{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "JBoss Enterprise Data Services Platform 5.3.0 roll up patch 1, which fixes\none security issue and various bugs, is now available from the Red Hat\nCustomer Portal.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "JBoss Enterprise Data Services Platform extends JBoss Enterprise SOA\nPlatform to provide services for data virtualization, federation, and\nintegration.\n\nThis roll up patch serves as a cumulative upgrade for JBoss Enterprise Data\nServices Platform 5.3.0. It includes various bug fixes. The following\nsecurity issue is also fixed with this release:\n\nIt was found that the Teiid JDBC (Java Database Connectivity) socket did\nnot encrypt client log in messages by default. A man-in-the-middle\nattacker could use this flaw to obtain log in credentials and other JDBC\ntraffic. (CVE-2012-3431)\n\nThis issue was discovered by Steven Hawkins of Red Hat.\n\nAll users of JBoss Enterprise Data Services Platform 5.3.0 as provided from\nthe Red Hat Customer Portal are advised to apply this roll up patch.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2012:1301",
        "url": "https://access.redhat.com/errata/RHSA-2012:1301"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform\u0026downloadType=securityPatches\u0026version=5.3.0+GA",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform\u0026downloadType=securityPatches\u0026version=5.3.0+GA"
      },
      {
        "category": "external",
        "summary": "843669",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=843669"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1301.json"
      }
    ],
    "title": "Red Hat Security Advisory: JBoss Enterprise Data Services Platform 5.3.0 update",
    "tracking": {
      "current_release_date": "2025-11-21T17:41:19+00:00",
      "generator": {
        "date": "2025-11-21T17:41:19+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.12"
        }
      },
      "id": "RHSA-2012:1301",
      "initial_release_date": "2012-09-20T17:20:00+00:00",
      "revision_history": [
        {
          "date": "2012-09-20T17:20:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2012-09-20T17:27:32+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-11-21T17:41:19+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "JBoss Enterprise Data Services Platform 5.3",
                "product": {
                  "name": "JBoss Enterprise Data Services Platform 5.3",
                  "product_id": "JBoss Enterprise Data Services Platform 5.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_data_services:5.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Middleware"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Steven Hawkins"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2012-3431",
      "discovery_date": "2012-07-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "843669"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Teiid Java Database Connectivity (JDBC) socket, as used in JBoss Enterprise Data Services Platform before 5.3.0, does not encrypt login messages by default contrary to documentation and specification, which allows remote attackers to obtain login credentials via a man-in-the-middle (MITM) attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Teiid: JDBC socket does not encrypt client login messages by default",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "JBoss Enterprise Data Services Platform 5.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-3431"
        },
        {
          "category": "external",
          "summary": "RHBZ#843669",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=843669"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-3431",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-3431"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3431",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3431"
        }
      ],
      "release_date": "2012-07-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-09-20T17:20:00+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting JBoss Enterprise Data Services Platform installation (including\nits databases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the JBoss Enterprise Data Services\nPlatform server by stopping the JBoss Application Server process before\ninstalling this update, and then after installing the update, restart the\nJBoss Enterprise Data Services Platform server by starting the JBoss\nApplication Server process.",
          "product_ids": [
            "JBoss Enterprise Data Services Platform 5.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:1301"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "ADJACENT_NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "JBoss Enterprise Data Services Platform 5.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Teiid: JDBC socket does not encrypt client login messages by default"
    }
  ]
}