:/a:redhat:jboss_bpms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
It was discovered that the implementation of org.hibernate.validator.util.ReflectionHelper together with the permissions required to run Hibernate Validator under the Java Security Manager could allow a malicious application deployed in the same application container to execute several actions with escalated privileges, which might otherwise not be possible. This flaw could be used to perform various attacks, including but not restricted to, arbitrary code execution in systems that are otherwise secured by the Java Security Manager.
3.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BPMS 6.0
Red Hat / Red Hat Process Automation Manager
|
cpe:/a:redhat:jboss_bpms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.
4.8 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BPMS 6.0
Red Hat / Red Hat Process Automation Manager
|
cpe:/a:redhat:jboss_bpms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A directory traversal flaw was found in the Spring Framework. A remote attacker could use this flaw to access arbitrary files on a server, and bypassing security restrictions that are otherwise in place.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BPMS 6.0
Red Hat / Red Hat Process Automation Manager
|
cpe:/a:redhat:jboss_bpms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
A directory traversal flaw was found in the way the Spring Framework sanitized certain URLs. A remote attacker could use this flaw to obtain any file on the file system that was also accessible to the process in which the Spring web application was running.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BPMS 6.0
Red Hat / Red Hat Process Automation Manager
|
cpe:/a:redhat:jboss_bpms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
An XML External Entity (XXE) flaw was found in the jbpm-designer BPMN2 import function. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BPMS 6.0
Red Hat / Red Hat Process Automation Manager
|
cpe:/a:redhat:jboss_bpms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was discovered that the default implementation of FileUploadServlet and FileDownloadServlet provided by the UberFire Framework did not restrict the paths to which a file could be written or read from. In applications using this framework and exposing these servlets, a remote attacker could gain access to information stored in files accessible to the application container process, or execute arbitrary code by uploading malicious content.
6.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BPMS 6.0
Red Hat / Red Hat Process Automation Manager
|
cpe:/a:redhat:jboss_bpms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
It was discovered that the default authorization constrains applied on servelets deployed in the KIE Workbench application were insufficient. A remote, authenticated user without sufficient privileges could use this flaw to upload or download arbitrary files, perform privileged actions that otherwise cannot be accessed, or perform other more complex attacks.
5.5 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BPMS 6.0
Red Hat / Red Hat Process Automation Manager
|
cpe:/a:redhat:jboss_bpms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
110 references
Acknowledgments
Red Hat Product Security
Florian Weimer
Red Hat JBoss EAP Quality Engineering team
Josef Cacek
Red Hat Product Security
David Jorm
Typesafe
James Roper
CA Technologies
Alexander Papadakis
David Jorm
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss BPM Suite 6.0.3 roll up patch 2, which fixes multiple\nsecurity issues, several bugs, and adds various enhancements, is now\navailable from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss BPM Suite is a business rules and processes management system\nfor the management, storage, creation, modification, and deployment of\nJBoss rules and BPMN2-compliant business processes.\n\nThis roll up patch serves as a cumulative upgrade for Red Hat JBoss BPM\nSuite 6.0.3, and includes bug fixes and enhancements. It includes various\nbug fixes, which are listed in the README file included with the patch\nfiles.\n\nThe following security issues are also fixed with this release,\ndescriptions of which can be found on the respective CVE pages linked in\nthe References section.\n\nCVE-2012-6153 Apache HttpComponents client: SSL hostname verification\nbypass, incomplete CVE-2012-5783 fix\n\nCVE-2014-3577 Apache HttpComponents client: SSL hostname verification\nbypass, incomplete CVE-2012-6153 fix\n\nCVE-2013-4002 xerces-j2: Xerces-J2 OpenJDK: XML parsing Denial of Service\n(JAXP, 8017298)\n\nCVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of\nuser-supplied content in outputText tags and EL expressions\n\nCVE-2014-0005 security: PicketBox/JBossSX: Unauthorized access to and\nmodification of application server configuration and state by application\n\nCVE-2014-0075 jbossweb: tomcat: Limited DoS in chunked transfer encoding\ninput filter\n\nCVE-2014-0096 jbossweb: Apache Tomcat: XXE vulnerability via user supplied\nXSLTs\n\nCVE-2014-0099 jbossweb: Apache Tomcat: Request smuggling via malicious\ncontent length header\n\nCVE-2014-0119 jbossweb: Apache Tomcat 6: XML parser hijack by malicious web\napplication\n\nCVE-2014-0193 netty: DoS via memory exhaustion during data aggregation\n\nCVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter\n\nCVE-2014-3472 jboss-as-controller: JBoss AS Security: Invalid EJB caller\nrole check implementation\n\nCVE-2014-3490 RESTEasy: XXE via parameter entities\n\nCVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage\n\nCVE-2014-3558 hibernate-validator: Hibernate Validator: JSM bypass via\nReflectionHelper\n\nCVE-2014-3578 spring: Spring Framework: Directory traversal\n\nCVE-2014-3625 spring: Spring Framework: directory traversal flaw\n\nCVE-2014-3682 jbpm-designer: XXE in BPMN2 import\n\nCVE-2014-8114 UberFire: Information disclosure and RCE via insecure file\nupload/download servlets\n\nCVE-2014-8115 KIE Workbench: Insufficient authorization constraints\n\nRed Hat would like to thank James Roper of Typesafe for reporting the\nCVE-2014-0193 issue, CA Technologies for reporting the CVE-2014-3472 issue,\nAlexander Papadakis for reporting the CVE-2014-3530 issue, and David Jorm\nfor reporting the CVE-2014-8114 and CVE-2014-8115 issues. The CVE-2012-6153\nissue was discovered by Florian Weimer of Red Hat Product Security; the\nCVE-2014-0005 issue was discovered by Josef Cacek of the Red Hat JBoss EAP\nQuality Engineering team; the CVE-2014-0075, CVE-2014-3490, and\nCVE-2014-3682 issues were discovered by David Jorm of Red Hat Product\nSecurity.\n\nAll users of Red Hat JBoss BPM Suite 6.0.3 as provided from the Red Hat\nCustomer Portal are advised to apply this roll up patch.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:0234",
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=distributions\u0026version=6.0.3",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=distributions\u0026version=6.0.3"
},
{
"category": "external",
"summary": "1019176",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1019176"
},
{
"category": "external",
"summary": "1049736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049736"
},
{
"category": "external",
"summary": "1065139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
},
{
"category": "external",
"summary": "1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "1103815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103815"
},
{
"category": "external",
"summary": "1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "external",
"summary": "1120495",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120495"
},
{
"category": "external",
"summary": "1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "1131882",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131882"
},
{
"category": "external",
"summary": "1148260",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1148260"
},
{
"category": "external",
"summary": "1165936",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1165936"
},
{
"category": "external",
"summary": "1169544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1169544"
},
{
"category": "external",
"summary": "1169545",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1169545"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0234.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.0.3 security update",
"tracking": {
"current_release_date": "2026-05-14T22:17:49+00:00",
"generator": {
"date": "2026-05-14T22:17:49+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.0"
}
},
"id": "RHSA-2015:0234",
"initial_release_date": "2015-02-17T22:27:47+00:00",
"revision_history": [
{
"date": "2015-02-17T22:27:47+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:35:14+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-14T22:17:49+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss BPMS 6.0",
"product": {
"name": "Red Hat JBoss BPMS 6.0",
"product_id": "Red Hat JBoss BPMS 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_bpms:6.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Process Automation Manager"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Florian Weimer"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2012-6153",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2012-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129916"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-6153"
},
{
"category": "external",
"summary": "RHBZ#1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
}
],
"release_date": "2014-08-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
},
{
"cve": "CVE-2013-4002",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2013-10-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1019176"
}
],
"notes": [
{
"category": "description",
"text": "A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: XML parsing Denial of Service (JAXP, 8017298)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Fuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Server 4 and 5; Red Hat JBoss Enterprise Web Platform 5; Red Hat JBoss SOA Platform 4 and 5; and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4002"
},
{
"category": "external",
"summary": "RHBZ#1019176",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1019176"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4002",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html"
}
],
"release_date": "2013-10-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: XML parsing Denial of Service (JAXP, 8017298)"
},
{
"cve": "CVE-2013-5855",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2014-02-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1065139"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Mojarra JavaServer Faces did not properly escape user-supplied content in certain circumstances. Contents of outputText tags and raw EL expressions that immediately follow script or style elements were not escaped. A remote attacker could use a specially crafted URL to execute arbitrary web script in the user\u0027s browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-5855"
},
{
"category": "external",
"summary": "RHBZ#1065139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-5855",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5855"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855"
},
{
"category": "external",
"summary": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209",
"url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209"
}
],
"release_date": "2014-02-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions"
},
{
"acknowledgments": [
{
"names": [
"Josef Cacek"
],
"organization": "Red Hat JBoss EAP Quality Engineering team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0005",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2014-01-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049736"
}
],
"notes": [
{
"category": "description",
"text": "It was identified that PicketBox/JBossSX allowed any deployed application to alter or read the underlying application server configuration and state without any authorization checks. An attacker able to deploy applications could use this flaw to circumvent security constraints applied to other applications deployed on the same system, disclose privileged information, and in certain cases allow arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0005"
},
{
"category": "external",
"summary": "RHBZ#1049736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0005",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0005"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0005",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0005"
}
],
"release_date": "2014-03-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 3.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0075",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1072776"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0075"
},
{
"category": "external",
"summary": "RHBZ#1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter"
},
{
"cve": "CVE-2014-0096",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1088342"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0096"
},
{
"category": "external",
"summary": "RHBZ#1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs"
},
{
"cve": "CVE-2014-0099",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102030"
}
],
"notes": [
{
"category": "description",
"text": "It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Request smuggling via malicious content length header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0099"
},
{
"category": "external",
"summary": "RHBZ#1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Request smuggling via malicious content length header"
},
{
"cve": "CVE-2014-0119",
"cwe": {
"id": "CWE-470",
"name": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102038"
}
],
"notes": [
{
"category": "description",
"text": "It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XML parser hijack by malicious web application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0119"
},
{
"category": "external",
"summary": "RHBZ#1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0119",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0119"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XML parser hijack by malicious web application"
},
{
"acknowledgments": [
{
"names": [
"James Roper"
],
"organization": "Typesafe"
}
],
"cve": "CVE-2014-0193",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-04-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1092783"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: DoS via memory exhaustion during data aggregation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0193"
