{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss BRMS 6.0.3 roll up patch 1, which fixes two security issues,\nseveral bugs, and adds various enhancements, is now available from the Red\nHat Customer Portal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss BRMS is a business rules management system for the\nmanagement, storage, creation, modification, and deployment of JBoss Rules.\n\nThis roll up patch serves as a cumulative upgrade for Red Hat JBoss BRMS\n6.0.3, and includes bug fixes and enhancements. It includes various bug\nfixes, which are listed in the README file included with the patch files.\n\nThe following security issues are fixed with this release:\n\nIt was discovered that Jakarta Commons HttpClient incorrectly extracted the\nhost name from an X.509 certificate subject\u0027s Common Name (CN) field.\nA man-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2012-6153, CVE-2014-3577)\n\nThe CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat\nProduct Security.\n\nAll users of Red Hat JBoss BRMS 6.0.3 as provided from the Red Hat Customer\nPortal are advised to apply this roll up patch.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:1891",
        "url": "https://access.redhat.com/errata/RHSA-2014:1891"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=distributions\u0026version=6.0.3",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=distributions\u0026version=6.0.3"
      },
      {
        "category": "external",
        "summary": "1129074",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
      },
      {
        "category": "external",
        "summary": "1129916",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1891.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss BRMS 6.0.3 security update",
    "tracking": {
      "current_release_date": "2026-05-14T22:17:47+00:00",
      "generator": {
        "date": "2026-05-14T22:17:47+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2014:1891",
      "initial_release_date": "2014-11-24T20:46:15+00:00",
      "revision_history": [
        {
          "date": "2014-11-24T20:46:15+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:33:35+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:17:47+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss BRMS 6.0",
                "product": {
                  "name": "Red Hat JBoss BRMS 6.0",
                  "product_id": "Red Hat JBoss BRMS 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_brms:6.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Decision Manager"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Florian Weimer"
          ],
          "organization": "Red Hat Product Security",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2012-6153",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2012-11-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1129916"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BRMS 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "RHBZ#1129916",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
        }
      ],
      "release_date": "2014-08-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-11-24T20:46:15+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss BRMS 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1891"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss BRMS 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
    },
    {
      "cve": "CVE-2014-3577",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2014-08-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1129074"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BRMS 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3577"
        },
        {
          "category": "external",
          "summary": "RHBZ#1129074",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
        }
      ],
      "release_date": "2014-08-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-11-24T20:46:15+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss BRMS 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1891"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss BRMS 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss BPM Suite 6.0.3 roll up patch 1, which fixes two security\nissues, several bugs, and adds various enhancements, is now available from\nthe Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss BPM Suite is a business rules and processes management system\nfor the management, storage, creation, modification, and deployment of\nJBoss rules and BPMN2-compliant business processes.\n\nThis roll up patch serves as a cumulative upgrade for Red Hat JBoss BPM\nSuite 6.0.3, and includes bug fixes and enhancements. It includes various\nbug fixes, which are listed in the README file included with the\npatch files.\n\nThe following security issues are fixed with this release:\n\nIt was discovered that Jakarta Commons HttpClient incorrectly extracted the\nhost name from an X.509 certificate subject\u0027s Common Name (CN) field.\nA man-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2012-6153, CVE-2014-3577)\n\nThe CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat\nProduct Security.\n\nAll users of Red Hat JBoss BPM Suite 6.0.3 as provided from the Red Hat\nCustomer Portal are advised to apply this roll up patch.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:1892",
        "url": "https://access.redhat.com/errata/RHSA-2014:1892"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=distributions\u0026version=6.0.3",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=distributions\u0026version=6.0.3"
      },
      {
        "category": "external",
        "summary": "1129074",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
      },
      {
        "category": "external",
        "summary": "1129916",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1892.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.0.3 update",
    "tracking": {
      "current_release_date": "2026-05-14T22:17:48+00:00",
      "generator": {
        "date": "2026-05-14T22:17:48+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2014:1892",
      "initial_release_date": "2014-11-24T20:46:11+00:00",
      "revision_history": [
        {
          "date": "2014-11-24T20:46:11+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:33:59+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:17:48+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss BPMS 6.0",
                "product": {
                  "name": "Red Hat JBoss BPMS 6.0",
                  "product_id": "Red Hat JBoss BPMS 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_bpms:6.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Process Automation Manager"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Florian Weimer"
          ],
          "organization": "Red Hat Product Security",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2012-6153",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2012-11-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1129916"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BPMS 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "RHBZ#1129916",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