},
{
"category": "external",
"summary": "RHBZ#1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0193",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193"
}
],
"release_date": "2014-05-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "netty: DoS via memory exhaustion during data aggregation"
},
{
"cve": "CVE-2014-0227",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109196"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0227"
},
{
"category": "external",
"summary": "RHBZ#1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0227",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43",
"url": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55",
"url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55"
}
],
"release_date": "2015-02-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter"
},
{
"acknowledgments": [
{
"names": [
"CA Technologies"
]
}
],
"cve": "CVE-2014-3472",
"cwe": {
"id": "CWE-184",
"name": "Incomplete List of Disallowed Inputs"
},
"discovery_date": "2014-05-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1103815"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the isCallerInRole() method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Security: Invalid EJB caller role check implementation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3472"
},
{
"category": "external",
"summary": "RHBZ#1103815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3472",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3472"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3472",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3472"
}
],
"release_date": "2014-08-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Security: Invalid EJB caller role check implementation"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3490",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1107901"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTEasy: XXE via parameter entities",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3490"
},
{
"category": "external",
"summary": "RHBZ#1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3490",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3490"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490"
}
],
"release_date": "2014-07-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTEasy: XXE via parameter entities"
},
{
"acknowledgments": [
{
"names": [
"Alexander Papadakis"
]
}
],
"cve": "CVE-2014-3530",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1112987"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "PicketLink: XXE via insecure DocumentBuilderFactory usage",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw could allow remote, unauthenticated attackers to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. All systems hosting PicketLink applications using SAML Identity Providers and Service Providers may be affected. It is strongly advised that anyone running an affected system applies patches to address this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3530"
},
{
"category": "external",
"summary": "RHBZ#1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3530",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3530"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530"
}
],
"release_date": "2014-07-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "PicketLink: XXE via insecure DocumentBuilderFactory usage"
},
{
"cve": "CVE-2014-3558",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"discovery_date": "2014-07-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1120495"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the implementation of org.hibernate.validator.util.ReflectionHelper together with the permissions required to run Hibernate Validator under the Java Security Manager could allow a malicious application deployed in the same application container to execute several actions with escalated privileges, which might otherwise not be possible. This flaw could be used to perform various attacks, including but not restricted to, arbitrary code execution in systems that are otherwise secured by the Java Security Manager.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Validator: JSM bypass via ReflectionHelper",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3558"
},
{
"category": "external",
"summary": "RHBZ#1120495",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120495"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3558",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3558"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3558",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3558"
}
],
"release_date": "2014-07-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Validator: JSM bypass via ReflectionHelper"
},
{
"cve": "CVE-2014-3577",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2014-08-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129074"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3577"
},
{
"category": "external",
"summary": "RHBZ#1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
}
],
"release_date": "2014-08-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
},
{
"cve": "CVE-2014-3578",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2014-08-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1131882"
}
],
"notes": [
{
"category": "description",
"text": "A directory traversal flaw was found in the Spring Framework. A remote attacker could use this flaw to access arbitrary files on a server, and bypassing security restrictions that are otherwise in place.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Framework: Directory traversal",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3578"
},
{
"category": "external",
"summary": "RHBZ#1131882",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131882"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3578",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3578"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3578",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3578"
},
{
"category": "external",
"summary": "http://www.pivotal.io/security/cve-2014-3578",
"url": "http://www.pivotal.io/security/cve-2014-3578"
},
{
"category": "external",
"summary": "https://jvn.jp/en/jp/JVN49154900/",
"url": "https://jvn.jp/en/jp/JVN49154900/"
}
],
"release_date": "2014-09-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Framework: Directory traversal"
},
{
"cve": "CVE-2014-3625",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2014-11-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1165936"
}
],
"notes": [
{
"category": "description",
"text": "A directory traversal flaw was found in the way the Spring Framework sanitized certain URLs. A remote attacker could use this flaw to obtain any file on the file system that was also accessible to the process in which the Spring web application was running.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Framework: directory traversal flaw",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3625"
},
{
"category": "external",
"summary": "RHBZ#1165936",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1165936"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3625",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3625"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3625",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3625"
}
],
"release_date": "2014-11-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Framework: directory traversal flaw"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3682",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-10-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1148260"
}
],
"notes": [
{
"category": "description",
"text": "An XML External Entity (XXE) flaw was found in the jbpm-designer BPMN2 import function. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jbpm-designer: XXE in BPMN2 import",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3682"
},
{
"category": "external",
"summary": "RHBZ#1148260",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1148260"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3682",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3682"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3682",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3682"
}
],
"release_date": "2015-02-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jbpm-designer: XXE in BPMN2 import"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
]
}
],
"cve": "CVE-2014-8114",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2014-11-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1169544"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the default implementation of FileUploadServlet and FileDownloadServlet provided by the UberFire Framework did not restrict the paths to which a file could be written or read from. In applications using this framework and exposing these servlets, a remote attacker could gain access to information stored in files accessible to the application container process, or execute arbitrary code by uploading malicious content.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "UberFire: Information disclosure and RCE via insecure file upload/download servlets",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-8114"
},
{
"category": "external",
"summary": "RHBZ#1169544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1169544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-8114",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-8114"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-8114",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8114"
}
],
"release_date": "2015-02-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "UberFire: Information disclosure and RCE via insecure file upload/download servlets"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
]
}
],
"cve": "CVE-2014-8115",
"cwe": {
"id": "CWE-285",
"name": "Improper Authorization"
},
"discovery_date": "2014-11-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1169545"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the default authorization constrains applied on servelets deployed in the KIE Workbench application were insufficient. A remote, authenticated user without sufficient privileges could use this flaw to upload or download arbitrary files, perform privileged actions that otherwise cannot be accessed, or perform other more complex attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Workbench: Insufficient authorization constraints",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat JBoss BRMS 5 is now in Phase 3, Extended Life Support, of its life cycle. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-8115"
},
{
"category": "external",
"summary": "RHBZ#1169545",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1169545"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-8115",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-8115"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-8115",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8115"
}
],
"release_date": "2015-02-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Workbench: Insufficient authorization constraints"
}
]
}
RHSA-2015:0235
Vulnerability from csaf_redhat - Published: 2015-02-17 22:27 - Updated: 2026-05-14 22:17Summary
Red Hat Security Advisory: Red Hat JBoss BRMS 6.0.3 security update
Severity
Important
Notes
Topic: Red Hat JBoss BRMS 6.0.3 roll up patch 2, which fixes multiple security
issues, several bugs, and adds various enhancements, is now available from
the Red Hat Customer Portal.
Red Hat Product Security has rated this update as having Important
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details: Red Hat JBoss BRMS is a business rules management system for the
management, storage, creation, modification, and deployment of JBoss
Rules.
This roll up patch serves as a cumulative upgrade for Red Hat JBoss BRMS
6.0.3, and includes bug fixes and enhancements. It includes various bug
fixes, which are listed in the README file included with the patch files.
The following security issues are also fixed with this release,
descriptions of which can be found on the respective CVE pages linked in
the References section.
CVE-2012-6153 Apache HttpComponents client: SSL hostname verification
bypass, incomplete CVE-2012-5783 fix
CVE-2014-3577 Apache HttpComponents client: SSL hostname verification
bypass, incomplete CVE-2012-6153 fix
CVE-2013-4002 xerces-j2: Xerces-J2 OpenJDK: XML parsing Denial of Service
(JAXP, 8017298)
CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of
user-supplied content in outputText tags and EL expressions
CVE-2014-0005 security: PicketBox/JBossSX: Unauthorized access to and
modification of application server configuration and state by application
CVE-2014-0075 jbossweb: tomcat: Limited DoS in chunked transfer encoding
input filter
CVE-2014-0096 jbossweb: Apache Tomcat: XXE vulnerability via user supplied
XSLTs
CVE-2014-0099 jbossweb: Apache Tomcat: Request smuggling via malicious
content length header
CVE-2014-0119 jbossweb: Apache Tomcat 6: XML parser hijack by malicious web
application
CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation
CVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter
CVE-2014-3472 jboss-as-controller: JBoss AS Security: Invalid EJB caller
role check implementation
CVE-2014-3490 RESTEasy: XXE via parameter entities
CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage
CVE-2014-3558 hibernate-validator: Hibernate Validator: JSM bypass via
ReflectionHelper
CVE-2014-3578 spring: Spring Framework: Directory traversal
CVE-2014-3625 spring: Spring Framework: directory traversal flaw
CVE-2014-3682 jbpm-designer: XXE in BPMN2 import
CVE-2014-8114 UberFire: Information disclosure and RCE via insecure file
upload/download servlets
CVE-2014-8115 KIE Workbench: Insufficient authorization constraints
Red Hat would like to thank James Roper of Typesafe for reporting the
CVE-2014-0193 issue; CA Technologies for reporting the CVE-2014-3472 issue;
Alexander Papadakis for reporting the CVE-2014-3530 issue; and David Jorm
for reporting the CVE-2014-8114 and CVE-2014-8115 issues. The CVE-2012-6153
issue was discovered by Florian Weimer of Red Hat Product Security; the
CVE-2014-0005 issue was discovered by Josef Cacek of the Red Hat JBoss EAP
Quality Engineering team; and the CVE-2014-0075, CVE-2014-3490, and
CVE-2014-3682 issues were discovered by David Jorm of Red Hat Product
Security.
All users of Red Hat JBoss BRMS 6.0.3 as provided from the Red Hat Customer
Portal are advised to apply this roll up patch.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.
5.8 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BRMS 6.0
Red Hat / Red Hat Decision Manager
|
cpe:/a:redhat:jboss_brms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BRMS 6.0
Red Hat / Red Hat Decision Manager
|
cpe:/a:redhat:jboss_brms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that Mojarra JavaServer Faces did not properly escape user-supplied content in certain circumstances. Contents of outputText tags and raw EL expressions that immediately follow script or style elements were not escaped. A remote attacker could use a specially crafted URL to execute arbitrary web script in the user's browser.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BRMS 6.0
Red Hat / Red Hat Decision Manager
|
cpe:/a:redhat:jboss_brms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was identified that PicketBox/JBossSX allowed any deployed application to alter or read the underlying application server configuration and state without any authorization checks. An attacker able to deploy applications could use this flaw to circumvent security constraints applied to other applications deployed on the same system, disclose privileged information, and in certain cases allow arbitrary code execution.
3.6 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BRMS 6.0
Red Hat / Red Hat Decision Manager
|
cpe:/a:redhat:jboss_brms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BRMS 6.0
Red Hat / Red Hat Decision Manager
|
cpe:/a:redhat:jboss_brms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.
2.1 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BRMS 6.0
Red Hat / Red Hat Decision Manager
|
cpe:/a:redhat:jboss_brms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.
5.8 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BRMS 6.0
Red Hat / Red Hat Decision Manager
|
cpe:/a:redhat:jboss_brms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.
2.1 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BRMS 6.0
Red Hat / Red Hat Decision Manager
|
cpe:/a:redhat:jboss_brms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BRMS 6.0
Red Hat / Red Hat Decision Manager
|
cpe:/a:redhat:jboss_brms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BRMS 6.0
Red Hat / Red Hat Decision Manager
|
cpe:/a:redhat:jboss_brms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that the isCallerInRole() method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles.
2.1 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BRMS 6.0
Red Hat / Red Hat Decision Manager
|
cpe:/a:redhat:jboss_brms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BRMS 6.0
Red Hat / Red Hat Decision Manager
|
cpe:/a:redhat:jboss_brms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
7.5 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BRMS 6.0
Red Hat / Red Hat Decision Manager
|
cpe:/a:redhat:jboss_brms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
It was discovered that the implementation of org.hibernate.validator.util.ReflectionHelper together with the permissions required to run Hibernate Validator under the Java Security Manager could allow a malicious application deployed in the same application container to execute several actions with escalated privileges, which might otherwise not be possible. This flaw could be used to perform various attacks, including but not restricted to, arbitrary code execution in systems that are otherwise secured by the Java Security Manager.
3.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BRMS 6.0
Red Hat / Red Hat Decision Manager
|
cpe:/a:redhat:jboss_brms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.
4.8 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BRMS 6.0
Red Hat / Red Hat Decision Manager
|
cpe:/a:redhat:jboss_brms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A directory traversal flaw was found in the Spring Framework. A remote attacker could use this flaw to access arbitrary files on a server, and bypassing security restrictions that are otherwise in place.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BRMS 6.0
Red Hat / Red Hat Decision Manager
|
cpe:/a:redhat:jboss_brms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
A directory traversal flaw was found in the way the Spring Framework sanitized certain URLs. A remote attacker could use this flaw to obtain any file on the file system that was also accessible to the process in which the Spring web application was running.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BRMS 6.0
Red Hat / Red Hat Decision Manager
|
cpe:/a:redhat:jboss_brms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
An XML External Entity (XXE) flaw was found in the jbpm-designer BPMN2 import function. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BRMS 6.0
Red Hat / Red Hat Decision Manager
|
cpe:/a:redhat:jboss_brms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was discovered that the default implementation of FileUploadServlet and FileDownloadServlet provided by the UberFire Framework did not restrict the paths to which a file could be written or read from. In applications using this framework and exposing these servlets, a remote attacker could gain access to information stored in files accessible to the application container process, or execute arbitrary code by uploading malicious content.
6.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BRMS 6.0
Red Hat / Red Hat Decision Manager
|
cpe:/a:redhat:jboss_brms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
It was discovered that the default authorization constrains applied on servelets deployed in the KIE Workbench application were insufficient. A remote, authenticated user without sufficient privileges could use this flaw to upload or download arbitrary files, perform privileged actions that otherwise cannot be accessed, or perform other more complex attacks.
5.5 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss BRMS 6.0
Red Hat / Red Hat Decision Manager
|
cpe:/a:redhat:jboss_brms:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
110 references
Acknowledgments
Red Hat Product Security
Florian Weimer
Red Hat JBoss EAP Quality Engineering team
Josef Cacek
Red Hat Product Security
David Jorm
Typesafe
James Roper
CA Technologies
Alexander Papadakis
David Jorm
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss BRMS 6.0.3 roll up patch 2, which fixes multiple security\nissues, several bugs, and adds various enhancements, is now available from\nthe Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss BRMS is a business rules management system for the\nmanagement, storage, creation, modification, and deployment of JBoss\nRules.\n\nThis roll up patch serves as a cumulative upgrade for Red Hat JBoss BRMS\n6.0.3, and includes bug fixes and enhancements. It includes various bug\nfixes, which are listed in the README file included with the patch files.\n\nThe following security issues are also fixed with this release,\ndescriptions of which can be found on the respective CVE pages linked in\nthe References section.\n\nCVE-2012-6153 Apache HttpComponents client: SSL hostname verification\nbypass, incomplete CVE-2012-5783 fix\n\nCVE-2014-3577 Apache HttpComponents client: SSL hostname verification\nbypass, incomplete CVE-2012-6153 fix\n\nCVE-2013-4002 xerces-j2: Xerces-J2 OpenJDK: XML parsing Denial of Service\n(JAXP, 8017298)\n\nCVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of\nuser-supplied content in outputText tags and EL expressions\n\nCVE-2014-0005 security: PicketBox/JBossSX: Unauthorized access to and\nmodification of application server configuration and state by application\n\nCVE-2014-0075 jbossweb: tomcat: Limited DoS in chunked transfer encoding\ninput filter\n\nCVE-2014-0096 jbossweb: Apache Tomcat: XXE vulnerability via user supplied\nXSLTs\n\nCVE-2014-0099 jbossweb: Apache Tomcat: Request smuggling via malicious\ncontent length header\n\nCVE-2014-0119 jbossweb: Apache Tomcat 6: XML parser hijack by malicious web\napplication\n\nCVE-2014-0193 netty: DoS via memory exhaustion during data aggregation\n\nCVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter\n\nCVE-2014-3472 jboss-as-controller: JBoss AS Security: Invalid EJB caller\nrole check implementation\n\nCVE-2014-3490 RESTEasy: XXE via parameter entities\n\nCVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage\n\nCVE-2014-3558 hibernate-validator: Hibernate Validator: JSM bypass via\nReflectionHelper\n\nCVE-2014-3578 spring: Spring Framework: Directory traversal\n\nCVE-2014-3625 spring: Spring Framework: directory traversal flaw\n\nCVE-2014-3682 jbpm-designer: XXE in BPMN2 import\n\nCVE-2014-8114 UberFire: Information disclosure and RCE via insecure file\nupload/download servlets\n\nCVE-2014-8115 KIE Workbench: Insufficient authorization constraints\n\nRed Hat would like to thank James Roper of Typesafe for reporting the\nCVE-2014-0193 issue; CA Technologies for reporting the CVE-2014-3472 issue;\nAlexander Papadakis for reporting the CVE-2014-3530 issue; and David Jorm\nfor reporting the CVE-2014-8114 and CVE-2014-8115 issues. The CVE-2012-6153\nissue was discovered by Florian Weimer of Red Hat Product Security; the\nCVE-2014-0005 issue was discovered by Josef Cacek of the Red Hat JBoss EAP\nQuality Engineering team; and the CVE-2014-0075, CVE-2014-3490, and\nCVE-2014-3682 issues were discovered by David Jorm of Red Hat Product\nSecurity.\n\nAll users of Red Hat JBoss BRMS 6.0.3 as provided from the Red Hat Customer\nPortal are advised to apply this roll up patch.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:0235",
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=distributions\u0026version=6.0.3",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=distributions\u0026version=6.0.3"
},
{
"category": "external",
"summary": "1019176",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1019176"
},
{
"category": "external",
"summary": "1049736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049736"
},
{
"category": "external",
"summary": "1065139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
},
{
"category": "external",
"summary": "1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "1103815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103815"
},
{
"category": "external",
"summary": "1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "external",
"summary": "1120495",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120495"
},
{
"category": "external",
"summary": "1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "1131882",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131882"
},
{
"category": "external",
"summary": "1148260",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1148260"
},
{
"category": "external",
"summary": "1165936",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1165936"
},
{
"category": "external",
"summary": "1169544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1169544"
},
{
"category": "external",
"summary": "1169545",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1169545"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0235.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss BRMS 6.0.3 security update",
"tracking": {
"current_release_date": "2026-05-14T22:17:49+00:00",
"generator": {
"date": "2026-05-14T22:17:49+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.0"
}
},
"id": "RHSA-2015:0235",
"initial_release_date": "2015-02-17T22:27:36+00:00",
"revision_history": [
{
"date": "2015-02-17T22:27:36+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:35:32+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-14T22:17:49+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss BRMS 6.0",
"product": {
"name": "Red Hat JBoss BRMS 6.0",
"product_id": "Red Hat JBoss BRMS 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_brms:6.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Decision Manager"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Florian Weimer"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2012-6153",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2012-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129916"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-6153"
},
{
"category": "external",
"summary": "RHBZ#1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
}
],
"release_date": "2014-08-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
},
{
"cve": "CVE-2013-4002",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2013-10-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1019176"
}
],
"notes": [
{
"category": "description",
"text": "A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: XML parsing Denial of Service (JAXP, 8017298)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Fuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Server 4 and 5; Red Hat JBoss Enterprise Web Platform 5; Red Hat JBoss SOA Platform 4 and 5; and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4002"
},
{
"category": "external",
"summary": "RHBZ#1019176",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1019176"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4002",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html"
}
],
"release_date": "2013-10-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: XML parsing Denial of Service (JAXP, 8017298)"
},
{
"cve": "CVE-2013-5855",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2014-02-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1065139"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Mojarra JavaServer Faces did not properly escape user-supplied content in certain circumstances. Contents of outputText tags and raw EL expressions that immediately follow script or style elements were not escaped. A remote attacker could use a specially crafted URL to execute arbitrary web script in the user\u0027s browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-5855"
},
{
"category": "external",
"summary": "RHBZ#1065139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-5855",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5855"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855"
},
{
"category": "external",
"summary": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209",
"url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209"
}
],
"release_date": "2014-02-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions"
},
{
"acknowledgments": [
{
"names": [
"Josef Cacek"
],
"organization": "Red Hat JBoss EAP Quality Engineering team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0005",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2014-01-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049736"
}
],
"notes": [
{
"category": "description",
"text": "It was identified that PicketBox/JBossSX allowed any deployed application to alter or read the underlying application server configuration and state without any authorization checks. An attacker able to deploy applications could use this flaw to circumvent security constraints applied to other applications deployed on the same system, disclose privileged information, and in certain cases allow arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0005"