        }
      ],
      "release_date": "2014-08-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-11-24T20:46:11+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss BPMS 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1892"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss BPMS 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
    },
    {
      "cve": "CVE-2014-3577",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2014-08-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1129074"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BPMS 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3577"
        },
        {
          "category": "external",
          "summary": "RHBZ#1129074",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
        }
      ],
      "release_date": "2014-08-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-11-24T20:46:11+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss BPMS 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1892"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss BPMS 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Operations Network 3.2.3, which fixes multiple security\nissues and several bugs, is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Operations Network is a middleware management solution that\nprovides a single point of control to deploy, manage, and monitor JBoss\nEnterprise Middleware, applications, and services.\n\nThis JBoss Operations Network 3.3.0 release serves as a replacement for\nJBoss Operations Network 3.2.3, and includes several bug fixes. Refer to\nthe JBoss Operations Network 3.3.0 Release Notes for information on the\nmost significant of these changes. The Release Notes will be available\nshortly from https://access.redhat.com/documentation/en-US/\n\nThe following security issues are also fixed with this release:\n\nIt was found that the fix for CVE-2012-5783 was incomplete: the code added\nto check that the server host name matches the domain name in a subject\u0027s\nCommon Name (CN) field in X.509 certificates was flawed. A\nman-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2012-6153, CVE-2014-3577)\n\nIt was found that the default context parameters as provided to RESTEasy\ndeployments by JBoss EAP did not explicitly disable external entity\nexpansion for RESTEasy. A remote attacker could use this flaw to perform\nXML External Entity (XXE) attacks on RESTEasy applications accepting XML\ninput. (CVE-2014-3481)\n\nIt was found that the fix for CVE-2012-0818 was incomplete: external\nparameter entities were not disabled when the\nresteasy.document.expand.entity.references parameter was set to false.\nA remote attacker able to send XML requests to a RESTEasy endpoint could\nuse this flaw to read files accessible to the user running the application\nserver, and potentially perform other more advanced XXE attacks.\n(CVE-2014-3490)\n\nThe HawtJNI Library class wrote native libraries to a predictable file name\nin /tmp when the native libraries were bundled in a JAR file, and no custom\nlibrary path was specified. A local attacker could overwrite these native\nlibraries with malicious versions during the window between when HawtJNI\nwrites them and when they are executed. (CVE-2013-2035)\n\nIt was found that the security auditing functionality provided by PicketBox\nand JBossSX, both security frameworks for Java applications, used a\nworld-readable audit.log file to record sensitive information. A local user\ncould possibly use this flaw to gain access to the sensitive information in\nthe audit.log file. (CVE-2014-0059)\n\nThe CVE-2013-2035 and CVE-2012-6153 issues were discovered by Florian\nWeimer of Red Hat Product Security. The CVE-2014-3481 issue was discovered\nby the Red Hat JBoss Enterprise Application Platform QE team. The\nCVE-2014-3490 issue was discovered by David Jorm of Red Hat Product\nSecurity.\n\nAll users of JBoss Operations Network 3.2.3 as provided from the Red Hat\nCustomer Portal are advised to upgrade to JBoss Operations Network 3.3.0.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:1904",
        "url": "https://access.redhat.com/errata/RHSA-2014:1904"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=em\u0026downloadType=securityPatches\u0026version=3.3.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=em\u0026downloadType=securityPatches\u0026version=3.3.0"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Operations_Network/",
        "url": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Operations_Network/"
      },
      {
        "category": "external",
        "summary": "958618",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=958618"
      },
      {
        "category": "external",
        "summary": "1063642",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063642"
      },
      {
        "category": "external",
        "summary": "1105242",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1105242"
      },
      {
        "category": "external",
        "summary": "1107901",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
      },
      {
        "category": "external",
        "summary": "1129074",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
      },
      {
        "category": "external",
        "summary": "1129916",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1904.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Operations Network 3.3.0 update",
    "tracking": {
      "current_release_date": "2026-05-14T22:17:53+00:00",
      "generator": {
        "date": "2026-05-14T22:17:53+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2014:1904",
      "initial_release_date": "2014-11-25T16:48:32+00:00",
      "revision_history": [
        {
          "date": "2014-11-25T16:48:32+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:33:48+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:17:53+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Operations Network 3.3",
                "product": {
                  "name": "Red Hat JBoss Operations Network 3.3",
                  "product_id": "Red Hat JBoss Operations Network 3.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_operations_network:3.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Operations Network"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Florian Weimer"
          ],
          "organization": "Red Hat Product Security",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2012-6153",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2012-11-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1129916"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Operations Network 3.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "RHBZ#1129916",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
        }
      ],
      "release_date": "2014-08-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-11-25T16:48:32+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nRefer to the JBoss Operations Network 3.3.0 Release Notes for\ninstallation information.",
          "product_ids": [
            "Red Hat JBoss Operations Network 3.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1904"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Operations Network 3.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Florian Weimer"
          ],
          "organization": "Red Hat Product Security Team",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2013-2035",
      "cwe": {
        "id": "CWE-377",
        "name": "Insecure Temporary File"
      },
      "discovery_date": "2013-04-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "958618"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The HawtJNI Library class wrote native libraries to a predictable file name in /tmp when the native libraries were bundled in a JAR file, and no custom library path was specified. A local attacker could overwrite these native libraries with malicious versions during the window between when HawtJNI writes them and when they are executed.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "HawtJNI: predictable temporary file name leading to local arbitrary code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Operations Network 3.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-2035"
        },
        {
          "category": "external",
          "summary": "RHBZ#958618",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=958618"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-2035",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-2035"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-2035",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2035"
        }
      ],
      "release_date": "2013-05-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-11-25T16:48:32+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nRefer to the JBoss Operations Network 3.3.0 Release Notes for\ninstallation information.",
          "product_ids": [
            "Red Hat JBoss Operations Network 3.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1904"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Operations Network 3.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "HawtJNI: predictable temporary file name leading to local arbitrary code execution"
    },
    {
      "cve": "CVE-2014-0059",
      "cwe": {
        "id": "CWE-532",
        "name": "Insertion of Sensitive Information into Log File"
      },
      "discovery_date": "2014-02-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1063642"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the security auditing functionality provided by PicketBox and JBossSX, both security frameworks for Java applications, used a world-readable audit.log file to record sensitive information. A local user could possibly use this flaw to gain access to the sensitive information in the audit.log file.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "JBossSX/PicketBox: World readable audit.log file",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Operations Network 3.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0059"
        },
        {
          "category": "external",
          "summary": "RHBZ#1063642",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063642"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0059",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0059"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0059",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0059"
        }
      ],
      "release_date": "2014-05-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-11-25T16:48:32+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nRefer to the JBoss Operations Network 3.3.0 Release Notes for\ninstallation information.",
          "product_ids": [
            "Red Hat JBoss Operations Network 3.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1904"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 2.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Operations Network 3.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "JBossSX/PicketBox: World readable audit.log file"
    },
    {
      "cve": "CVE-2014-0227",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2014-06-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1109196"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Operations Network 3.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0227"
        },
        {
          "category": "external",
          "summary": "RHBZ#1109196",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0227",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0227"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227"
        },
        {
          "category": "external",
          "summary": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43",
          "url": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43"
        },
        {
          "category": "external",
          "summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55",
          "url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55"
        }
      ],
      "release_date": "2015-02-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-11-25T16:48:32+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nRefer to the JBoss Operations Network 3.3.0 Release Notes for\ninstallation information.",
          "product_ids": [
            "Red Hat JBoss Operations Network 3.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1904"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Operations Network 3.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter"
    },
    {
      "acknowledgments": [
        {
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2014-3481",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2014-06-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1105242"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the default context parameters as provided to RESTEasy deployments by JBoss EAP did not explicitly disable external entity expansion for RESTEasy. A remote attacker could use this flaw to perform XML External Entity (XXE) attacks on RESTEasy applications accepting XML input.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "JAX-RS: Information disclosure via XML eXternal Entity (XXE)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Operations Network 3.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3481"
        },
        {
          "category": "external",
          "summary": "RHBZ#1105242",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1105242"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3481",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3481"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3481",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3481"
        }
      ],
      "release_date": "2014-06-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-11-25T16:48:32+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nRefer to the JBoss Operations Network 3.3.0 Release Notes for\ninstallation information.",
          "product_ids": [
            "Red Hat JBoss Operations Network 3.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1904"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Operations Network 3.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "JAX-RS: Information disclosure via XML eXternal Entity (XXE)"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "David Jorm"