},
{
"category": "external",
"summary": "RHBZ#1049736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0005",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0005"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0005",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0005"
}
],
"release_date": "2014-03-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 3.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0075",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1072776"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0075"
},
{
"category": "external",
"summary": "RHBZ#1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter"
},
{
"cve": "CVE-2014-0096",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1088342"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0096"
},
{
"category": "external",
"summary": "RHBZ#1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs"
},
{
"cve": "CVE-2014-0099",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102030"
}
],
"notes": [
{
"category": "description",
"text": "It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Request smuggling via malicious content length header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0099"
},
{
"category": "external",
"summary": "RHBZ#1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Request smuggling via malicious content length header"
},
{
"cve": "CVE-2014-0119",
"cwe": {
"id": "CWE-470",
"name": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102038"
}
],
"notes": [
{
"category": "description",
"text": "It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XML parser hijack by malicious web application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0119"
},
{
"category": "external",
"summary": "RHBZ#1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0119",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0119"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XML parser hijack by malicious web application"
},
{
"acknowledgments": [
{
"names": [
"James Roper"
],
"organization": "Typesafe"
}
],
"cve": "CVE-2014-0193",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-04-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1092783"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: DoS via memory exhaustion during data aggregation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0193"
},
{
"category": "external",
"summary": "RHBZ#1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0193",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193"
}
],
"release_date": "2014-05-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "netty: DoS via memory exhaustion during data aggregation"
},
{
"cve": "CVE-2014-0227",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109196"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0227"
},
{
"category": "external",
"summary": "RHBZ#1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0227",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43",
"url": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55",
"url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55"
}
],
"release_date": "2015-02-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter"
},
{
"acknowledgments": [
{
"names": [
"CA Technologies"
]
}
],
"cve": "CVE-2014-3472",
"cwe": {
"id": "CWE-184",
"name": "Incomplete List of Disallowed Inputs"
},
"discovery_date": "2014-05-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1103815"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the isCallerInRole() method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Security: Invalid EJB caller role check implementation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3472"
},
{
"category": "external",
"summary": "RHBZ#1103815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3472",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3472"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3472",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3472"
}
],
"release_date": "2014-08-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Security: Invalid EJB caller role check implementation"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3490",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1107901"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTEasy: XXE via parameter entities",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3490"
},
{
"category": "external",
"summary": "RHBZ#1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3490",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3490"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490"
}
],
"release_date": "2014-07-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTEasy: XXE via parameter entities"
},
{
"acknowledgments": [
{
"names": [
"Alexander Papadakis"
]
}
],
"cve": "CVE-2014-3530",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1112987"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "PicketLink: XXE via insecure DocumentBuilderFactory usage",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw could allow remote, unauthenticated attackers to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. All systems hosting PicketLink applications using SAML Identity Providers and Service Providers may be affected. It is strongly advised that anyone running an affected system applies patches to address this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3530"
},
{
"category": "external",
"summary": "RHBZ#1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3530",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3530"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530"
}
],
"release_date": "2014-07-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "PicketLink: XXE via insecure DocumentBuilderFactory usage"
},
{
"cve": "CVE-2014-3558",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"discovery_date": "2014-07-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1120495"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the implementation of org.hibernate.validator.util.ReflectionHelper together with the permissions required to run Hibernate Validator under the Java Security Manager could allow a malicious application deployed in the same application container to execute several actions with escalated privileges, which might otherwise not be possible. This flaw could be used to perform various attacks, including but not restricted to, arbitrary code execution in systems that are otherwise secured by the Java Security Manager.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Validator: JSM bypass via ReflectionHelper",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3558"
},
{
"category": "external",
"summary": "RHBZ#1120495",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120495"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3558",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3558"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3558",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3558"
}
],
"release_date": "2014-07-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Validator: JSM bypass via ReflectionHelper"
},
{
"cve": "CVE-2014-3577",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2014-08-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129074"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3577"
},
{
"category": "external",
"summary": "RHBZ#1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
}
],
"release_date": "2014-08-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
},
{
"cve": "CVE-2014-3578",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2014-08-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1131882"
}
],
"notes": [
{
"category": "description",
"text": "A directory traversal flaw was found in the Spring Framework. A remote attacker could use this flaw to access arbitrary files on a server, and bypassing security restrictions that are otherwise in place.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Framework: Directory traversal",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3578"
},
{
"category": "external",
"summary": "RHBZ#1131882",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131882"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3578",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3578"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3578",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3578"
},
{
"category": "external",
"summary": "http://www.pivotal.io/security/cve-2014-3578",
"url": "http://www.pivotal.io/security/cve-2014-3578"
},
{
"category": "external",
"summary": "https://jvn.jp/en/jp/JVN49154900/",
"url": "https://jvn.jp/en/jp/JVN49154900/"
}
],
"release_date": "2014-09-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Framework: Directory traversal"
},
{
"cve": "CVE-2014-3625",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2014-11-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1165936"
}
],
"notes": [
{
"category": "description",
"text": "A directory traversal flaw was found in the way the Spring Framework sanitized certain URLs. A remote attacker could use this flaw to obtain any file on the file system that was also accessible to the process in which the Spring web application was running.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Framework: directory traversal flaw",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3625"
},
{
"category": "external",
"summary": "RHBZ#1165936",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1165936"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3625",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3625"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3625",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3625"
}
],
"release_date": "2014-11-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Framework: directory traversal flaw"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3682",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-10-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1148260"
}
],
"notes": [
{
"category": "description",
"text": "An XML External Entity (XXE) flaw was found in the jbpm-designer BPMN2 import function. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jbpm-designer: XXE in BPMN2 import",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3682"
},
{
"category": "external",
"summary": "RHBZ#1148260",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1148260"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3682",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3682"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3682",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3682"
}
],
"release_date": "2015-02-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jbpm-designer: XXE in BPMN2 import"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
]
}
],
"cve": "CVE-2014-8114",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2014-11-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1169544"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the default implementation of FileUploadServlet and FileDownloadServlet provided by the UberFire Framework did not restrict the paths to which a file could be written or read from. In applications using this framework and exposing these servlets, a remote attacker could gain access to information stored in files accessible to the application container process, or execute arbitrary code by uploading malicious content.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "UberFire: Information disclosure and RCE via insecure file upload/download servlets",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-8114"
},
{
"category": "external",
"summary": "RHBZ#1169544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1169544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-8114",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-8114"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-8114",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8114"
}
],
"release_date": "2015-02-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "UberFire: Information disclosure and RCE via insecure file upload/download servlets"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
]
}
],
"cve": "CVE-2014-8115",
"cwe": {
"id": "CWE-285",
"name": "Improper Authorization"
},
"discovery_date": "2014-11-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1169545"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the default authorization constrains applied on servelets deployed in the KIE Workbench application were insufficient. A remote, authenticated user without sufficient privileges could use this flaw to upload or download arbitrary files, perform privileged actions that otherwise cannot be accessed, or perform other more complex attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Workbench: Insufficient authorization constraints",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat JBoss BRMS 5 is now in Phase 3, Extended Life Support, of its life cycle. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-8115"
},
{
"category": "external",
"summary": "RHBZ#1169545",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1169545"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-8115",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-8115"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-8115",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8115"
}
],
"release_date": "2015-02-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Workbench: Insufficient authorization constraints"
}
]
}
RHSA-2015:0675
Vulnerability from csaf_redhat - Published: 2015-03-11 16:51 - Updated: 2026-05-14 22:17Summary
Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.1.0 update
Severity
Important
Notes
Topic: Red Hat JBoss Data Virtualization 6.1.0, which fixes multiple security
issues and various bugs, is now available from the Red Hat Customer Portal.
Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details: Red Hat JBoss Data Virtualization is a lean data integration solution that
provides easy, real-time, and unified data access across disparate sources
to multiple applications and users. JBoss Data Virtualization makes data
spread across physically distinct systems—such as multiple databases, XML
files, and even Hadoop systems—appear as a set of tables in a local
database.
The release of Red Hat JBoss Data Virtualization 6.1.0 serves as a
replacement for Red Hat JBoss Data Virtualization 6.0.0. It includes
various bug fixes, which are listed in the README file included with the
patch files.
The following security issues are also fixed with this release,
descriptions of which can be found on the respective CVE pages linked in
the References section.
CVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname
verification bypass, incomplete CVE-2012-5783 fix
CVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname
verification bypass, incomplete CVE-2012-6153 fix
CVE-2013-4002 Xerces-J2 OpenJDK: XML parsing Denial of Service (JAXP,
8017298)
CVE-2013-4517 Apache Santuario XML Security for Java: Java XML Signature
DoS Attack
CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of
user-supplied content in outputText tags and EL expressions
CVE-2014-0059 JBossSX/PicketBox: World readable audit.log file
CVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding
input filter
CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs
CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content
length header
CVE-2014-0119 Tomcat/JBossWeb: XML parser hijack by malicious web
application
CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation
CVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding
input filter
CVE-2014-3481 JBoss AS JAX-RS: Information disclosure via XML eXternal
Entity (XXE)
CVE-2014-3490 RESTEasy: XXE via parameter entities
CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage
CVE-2014-3623 Apache WSS4J / Apache CXF: Improper security semantics
enforcement of SAML SubjectConfirmation methods
CVE-2014-7839 RESTeasy: External entities expanded by DocumentProvider
CVE-2014-8122 JBoss Weld: Limited information disclosure via stale thread
state
Red Hat would like to thank James Roper of Typesafe for reporting
CVE-2014-0193, Alexander Papadakis for reporting CVE-2014-3530, and Rune
Steinseth of JProfessionals for reporting CVE-2014-8122. The CVE-2012-6153
issue was discovered by Florian Weimer of Red Hat Product Security, the
CVE-2014-0075 and CVE-2014-3490 issues were discovered by David Jorm of Red
Hat Product Security, and the CVE-2014-3481 issue was discovered by the Red
Hat JBoss Enterprise Application Platform QE team.
All users of Red Hat JBoss Data Virtualization 6.0.0 as provided from the
Red Hat Customer Portal are advised to apply this roll up patch.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.
5.8 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Data Virtualization 6.1
Red Hat / Red Hat JBoss Data Virtualization
|
cpe:/a:redhat:jboss_data_virtualization:6.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Data Virtualization 6.1
Red Hat / Red Hat JBoss Data Virtualization
|
cpe:/a:redhat:jboss_data_virtualization:6.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was discovered that the Apache Santuario XML Security for Java project allowed Document Type Definitions (DTDs) to be processed when applying Transforms even when secure validation was enabled. A remote attacker could use this flaw to exhaust all available memory on the system, causing a denial of service.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Data Virtualization 6.1
Red Hat / Red Hat JBoss Data Virtualization
|
cpe:/a:redhat:jboss_data_virtualization:6.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that Mojarra JavaServer Faces did not properly escape user-supplied content in certain circumstances. Contents of outputText tags and raw EL expressions that immediately follow script or style elements were not escaped. A remote attacker could use a specially crafted URL to execute arbitrary web script in the user's browser.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Data Virtualization 6.1
Red Hat / Red Hat JBoss Data Virtualization
|
cpe:/a:redhat:jboss_data_virtualization:6.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that the security auditing functionality provided by PicketBox and JBossSX, both security frameworks for Java applications, used a world-readable audit.log file to record sensitive information. A local user could possibly use this flaw to gain access to the sensitive information in the audit.log file.
2.1 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Data Virtualization 6.1
Red Hat / Red Hat JBoss Data Virtualization
|
cpe:/a:redhat:jboss_data_virtualization:6.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Data Virtualization 6.1
Red Hat / Red Hat JBoss Data Virtualization
|
cpe:/a:redhat:jboss_data_virtualization:6.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.
2.1 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Data Virtualization 6.1
Red Hat / Red Hat JBoss Data Virtualization
|
cpe:/a:redhat:jboss_data_virtualization:6.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.
5.8 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Data Virtualization 6.1
Red Hat / Red Hat JBoss Data Virtualization
|
cpe:/a:redhat:jboss_data_virtualization:6.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.
2.1 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Data Virtualization 6.1
Red Hat / Red Hat JBoss Data Virtualization
|
cpe:/a:redhat:jboss_data_virtualization:6.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Data Virtualization 6.1
Red Hat / Red Hat JBoss Data Virtualization
|
cpe:/a:redhat:jboss_data_virtualization:6.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Data Virtualization 6.1
Red Hat / Red Hat JBoss Data Virtualization
|
cpe:/a:redhat:jboss_data_virtualization:6.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that the default context parameters as provided to RESTEasy deployments by JBoss EAP did not explicitly disable external entity expansion for RESTEasy. A remote attacker could use this flaw to perform XML External Entity (XXE) attacks on RESTEasy applications accepting XML input.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Data Virtualization 6.1
Red Hat / Red Hat JBoss Data Virtualization
|
cpe:/a:redhat:jboss_data_virtualization:6.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Data Virtualization 6.1
Red Hat / Red Hat JBoss Data Virtualization
|
cpe:/a:redhat:jboss_data_virtualization:6.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
7.5 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Data Virtualization 6.1
Red Hat / Red Hat JBoss Data Virtualization
|
cpe:/a:redhat:jboss_data_virtualization:6.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.
4.8 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Data Virtualization 6.1
Red Hat / Red Hat JBoss Data Virtualization
|
cpe:/a:redhat:jboss_data_virtualization:6.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A directory traversal flaw was found in the Spring Framework. A remote attacker could use this flaw to access arbitrary files on a server, and bypassing security restrictions that are otherwise in place.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Data Virtualization 6.1
Red Hat / Red Hat JBoss Data Virtualization
|
cpe:/a:redhat:jboss_data_virtualization:6.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that Apache WSS4J (Web Services Security for Java), as used by Apache CXF with the TransportBinding, did not, by default, properly enforce all security requirements associated with SAML SubjectConfirmation methods. A remote attacker could use this flaw to perform various types of spoofing attacks on web service endpoints secured by WSS4J that rely on SAML for authentication.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Data Virtualization 6.1
Red Hat / Red Hat JBoss Data Virtualization
|
cpe:/a:redhat:jboss_data_virtualization:6.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that the RESTEasy DocumentProvider did not set the external-parameter-entities and external-general-entities features appropriately, thus allowing external entity expansion. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XML eXternal Entity (XXE) attacks.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Data Virtualization 6.1
Red Hat / Red Hat JBoss Data Virtualization
|
cpe:/a:redhat:jboss_data_virtualization:6.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was discovered that under specific conditions the conversation state information stored in a thread-local variable in JBoss Weld was not sanitized correctly when the conversation ended. This could lead to a race condition that could potentially expose sensitive information from a previous conversation to the current conversation.
2.1 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Data Virtualization 6.1
Red Hat / Red Hat JBoss Data Virtualization
|
cpe:/a:redhat:jboss_data_virtualization:6.1
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
References
104 references
Acknowledgments
Red Hat Product Security
Florian Weimer
Red Hat Product Security
David Jorm
Typesafe
James Roper
Alexander Papadakis
JProfessionals
Rune Steinseth
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Data Virtualization 6.1.0, which fixes multiple security\nissues and various bugs, is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Data Virtualization is a lean data integration solution that\nprovides easy, real-time, and unified data access across disparate sources\nto multiple applications and users. JBoss Data Virtualization makes data\nspread across physically distinct systems\u2014such as multiple databases, XML\nfiles, and even Hadoop systems\u2014appear as a set of tables in a local\ndatabase.\n\nThe release of Red Hat JBoss Data Virtualization 6.1.0 serves as a\nreplacement for Red Hat JBoss Data Virtualization 6.0.0. It includes\nvarious bug fixes, which are listed in the README file included with the\npatch files.\n\nThe following security issues are also fixed with this release,\ndescriptions of which can be found on the respective CVE pages linked in\nthe References section.\n\nCVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname\nverification bypass, incomplete CVE-2012-5783 fix\n\nCVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname\nverification bypass, incomplete CVE-2012-6153 fix\n\nCVE-2013-4002 Xerces-J2 OpenJDK: XML parsing Denial of Service (JAXP,\n8017298)\n\nCVE-2013-4517 Apache Santuario XML Security for Java: Java XML Signature\nDoS Attack\n\nCVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of\nuser-supplied content in outputText tags and EL expressions\n\nCVE-2014-0059 JBossSX/PicketBox: World readable audit.log file\n\nCVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding\ninput filter\n\nCVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs\n\nCVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content\nlength header\n\nCVE-2014-0119 Tomcat/JBossWeb: XML parser hijack by malicious web\napplication\n\nCVE-2014-0193 netty: DoS via memory exhaustion during data aggregation\n\nCVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding\ninput filter\n\nCVE-2014-3481 JBoss AS JAX-RS: Information disclosure via XML eXternal\nEntity (XXE)\n\nCVE-2014-3490 RESTEasy: XXE via parameter entities\n\nCVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage\n\nCVE-2014-3623 Apache WSS4J / Apache CXF: Improper security semantics\nenforcement of SAML SubjectConfirmation methods\n\nCVE-2014-7839 RESTeasy: External entities expanded by DocumentProvider\n\nCVE-2014-8122 JBoss Weld: Limited information disclosure via stale thread\nstate\n\nRed Hat would like to thank James Roper of Typesafe for reporting\nCVE-2014-0193, Alexander Papadakis for reporting CVE-2014-3530, and Rune\nSteinseth of JProfessionals for reporting CVE-2014-8122. The CVE-2012-6153\nissue was discovered by Florian Weimer of Red Hat Product Security, the\nCVE-2014-0075 and CVE-2014-3490 issues were discovered by David Jorm of Red\nHat Product Security, and the CVE-2014-3481 issue was discovered by the Red\nHat JBoss Enterprise Application Platform QE team.\n\nAll users of Red Hat JBoss Data Virtualization 6.0.0 as provided from the\nRed Hat Customer Portal are advised to apply this roll up patch.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:0675",
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform\u0026downloadType=distributions\u0026version=6.1.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform\u0026downloadType=distributions\u0026version=6.1.0"
},
{
"category": "external",
"summary": "1019176",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1019176"
},
{
"category": "external",
"summary": "1045257",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1045257"
},
{
"category": "external",
"summary": "1063642",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063642"
},
{
"category": "external",
"summary": "1065139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
},
{
"category": "external",
"summary": "1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "1105242",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1105242"
},
{
"category": "external",
"summary": "1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "external",
"summary": "1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "1157304",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1157304"
},
{
"category": "external",
"summary": "1165328",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1165328"
},
{
"category": "external",
"summary": "1169237",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1169237"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0675.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.1.0 update",
"tracking": {
"current_release_date": "2026-05-14T22:17:49+00:00",
"generator": {
"date": "2026-05-14T22:17:49+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.0"
}
},
"id": "RHSA-2015:0675",
"initial_release_date": "2015-03-11T16:51:20+00:00",
"revision_history": [
{
"date": "2015-03-11T16:51:20+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:35:38+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-14T22:17:49+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Data Virtualization 6.1",
"product": {
"name": "Red Hat JBoss Data Virtualization 6.1",
"product_id": "Red Hat JBoss Data Virtualization 6.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_data_virtualization:6.1"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Data Virtualization"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Florian Weimer"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2012-6153",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2012-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129916"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-6153"
},
{
"category": "external",
"summary": "RHBZ#1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
}
],
"release_date": "2014-08-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
},
{
"cve": "CVE-2013-4002",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2013-10-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1019176"
}
],
"notes": [
{
"category": "description",
"text": "A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: XML parsing Denial of Service (JAXP, 8017298)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Fuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Server 4 and 5; Red Hat JBoss Enterprise Web Platform 5; Red Hat JBoss SOA Platform 4 and 5; and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4002"
},
{
"category": "external",
"summary": "RHBZ#1019176",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1019176"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4002",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html"
}
],
"release_date": "2013-10-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: XML parsing Denial of Service (JAXP, 8017298)"
},
{