          ],
          "organization": "Red Hat Product Security",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2014-3490",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2014-06-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1107901"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "RESTEasy: XXE via parameter entities",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Operations Network 3.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3490"
        },
        {
          "category": "external",
          "summary": "RHBZ#1107901",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3490",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3490"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490"
        }
      ],
      "release_date": "2014-07-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-11-25T16:48:32+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nRefer to the JBoss Operations Network 3.3.0 Release Notes for\ninstallation information.",
          "product_ids": [
            "Red Hat JBoss Operations Network 3.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1904"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Operations Network 3.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "RESTEasy: XXE via parameter entities"
    },
    {
      "cve": "CVE-2014-3577",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2014-08-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1129074"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Operations Network 3.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3577"
        },
        {
          "category": "external",
          "summary": "RHBZ#1129074",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
        }
      ],
      "release_date": "2014-08-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-11-25T16:48:32+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nRefer to the JBoss Operations Network 3.3.0 Release Notes for\ninstallation information.",
          "product_ids": [
            "Red Hat JBoss Operations Network 3.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1904"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Operations Network 3.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated Red Hat JBoss Enterprise Application Platform 6.3.2 packages that\nfix three security issues are now available for Red Hat Enterprise Linux 5,\n6, and 7.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform 6 is a platform for Java\napplications based on JBoss Application Server 7.\n\nIt was discovered that the Apache CXF incorrectly extracted the host name\nfrom an X.509 certificate subject\u0027s Common Name (CN) field.\nA man-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2012-6153, CVE-2014-3577)\n\nIt was found that Apache WSS4J (Web Services Security for Java), as used by\nApache CXF with the TransportBinding, did not, by default, properly enforce\nall security requirements associated with SAML SubjectConfirmation methods.\nA remote attacker could use this flaw to perform various types of spoofing\nattacks on web service endpoints secured by WSS4j that rely on SAML for\nauthentication. (CVE-2014-3623)\n\nThe CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat\nProduct Security.\n\nAll users of Red Hat JBoss Enterprise Application Platform 6.3.2 on Red\nHat Enterprise Linux 5, 6, and 7 are advised to upgrade to these updated\npackages. The JBoss server process must be restarted for the update to\ntake effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:2019",
        "url": "https://access.redhat.com/errata/RHSA-2014:2019"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1129074",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
      },
      {
        "category": "external",
        "summary": "1129916",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
      },
      {
        "category": "external",
        "summary": "1157304",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1157304"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_2019.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.2 security update",
    "tracking": {
      "current_release_date": "2026-05-14T22:17:49+00:00",
      "generator": {
        "date": "2026-05-14T22:17:49+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2014:2019",
      "initial_release_date": "2014-12-18T17:58:44+00:00",
      "revision_history": [
        {
          "date": "2014-12-18T17:58:44+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-12-18T17:58:44+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:17:49+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server",
                  "product_id": "6Server-JBEAP-6.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server",
                  "product_id": "5Server-JBEAP-6.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server",
                  "product_id": "7Server-JBEAP-6.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.noarch",
                "product": {
                  "name": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.noarch",
                  "product_id": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-cxf@2.7.12-1.SP1_redhat_5.1.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.noarch",
                "product": {
                  "name": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.noarch",
                  "product_id": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wss4j@1.6.16-2.redhat_3.1.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.noarch",
                "product": {
                  "name": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.noarch",
                  "product_id": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-cxf@2.7.12-1.SP1_redhat_5.1.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.noarch",
                "product": {
                  "name": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.noarch",
                  "product_id": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wss4j@1.6.16-2.redhat_3.1.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.noarch",
                "product": {
                  "name": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.noarch",
                  "product_id": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-cxf@2.7.12-1.SP1_redhat_5.1.ep6.el7?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.noarch",
                "product": {
                  "name": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.noarch",
                  "product_id": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wss4j@1.6.16-2.redhat_3.1.ep6.el7?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.src",
                "product": {
                  "name": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.src",
                  "product_id": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-cxf@2.7.12-1.SP1_redhat_5.1.ep6.el6?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.src",
                "product": {
                  "name": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.src",
                  "product_id": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wss4j@1.6.16-2.redhat_3.1.ep6.el6?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.src",
                "product": {
                  "name": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.src",
                  "product_id": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-cxf@2.7.12-1.SP1_redhat_5.1.ep6.el5?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.src",
                "product": {
                  "name": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.src",
                  "product_id": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wss4j@1.6.16-2.redhat_3.1.ep6.el5?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.src",
                "product": {
                  "name": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.src",
                  "product_id": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-cxf@2.7.12-1.SP1_redhat_5.1.ep6.el7?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.src",
                "product": {
                  "name": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.src",
                  "product_id": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wss4j@1.6.16-2.redhat_3.1.ep6.el7?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.noarch"
        },
        "product_reference": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.src as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.src"
        },
        "product_reference": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.src",
        "relates_to_product_reference": "5Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.noarch"
        },
        "product_reference": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.src as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.src"
        },
        "product_reference": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.src",
        "relates_to_product_reference": "5Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.noarch"
        },
        "product_reference": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.src as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.src"
        },
        "product_reference": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.src",
        "relates_to_product_reference": "6Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.noarch"
        },
        "product_reference": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.src as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.src"
        },
        "product_reference": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.src",
        "relates_to_product_reference": "6Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server",
          "product_id": "7Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.noarch"
        },
        "product_reference": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.noarch",
        "relates_to_product_reference": "7Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.src as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server",
          "product_id": "7Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.src"
        },
        "product_reference": "apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.src",
        "relates_to_product_reference": "7Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server",
          "product_id": "7Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.noarch"
        },
        "product_reference": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.noarch",
        "relates_to_product_reference": "7Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.src as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server",
          "product_id": "7Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.src"
        },
        "product_reference": "wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.src",
        "relates_to_product_reference": "7Server-JBEAP-6.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Florian Weimer"
          ],
          "organization": "Red Hat Product Security",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2012-6153",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2012-11-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1129916"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.noarch",
          "5Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.src",
          "5Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.noarch",
          "5Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.src",
          "6Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.noarch",
          "6Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.src",
          "6Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.noarch",
          "6Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.src",
          "7Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.noarch",
          "7Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.src",
          "7Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.noarch",
          "7Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "RHBZ#1129916",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
        }
      ],
      "release_date": "2014-08-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-12-18T17:58:44+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied. Also, back up any customized Red\nHat JBoss Enterprise Application Platform 6 configuration files. On update,\nthe configuration files that have been locally modified will not be\nupdated. The updated version of such files will be stored as the rpmnew\nfiles. Make sure to locate any such files after the update and merge any\nchanges manually.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "5Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.src",
            "5Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.src",
            "6Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.src",
            "6Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.src",
            "7Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.src",
            "7Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:2019"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "5Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.src",
            "5Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.src",
            "6Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.src",
            "6Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.src",
            "7Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.src",
            "7Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
    },
    {
      "cve": "CVE-2014-3577",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2014-08-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1129074"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.noarch",
          "5Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.src",