"cve": "CVE-2013-4517",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2013-12-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1045257"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the Apache Santuario XML Security for Java project allowed Document Type Definitions (DTDs) to be processed when applying Transforms even when secure validation was enabled. A remote attacker could use this flaw to exhaust all available memory on the system, causing a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Java: Java XML Signature DoS Attack",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Fuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4, Fuse Mediation Router 2.7, 2.8 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nFuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 4; Red Hat JBoss Enterprise Data Services Platform 5; Red Hat JBoss Enterprise Portal Platform 4 and 5; and Red Hat JBoss Enterprise SOA Platform 4 and 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4517"
},
{
"category": "external",
"summary": "RHBZ#1045257",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1045257"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4517",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4517"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4517",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4517"
}
],
"release_date": "2013-11-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Java: Java XML Signature DoS Attack"
},
{
"cve": "CVE-2013-5855",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2014-02-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1065139"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Mojarra JavaServer Faces did not properly escape user-supplied content in certain circumstances. Contents of outputText tags and raw EL expressions that immediately follow script or style elements were not escaped. A remote attacker could use a specially crafted URL to execute arbitrary web script in the user\u0027s browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-5855"
},
{
"category": "external",
"summary": "RHBZ#1065139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-5855",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5855"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855"
},
{
"category": "external",
"summary": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209",
"url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209"
}
],
"release_date": "2014-02-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions"
},
{
"cve": "CVE-2014-0059",
"cwe": {
"id": "CWE-532",
"name": "Insertion of Sensitive Information into Log File"
},
"discovery_date": "2014-02-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1063642"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the security auditing functionality provided by PicketBox and JBossSX, both security frameworks for Java applications, used a world-readable audit.log file to record sensitive information. A local user could possibly use this flaw to gain access to the sensitive information in the audit.log file.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JBossSX/PicketBox: World readable audit.log file",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0059"
},
{
"category": "external",
"summary": "RHBZ#1063642",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063642"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0059",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0059"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0059",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0059"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "JBossSX/PicketBox: World readable audit.log file"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0075",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1072776"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0075"
},
{
"category": "external",
"summary": "RHBZ#1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter"
},
{
"cve": "CVE-2014-0096",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1088342"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0096"
},
{
"category": "external",
"summary": "RHBZ#1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs"
},
{
"cve": "CVE-2014-0099",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102030"
}
],
"notes": [
{
"category": "description",
"text": "It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Request smuggling via malicious content length header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0099"
},
{
"category": "external",
"summary": "RHBZ#1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Request smuggling via malicious content length header"
},
{
"cve": "CVE-2014-0119",
"cwe": {
"id": "CWE-470",
"name": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102038"
}
],
"notes": [
{
"category": "description",
"text": "It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XML parser hijack by malicious web application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0119"
},
{
"category": "external",
"summary": "RHBZ#1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0119",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0119"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XML parser hijack by malicious web application"
},
{
"acknowledgments": [
{
"names": [
"James Roper"
],
"organization": "Typesafe"
}
],
"cve": "CVE-2014-0193",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-04-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1092783"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: DoS via memory exhaustion during data aggregation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0193"
},
{
"category": "external",
"summary": "RHBZ#1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0193",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193"
}
],
"release_date": "2014-05-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "netty: DoS via memory exhaustion during data aggregation"
},
{
"cve": "CVE-2014-0227",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109196"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0227"
},
{
"category": "external",
"summary": "RHBZ#1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0227",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43",
"url": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55",
"url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55"
}
],
"release_date": "2015-02-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter"
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3481",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1105242"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the default context parameters as provided to RESTEasy deployments by JBoss EAP did not explicitly disable external entity expansion for RESTEasy. A remote attacker could use this flaw to perform XML External Entity (XXE) attacks on RESTEasy applications accepting XML input.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JAX-RS: Information disclosure via XML eXternal Entity (XXE)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3481"
},
{
"category": "external",
"summary": "RHBZ#1105242",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1105242"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3481",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3481"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3481",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3481"
}
],
"release_date": "2014-06-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "JAX-RS: Information disclosure via XML eXternal Entity (XXE)"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3490",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1107901"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTEasy: XXE via parameter entities",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3490"
},
{
"category": "external",
"summary": "RHBZ#1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3490",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3490"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490"
}
],
"release_date": "2014-07-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTEasy: XXE via parameter entities"
},
{
"acknowledgments": [
{
"names": [
"Alexander Papadakis"
]
}
],
"cve": "CVE-2014-3530",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1112987"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "PicketLink: XXE via insecure DocumentBuilderFactory usage",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw could allow remote, unauthenticated attackers to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. All systems hosting PicketLink applications using SAML Identity Providers and Service Providers may be affected. It is strongly advised that anyone running an affected system applies patches to address this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3530"
},
{
"category": "external",
"summary": "RHBZ#1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3530",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3530"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530"
}
],
"release_date": "2014-07-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "PicketLink: XXE via insecure DocumentBuilderFactory usage"
},
{
"cve": "CVE-2014-3577",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2014-08-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129074"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3577"
},
{
"category": "external",
"summary": "RHBZ#1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
}
],
"release_date": "2014-08-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
},
{
"cve": "CVE-2014-3578",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2014-08-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1131882"
}
],
"notes": [
{
"category": "description",
"text": "A directory traversal flaw was found in the Spring Framework. A remote attacker could use this flaw to access arbitrary files on a server, and bypassing security restrictions that are otherwise in place.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Framework: Directory traversal",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3578"
},
{
"category": "external",
"summary": "RHBZ#1131882",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131882"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3578",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3578"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3578",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3578"
},
{
"category": "external",
"summary": "http://www.pivotal.io/security/cve-2014-3578",
"url": "http://www.pivotal.io/security/cve-2014-3578"
},
{
"category": "external",
"summary": "https://jvn.jp/en/jp/JVN49154900/",
"url": "https://jvn.jp/en/jp/JVN49154900/"
}
],
"release_date": "2014-09-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Framework: Directory traversal"
},
{
"cve": "CVE-2014-3623",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2014-10-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1157304"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Apache WSS4J (Web Services Security for Java), as used by Apache CXF with the TransportBinding, did not, by default, properly enforce all security requirements associated with SAML SubjectConfirmation methods. A remote attacker could use this flaw to perform various types of spoofing attacks on web service endpoints secured by WSS4J that rely on SAML for authentication.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Fuse ESB Enterprise 7 is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss SOA Platform 5 and Red Hat JBoss BRMS 5 are now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware Product Life Cycle: https://access.redhat.com/support/policy/updates/jboss_notes/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3623"
},
{
"category": "external",
"summary": "RHBZ#1157304",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1157304"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3623",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3623"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3623",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3623"
}
],
"release_date": "2014-10-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods"
},
{
"cve": "CVE-2014-7839",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-11-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1165328"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the RESTEasy DocumentProvider did not set the external-parameter-entities and external-general-entities features appropriately, thus allowing external entity expansion. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XML eXternal Entity (XXE) attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTeasy: External entities expanded by DocumentProvider",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Web Framework Kit has moved out of maintenance phase and is no longer supported by Red Hat Product Security. This issue is not currently planned to be addressed in any future updates. For additional information, refer to the Red Hat JBoss Middleware Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-7839"
},
{
"category": "external",
"summary": "RHBZ#1165328",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1165328"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-7839",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-7839"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-7839",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7839"
}
],
"release_date": "2014-11-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTeasy: External entities expanded by DocumentProvider"
},
{
"acknowledgments": [
{
"names": [
"Rune Steinseth"
],
"organization": "JProfessionals"
}
],
"cve": "CVE-2014-8122",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2014-11-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1169237"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that under specific conditions the conversation state information stored in a thread-local variable in JBoss Weld was not sanitized correctly when the conversation ended. This could lead to a race condition that could potentially expose sensitive information from a previous conversation to the current conversation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Weld: Limited information disclosure via stale thread state",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-8122"
},
{
"category": "external",
"summary": "RHBZ#1169237",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1169237"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-8122",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-8122"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-8122",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8122"
}
],
"release_date": "2014-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Weld: Limited information disclosure via stale thread state"
}
]
}
RHSA-2015:0720
Vulnerability from csaf_redhat - Published: 2015-03-24 21:05 - Updated: 2026-05-14 22:17Summary
Red Hat Security Advisory: Red Hat JBoss Fuse Service Works 6.0.0 security update
Severity
Important
Notes
Topic: Red Hat JBoss Fuse Service Works 6.0.0 roll up patch 4, which fixes
multiple security issues and various bugs, is now available from the Red
Hat Customer Portal.
Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details: Red Hat JBoss Fuse Service Works is the next-generation ESB and business
process automation infrastructure.
This roll up patch serves as a cumulative upgrade for Red Hat JBoss Fuse
Service Works 6.0.0. It includes various bug fixes, which are listed in the
README file included with the patch files.
The following security issues are also fixed with this release,
descriptions of which can be found on the respective CVE pages linked in
the References section.
CVE-2012-6153 Apache HttpComponents client: SSL hostname verification
bypass, incomplete CVE-2012-5783 fix
CVE-2014-3577 Apache HttpComponents client: SSL hostname verification
bypass, incomplete CVE-2012-6153 fix
CVE-2014-3625 spring: Spring Framework: directory traversal flaw
CVE-2014-3578 spring: Spring Framework: Directory traversal
CVE-2014-3558 hibernate-validator: Hibernate Validator: JSM bypass via
ReflectionHelper
CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage
CVE-2014-3490 RESTEasy: XXE via parameter entities
CVE-2014-3481 jboss-as-jaxrs: JBoss AS JAX-RS: Information disclosure via
XML eXternal Entity (XXE)
CVE-2014-3472 jboss-as-controller: JBoss AS Security: Invalid EJB caller
role check implementation
CVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding
input filter
CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation
CVE-2014-0119 jbossweb: Apache Tomcat 6: XML parser hijack by malicious web
application
CVE-2014-0099 jbossweb: Apache Tomcat: Request smuggling via malicious
content length header
CVE-2014-0096 jbossweb: Apache Tomcat: XXE vulnerability via user supplied
XSLTs
CVE-2014-0075 jbossweb: tomcat: Limited DoS in chunked transfer encoding
input filter
CVE-2014-0005 security: PicketBox/JBossSX: Unauthorized access to and
modification of application server configuration and state by application
CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of
user-supplied content in outputText tags and EL expressions
CVE-2013-4002 xerces-j2: Xerces-J2 OpenJDK: XML parsing Denial of Service
(JAXP, 8017298)
Red Hat would like to thank James Roper of Typesafe for reporting the
CVE-2014-0193 issue; CA Technologies for reporting the CVE-2014-3472
issue; and Alexander Papadakis for reporting the CVE-2014-3530 issue. The
CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat Product
Security; the CVE-2014-0005 issue was discovered by Josef Cacek of the Red
Hat JBoss EAP Quality Engineering team; the CVE-2014-3481 issue was
discovered by the Red Hat JBoss Enterprise Application Platform QE team;
and the CVE-2014-0075 and CVE-2014-3490 issues were discovered by David
Jorm of Red Hat Product Security.
All users of Red Hat JBoss Fuse Service Works 6.0.0 as provided from the
Red Hat Customer Portal are advised to apply this roll up patch.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.
5.8 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Fuse Service Works 6.0
Red Hat / Red Hat JBoss Fuse Service Works
|
cpe:/a:redhat:jboss_fuse_service_works:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Fuse Service Works 6.0
Red Hat / Red Hat JBoss Fuse Service Works
|
cpe:/a:redhat:jboss_fuse_service_works:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that Mojarra JavaServer Faces did not properly escape user-supplied content in certain circumstances. Contents of outputText tags and raw EL expressions that immediately follow script or style elements were not escaped. A remote attacker could use a specially crafted URL to execute arbitrary web script in the user's browser.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Fuse Service Works 6.0
Red Hat / Red Hat JBoss Fuse Service Works
|
cpe:/a:redhat:jboss_fuse_service_works:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was identified that PicketBox/JBossSX allowed any deployed application to alter or read the underlying application server configuration and state without any authorization checks. An attacker able to deploy applications could use this flaw to circumvent security constraints applied to other applications deployed on the same system, disclose privileged information, and in certain cases allow arbitrary code execution.
3.6 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Fuse Service Works 6.0
Red Hat / Red Hat JBoss Fuse Service Works
|
cpe:/a:redhat:jboss_fuse_service_works:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Fuse Service Works 6.0
Red Hat / Red Hat JBoss Fuse Service Works
|
cpe:/a:redhat:jboss_fuse_service_works:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.
2.1 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Fuse Service Works 6.0
Red Hat / Red Hat JBoss Fuse Service Works
|
cpe:/a:redhat:jboss_fuse_service_works:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.
5.8 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Fuse Service Works 6.0
Red Hat / Red Hat JBoss Fuse Service Works
|
cpe:/a:redhat:jboss_fuse_service_works:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.
2.1 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Fuse Service Works 6.0
Red Hat / Red Hat JBoss Fuse Service Works
|
cpe:/a:redhat:jboss_fuse_service_works:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Fuse Service Works 6.0
Red Hat / Red Hat JBoss Fuse Service Works
|
cpe:/a:redhat:jboss_fuse_service_works:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.
4.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Fuse Service Works 6.0
Red Hat / Red Hat JBoss Fuse Service Works
|
cpe:/a:redhat:jboss_fuse_service_works:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that the isCallerInRole() method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles.
2.1 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Fuse Service Works 6.0
Red Hat / Red Hat JBoss Fuse Service Works
|
cpe:/a:redhat:jboss_fuse_service_works:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
It was found that the default context parameters as provided to RESTEasy deployments by JBoss EAP did not explicitly disable external entity expansion for RESTEasy. A remote attacker could use this flaw to perform XML External Entity (XXE) attacks on RESTEasy applications accepting XML input.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Fuse Service Works 6.0
Red Hat / Red Hat JBoss Fuse Service Works
|
cpe:/a:redhat:jboss_fuse_service_works:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Fuse Service Works 6.0
Red Hat / Red Hat JBoss Fuse Service Works
|
cpe:/a:redhat:jboss_fuse_service_works:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
7.5 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Fuse Service Works 6.0
Red Hat / Red Hat JBoss Fuse Service Works
|
cpe:/a:redhat:jboss_fuse_service_works:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
It was discovered that the implementation of org.hibernate.validator.util.ReflectionHelper together with the permissions required to run Hibernate Validator under the Java Security Manager could allow a malicious application deployed in the same application container to execute several actions with escalated privileges, which might otherwise not be possible. This flaw could be used to perform various attacks, including but not restricted to, arbitrary code execution in systems that are otherwise secured by the Java Security Manager.
3.3 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Fuse Service Works 6.0
Red Hat / Red Hat JBoss Fuse Service Works
|
cpe:/a:redhat:jboss_fuse_service_works:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.
4.8 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Fuse Service Works 6.0
Red Hat / Red Hat JBoss Fuse Service Works
|
cpe:/a:redhat:jboss_fuse_service_works:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A directory traversal flaw was found in the Spring Framework. A remote attacker could use this flaw to access arbitrary files on a server, and bypassing security restrictions that are otherwise in place.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Fuse Service Works 6.0
Red Hat / Red Hat JBoss Fuse Service Works
|
cpe:/a:redhat:jboss_fuse_service_works:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
A directory traversal flaw was found in the way the Spring Framework sanitized certain URLs. A remote attacker could use this flaw to obtain any file on the file system that was also accessible to the process in which the Spring web application was running.