          "5Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.noarch",
          "5Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.src",
          "6Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.noarch",
          "6Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.src",
          "6Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.noarch",
          "6Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.src",
          "7Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.noarch",
          "7Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.src",
          "7Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.noarch",
          "7Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3577"
        },
        {
          "category": "external",
          "summary": "RHBZ#1129074",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
        }
      ],
      "release_date": "2014-08-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-12-18T17:58:44+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied. Also, back up any customized Red\nHat JBoss Enterprise Application Platform 6 configuration files. On update,\nthe configuration files that have been locally modified will not be\nupdated. The updated version of such files will be stored as the rpmnew\nfiles. Make sure to locate any such files after the update and merge any\nchanges manually.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "5Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.src",
            "5Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.src",
            "6Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.src",
            "6Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.src",
            "7Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.src",
            "7Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:2019"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "5Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.src",
            "5Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.src",
            "6Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.src",
            "6Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.src",
            "7Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.src",
            "7Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
    },
    {
      "cve": "CVE-2014-3623",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2014-10-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1157304"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that Apache WSS4J (Web Services Security for Java), as used by Apache CXF with the TransportBinding, did not, by default, properly enforce all security requirements associated with SAML SubjectConfirmation methods. A remote attacker could use this flaw to perform various types of spoofing attacks on web service endpoints secured by WSS4J that rely on SAML for authentication.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Fuse ESB Enterprise 7 is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss SOA Platform 5 and Red Hat JBoss BRMS 5 are now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware Product Life Cycle: https://access.redhat.com/support/policy/updates/jboss_notes/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.noarch",
          "5Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.src",
          "5Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.noarch",
          "5Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.src",
          "6Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.noarch",
          "6Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.src",
          "6Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.noarch",
          "6Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.src",
          "7Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.noarch",
          "7Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.src",
          "7Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.noarch",
          "7Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3623"
        },
        {
          "category": "external",
          "summary": "RHBZ#1157304",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1157304"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3623",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3623"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3623",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3623"
        }
      ],
      "release_date": "2014-10-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-12-18T17:58:44+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied. Also, back up any customized Red\nHat JBoss Enterprise Application Platform 6 configuration files. On update,\nthe configuration files that have been locally modified will not be\nupdated. The updated version of such files will be stored as the rpmnew\nfiles. Make sure to locate any such files after the update and merge any\nchanges manually.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "5Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.src",
            "5Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.src",
            "6Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.src",
            "6Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.src",
            "7Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.src",
            "7Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:2019"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "5Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el5.src",
            "5Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el5.src",
            "6Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el6.src",
            "6Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el6.src",
            "7Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:apache-cxf-0:2.7.12-1.SP1_redhat_5.1.ep6.el7.src",
            "7Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:wss4j-0:1.6.16-2.redhat_3.1.ep6.el7.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat JBoss Enterprise Application Platform 6.3.2 that\nfixes three security issues is now available from the Red Hat Customer\nPortal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform 6 is a platform for Java\napplications based on JBoss Application Server 7.\n\nIt was discovered that the Apache CXF incorrectly extracted the host name\nfrom an X.509 certificate subject\u0027s Common Name (CN) field.\nA man-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2012-6153, CVE-2014-3577)\n\nIt was found that Apache WSS4J (Web Services Security for Java), as used by\nApache CXF with the TransportBinding, did not, by default, properly enforce\nall security requirements associated with SAML SubjectConfirmation methods.\nA remote attacker could use this flaw to perform various types of spoofing\nattacks on web service endpoints secured by WSS4j that rely on SAML for\nauthentication. (CVE-2014-3623)\n\nThe CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat\nProduct Security.\n\nAll users of Red Hat JBoss Enterprise Application Platform 6.3.2 as\nprovided from the Red Hat Customer Portal are advised to apply this update.\nThe JBoss server process must be restarted for the update to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:2020",