5.0 ()
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Fuse Service Works 6.0
Red Hat / Red Hat JBoss Fuse Service Works
|
cpe:/a:redhat:jboss_fuse_service_works:6.0
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
100 references
Acknowledgments
Red Hat Product Security
Florian Weimer
Red Hat JBoss EAP Quality Engineering team
Josef Cacek
Red Hat Product Security
David Jorm
Typesafe
James Roper
CA Technologies
Alexander Papadakis
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Fuse Service Works 6.0.0 roll up patch 4, which fixes\nmultiple security issues and various bugs, is now available from the Red\nHat Customer Portal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Fuse Service Works is the next-generation ESB and business\nprocess automation infrastructure.\n\nThis roll up patch serves as a cumulative upgrade for Red Hat JBoss Fuse\nService Works 6.0.0. It includes various bug fixes, which are listed in the\nREADME file included with the patch files.\n\nThe following security issues are also fixed with this release,\ndescriptions of which can be found on the respective CVE pages linked in\nthe References section.\n\nCVE-2012-6153 Apache HttpComponents client: SSL hostname verification\nbypass, incomplete CVE-2012-5783 fix\n\nCVE-2014-3577 Apache HttpComponents client: SSL hostname verification\nbypass, incomplete CVE-2012-6153 fix\n\nCVE-2014-3625 spring: Spring Framework: directory traversal flaw\n\nCVE-2014-3578 spring: Spring Framework: Directory traversal\n\nCVE-2014-3558 hibernate-validator: Hibernate Validator: JSM bypass via\nReflectionHelper\n\nCVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage\n\nCVE-2014-3490 RESTEasy: XXE via parameter entities\n\nCVE-2014-3481 jboss-as-jaxrs: JBoss AS JAX-RS: Information disclosure via\nXML eXternal Entity (XXE)\n\nCVE-2014-3472 jboss-as-controller: JBoss AS Security: Invalid EJB caller\nrole check implementation\n\nCVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding\ninput filter\n\nCVE-2014-0193 netty: DoS via memory exhaustion during data aggregation\n\nCVE-2014-0119 jbossweb: Apache Tomcat 6: XML parser hijack by malicious web\napplication\n\nCVE-2014-0099 jbossweb: Apache Tomcat: Request smuggling via malicious\ncontent length header\n\nCVE-2014-0096 jbossweb: Apache Tomcat: XXE vulnerability via user supplied\nXSLTs\n\nCVE-2014-0075 jbossweb: tomcat: Limited DoS in chunked transfer encoding\ninput filter\n\nCVE-2014-0005 security: PicketBox/JBossSX: Unauthorized access to and\nmodification of application server configuration and state by application\n\nCVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of\nuser-supplied content in outputText tags and EL expressions\n\nCVE-2013-4002 xerces-j2: Xerces-J2 OpenJDK: XML parsing Denial of Service\n(JAXP, 8017298)\n\nRed Hat would like to thank James Roper of Typesafe for reporting the\nCVE-2014-0193 issue; CA Technologies for reporting the CVE-2014-3472\nissue; and Alexander Papadakis for reporting the CVE-2014-3530 issue. The\nCVE-2012-6153 issue was discovered by Florian Weimer of Red Hat Product\nSecurity; the CVE-2014-0005 issue was discovered by Josef Cacek of the Red\nHat JBoss EAP Quality Engineering team; the CVE-2014-3481 issue was\ndiscovered by the Red Hat JBoss Enterprise Application Platform QE team;\nand the CVE-2014-0075 and CVE-2014-3490 issues were discovered by David\nJorm of Red Hat Product Security.\n\nAll users of Red Hat JBoss Fuse Service Works 6.0.0 as provided from the\nRed Hat Customer Portal are advised to apply this roll up patch.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:0720",
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse.serviceworks\u0026downloadType=securityPatches\u0026version=6.0.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse.serviceworks\u0026downloadType=securityPatches\u0026version=6.0.0"
},
{
"category": "external",
"summary": "1019176",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1019176"
},
{
"category": "external",
"summary": "1049736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049736"
},
{
"category": "external",
"summary": "1065139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
},
{
"category": "external",
"summary": "1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "1103815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103815"
},
{
"category": "external",
"summary": "1105242",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1105242"
},
{
"category": "external",
"summary": "1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "external",
"summary": "1120495",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120495"
},
{
"category": "external",
"summary": "1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "1131882",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131882"
},
{
"category": "external",
"summary": "1165936",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1165936"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0720.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Fuse Service Works 6.0.0 security update",
"tracking": {
"current_release_date": "2026-05-14T22:17:50+00:00",
"generator": {
"date": "2026-05-14T22:17:50+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.0"
}
},
"id": "RHSA-2015:0720",
"initial_release_date": "2015-03-24T21:05:53+00:00",
"revision_history": [
{
"date": "2015-03-24T21:05:53+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:36:11+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-14T22:17:50+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Fuse Service Works 6.0",
"product": {
"name": "Red Hat JBoss Fuse Service Works 6.0",
"product_id": "Red Hat JBoss Fuse Service Works 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_fuse_service_works:6.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Fuse Service Works"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Florian Weimer"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2012-6153",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2012-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129916"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-6153"
},
{
"category": "external",
"summary": "RHBZ#1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
}
],
"release_date": "2014-08-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
},
{
"cve": "CVE-2013-4002",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2013-10-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1019176"
}
],
"notes": [
{
"category": "description",
"text": "A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: XML parsing Denial of Service (JAXP, 8017298)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Fuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Server 4 and 5; Red Hat JBoss Enterprise Web Platform 5; Red Hat JBoss SOA Platform 4 and 5; and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4002"
},
{
"category": "external",
"summary": "RHBZ#1019176",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1019176"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4002",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html"
}
],
"release_date": "2013-10-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: XML parsing Denial of Service (JAXP, 8017298)"
},
{
"cve": "CVE-2013-5855",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2014-02-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1065139"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Mojarra JavaServer Faces did not properly escape user-supplied content in certain circumstances. Contents of outputText tags and raw EL expressions that immediately follow script or style elements were not escaped. A remote attacker could use a specially crafted URL to execute arbitrary web script in the user\u0027s browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-5855"
},
{
"category": "external",
"summary": "RHBZ#1065139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-5855",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5855"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855"
},
{
"category": "external",
"summary": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209",
"url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209"
}
],
"release_date": "2014-02-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions"
},
{
"acknowledgments": [
{
"names": [
"Josef Cacek"
],
"organization": "Red Hat JBoss EAP Quality Engineering team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0005",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2014-01-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049736"
}
],
"notes": [
{
"category": "description",
"text": "It was identified that PicketBox/JBossSX allowed any deployed application to alter or read the underlying application server configuration and state without any authorization checks. An attacker able to deploy applications could use this flaw to circumvent security constraints applied to other applications deployed on the same system, disclose privileged information, and in certain cases allow arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0005"
},
{
"category": "external",
"summary": "RHBZ#1049736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0005",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0005"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0005",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0005"
}
],
"release_date": "2014-03-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 3.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0075",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1072776"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0075"
},
{
"category": "external",
"summary": "RHBZ#1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter"
},
{
"cve": "CVE-2014-0096",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1088342"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0096"
},
{
"category": "external",
"summary": "RHBZ#1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs"
},
{
"cve": "CVE-2014-0099",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102030"
}
],
"notes": [
{
"category": "description",
"text": "It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Request smuggling via malicious content length header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0099"
},
{
"category": "external",
"summary": "RHBZ#1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Request smuggling via malicious content length header"
},
{
"cve": "CVE-2014-0119",
"cwe": {
"id": "CWE-470",
"name": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102038"
}
],
"notes": [
{
"category": "description",
"text": "It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XML parser hijack by malicious web application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0119"
},
{
"category": "external",
"summary": "RHBZ#1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0119",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0119"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XML parser hijack by malicious web application"
},
{
"acknowledgments": [
{
"names": [
"James Roper"
],
"organization": "Typesafe"
}
],
"cve": "CVE-2014-0193",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-04-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1092783"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: DoS via memory exhaustion during data aggregation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0193"
},
{
"category": "external",
"summary": "RHBZ#1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0193",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193"
}
],
"release_date": "2014-05-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "netty: DoS via memory exhaustion during data aggregation"
},
{
"cve": "CVE-2014-0227",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109196"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0227"
},
{
"category": "external",
"summary": "RHBZ#1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0227",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43",
"url": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55",
"url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55"
}
],
"release_date": "2015-02-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter"
},
{
"acknowledgments": [
{
"names": [
"CA Technologies"
]
}
],
"cve": "CVE-2014-3472",
"cwe": {
"id": "CWE-184",
"name": "Incomplete List of Disallowed Inputs"
},
"discovery_date": "2014-05-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1103815"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the isCallerInRole() method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Security: Invalid EJB caller role check implementation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3472"
},
{
"category": "external",
"summary": "RHBZ#1103815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3472",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3472"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3472",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3472"
}
],
"release_date": "2014-08-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Security: Invalid EJB caller role check implementation"
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3481",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1105242"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the default context parameters as provided to RESTEasy deployments by JBoss EAP did not explicitly disable external entity expansion for RESTEasy. A remote attacker could use this flaw to perform XML External Entity (XXE) attacks on RESTEasy applications accepting XML input.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JAX-RS: Information disclosure via XML eXternal Entity (XXE)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3481"
},
{
"category": "external",
"summary": "RHBZ#1105242",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1105242"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3481",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3481"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3481",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3481"
}
],
"release_date": "2014-06-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "JAX-RS: Information disclosure via XML eXternal Entity (XXE)"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3490",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1107901"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTEasy: XXE via parameter entities",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3490"
},
{
"category": "external",
"summary": "RHBZ#1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3490",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3490"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490"
}
],
"release_date": "2014-07-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTEasy: XXE via parameter entities"
},
{
"acknowledgments": [
{
"names": [
"Alexander Papadakis"
]
}
],
"cve": "CVE-2014-3530",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1112987"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "PicketLink: XXE via insecure DocumentBuilderFactory usage",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw could allow remote, unauthenticated attackers to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. All systems hosting PicketLink applications using SAML Identity Providers and Service Providers may be affected. It is strongly advised that anyone running an affected system applies patches to address this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3530"
},
{
"category": "external",
"summary": "RHBZ#1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3530",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3530"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530"
}
],
"release_date": "2014-07-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "PicketLink: XXE via insecure DocumentBuilderFactory usage"
},
{
"cve": "CVE-2014-3558",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"discovery_date": "2014-07-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1120495"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the implementation of org.hibernate.validator.util.ReflectionHelper together with the permissions required to run Hibernate Validator under the Java Security Manager could allow a malicious application deployed in the same application container to execute several actions with escalated privileges, which might otherwise not be possible. This flaw could be used to perform various attacks, including but not restricted to, arbitrary code execution in systems that are otherwise secured by the Java Security Manager.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Validator: JSM bypass via ReflectionHelper",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3558"
},
{
"category": "external",
"summary": "RHBZ#1120495",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120495"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3558",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3558"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3558",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3558"
}
],
"release_date": "2014-07-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Validator: JSM bypass via ReflectionHelper"
},
{
"cve": "CVE-2014-3577",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2014-08-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129074"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3577"
},
{
"category": "external",
"summary": "RHBZ#1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
}
],
"release_date": "2014-08-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
},
{
"cve": "CVE-2014-3578",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2014-08-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1131882"
}
],
"notes": [
{
"category": "description",
"text": "A directory traversal flaw was found in the Spring Framework. A remote attacker could use this flaw to access arbitrary files on a server, and bypassing security restrictions that are otherwise in place.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Framework: Directory traversal",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3578"
},
{
"category": "external",
"summary": "RHBZ#1131882",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131882"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3578",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3578"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3578",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3578"
},
{
"category": "external",
"summary": "http://www.pivotal.io/security/cve-2014-3578",
"url": "http://www.pivotal.io/security/cve-2014-3578"
},
{
"category": "external",
"summary": "https://jvn.jp/en/jp/JVN49154900/",
"url": "https://jvn.jp/en/jp/JVN49154900/"
}
],
"release_date": "2014-09-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Framework: Directory traversal"
},
{
"cve": "CVE-2014-3625",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2014-11-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1165936"
}
],
"notes": [
{
"category": "description",
"text": "A directory traversal flaw was found in the way the Spring Framework sanitized certain URLs. A remote attacker could use this flaw to obtain any file on the file system that was also accessible to the process in which the Spring web application was running.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Framework: directory traversal flaw",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3625"
},
{
"category": "external",
"summary": "RHBZ#1165936",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1165936"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3625",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3625"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3625",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3625"
}
],
"release_date": "2014-11-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Framework: directory traversal flaw"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…