        "url": "https://access.redhat.com/errata/RHSA-2014:2020"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform\u0026downloadType=securityPatches\u0026version=6.3",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform\u0026downloadType=securityPatches\u0026version=6.3"
      },
      {
        "category": "external",
        "summary": "1129074",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
      },
      {
        "category": "external",
        "summary": "1129916",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
      },
      {
        "category": "external",
        "summary": "1157304",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1157304"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_2020.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.2 security update",
    "tracking": {
      "current_release_date": "2026-05-14T22:17:49+00:00",
      "generator": {
        "date": "2026-05-14T22:17:49+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2014:2020",
      "initial_release_date": "2014-12-18T17:48:09+00:00",
      "revision_history": [
        {
          "date": "2014-12-18T17:48:09+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-12-18T17:48:10+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:17:49+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6.3",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6.3",
                  "product_id": "Red Hat JBoss Enterprise Application Platform 6.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Florian Weimer"
          ],
          "organization": "Red Hat Product Security",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2012-6153",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2012-11-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1129916"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 6.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "RHBZ#1129916",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
        }
      ],
      "release_date": "2014-08-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-12-18T17:48:09+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting Red Hat JBoss Enterprise Application Platform installation and\ndeployed applications.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 6.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:2020"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 6.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
    },
    {
      "cve": "CVE-2014-3577",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2014-08-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1129074"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 6.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3577"
        },
        {
          "category": "external",
          "summary": "RHBZ#1129074",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
        }
      ],
      "release_date": "2014-08-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-12-18T17:48:09+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting Red Hat JBoss Enterprise Application Platform installation and\ndeployed applications.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 6.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:2020"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 6.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
    },
    {
      "cve": "CVE-2014-3623",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2014-10-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1157304"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that Apache WSS4J (Web Services Security for Java), as used by Apache CXF with the TransportBinding, did not, by default, properly enforce all security requirements associated with SAML SubjectConfirmation methods. A remote attacker could use this flaw to perform various types of spoofing attacks on web service endpoints secured by WSS4J that rely on SAML for authentication.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Fuse ESB Enterprise 7 is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss SOA Platform 5 and Red Hat JBoss BRMS 5 are now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware Product Life Cycle: https://access.redhat.com/support/policy/updates/jboss_notes/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 6.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3623"
        },
        {
          "category": "external",
          "summary": "RHBZ#1157304",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1157304"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3623",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3623"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3623",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3623"
        }
      ],
      "release_date": "2014-10-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-12-18T17:48:09+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting Red Hat JBoss Enterprise Application Platform installation and\ndeployed applications.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 6.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:2020"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 6.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated devtoolset-2-httpcomponents-client packages that fix one security\nissue are now available for Red Hat Developer Toolset 2.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "HttpClient is an HTTP/1.1 compliant HTTP agent implementation based on\nhttpcomponents HttpCore.\n\nIt was discovered that the HttpClient incorrectly extracted host name from\nan X.509 certificate subject\u0027s Common Name (CN) field. A man-in-the-middle\nattacker could use this flaw to spoof an SSL server using a specially\ncrafted X.509 certificate. (CVE-2012-6153)\n\nThis issue was discovered by Florian Weimer of Red Hat Product Security.\n\nFor additional information on this flaw, refer to the Knowledgebase article\nin the References section.\n\nAll devtoolset-2-httpcomponents-client users are advised to upgrade to\nthese updated packages, which contain a backported patch to correct this\nissue.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:1098",
        "url": "https://access.redhat.com/errata/RHSA-2014:1098"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/1165533",
        "url": "https://access.redhat.com/solutions/1165533"
      },
      {
        "category": "external",
        "summary": "1129916",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1098.json"
      }
    ],
    "title": "Red Hat Security Advisory: devtoolset-2-httpcomponents-client security update",
    "tracking": {
      "current_release_date": "2024-11-14T12:16:29+00:00",
      "generator": {
        "date": "2024-11-14T12:16:29+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2014:1098",
      "initial_release_date": "2014-08-26T16:32:35+00:00",
      "revision_history": [
        {
          "date": "2014-08-26T16:32:35+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-08-26T16:32:35+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T12:16:29+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Developer Toolset 2 for Red Hat Enterprise Linux 6 Server",
                "product": {
                  "name": "Red Hat Developer Toolset 2 for Red Hat Enterprise Linux 6 Server",
                  "product_id": "6Server-RHDevToolset-2.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:developer_toolset:2.1::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Developer Toolset 2 for Red Hat Enterprise Linux 6 Workstation",
                "product": {
                  "name": "Red Hat Developer Toolset 2 for Red Hat Enterprise Linux 6 Workstation",
                  "product_id": "6Workstation-RHDevToolset-2.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:developer_toolset:2.1::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Developer Toolset"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.noarch",
                "product": {
                  "name": "devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.noarch",
                  "product_id": "devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/devtoolset-2-httpcomponents-client@4.2.1-6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "devtoolset-2-httpcomponents-client-javadoc-0:4.2.1-6.el6.noarch",
                "product": {
                  "name": "devtoolset-2-httpcomponents-client-javadoc-0:4.2.1-6.el6.noarch",
                  "product_id": "devtoolset-2-httpcomponents-client-javadoc-0:4.2.1-6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/devtoolset-2-httpcomponents-client-javadoc@4.2.1-6.el6?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.src",
                "product": {
                  "name": "devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.src",
                  "product_id": "devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/devtoolset-2-httpcomponents-client@4.2.1-6.el6?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.noarch as a component of Red Hat Developer Toolset 2 for Red Hat Enterprise Linux 6 Server",
          "product_id": "6Server-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.noarch"
        },
        "product_reference": "devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.noarch",
        "relates_to_product_reference": "6Server-RHDevToolset-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.src as a component of Red Hat Developer Toolset 2 for Red Hat Enterprise Linux 6 Server",
          "product_id": "6Server-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.src"
        },
        "product_reference": "devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.src",
        "relates_to_product_reference": "6Server-RHDevToolset-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "devtoolset-2-httpcomponents-client-javadoc-0:4.2.1-6.el6.noarch as a component of Red Hat Developer Toolset 2 for Red Hat Enterprise Linux 6 Server",
          "product_id": "6Server-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-javadoc-0:4.2.1-6.el6.noarch"
        },
        "product_reference": "devtoolset-2-httpcomponents-client-javadoc-0:4.2.1-6.el6.noarch",
        "relates_to_product_reference": "6Server-RHDevToolset-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.noarch as a component of Red Hat Developer Toolset 2 for Red Hat Enterprise Linux 6 Workstation",
          "product_id": "6Workstation-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.noarch"
        },
        "product_reference": "devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.noarch",
        "relates_to_product_reference": "6Workstation-RHDevToolset-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.src as a component of Red Hat Developer Toolset 2 for Red Hat Enterprise Linux 6 Workstation",
          "product_id": "6Workstation-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.src"
        },
        "product_reference": "devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.src",
        "relates_to_product_reference": "6Workstation-RHDevToolset-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "devtoolset-2-httpcomponents-client-javadoc-0:4.2.1-6.el6.noarch as a component of Red Hat Developer Toolset 2 for Red Hat Enterprise Linux 6 Workstation",
          "product_id": "6Workstation-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-javadoc-0:4.2.1-6.el6.noarch"
        },
        "product_reference": "devtoolset-2-httpcomponents-client-javadoc-0:4.2.1-6.el6.noarch",
        "relates_to_product_reference": "6Workstation-RHDevToolset-2.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Florian Weimer"
          ],
          "organization": "Red Hat Product Security",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2012-6153",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2012-11-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1129916"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.noarch",
          "6Server-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.src",
          "6Server-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-javadoc-0:4.2.1-6.el6.noarch",
          "6Workstation-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.noarch",
          "6Workstation-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.src",
          "6Workstation-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-javadoc-0:4.2.1-6.el6.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "RHBZ#1129916",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
        }
      ],
      "release_date": "2014-08-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-08-26T16:32:35+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.noarch",
            "6Server-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.src",
            "6Server-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-javadoc-0:4.2.1-6.el6.noarch",
            "6Workstation-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.noarch",
            "6Workstation-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.src",
            "6Workstation-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-javadoc-0:4.2.1-6.el6.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1098"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.noarch",
            "6Server-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.src",
            "6Server-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-javadoc-0:4.2.1-6.el6.noarch",
            "6Workstation-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.noarch",
            "6Workstation-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-0:4.2.1-6.el6.src",
            "6Workstation-RHDevToolset-2.1:devtoolset-2-httpcomponents-client-javadoc-0:4.2.1-6.el6.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated Red Hat JBoss Enterprise Application Platform 6.3.0 packages that\nfix two security issues are now available for Red Hat Enterprise Linux 5,\n6, and 7.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform 6 is a platform for Java\napplications based on JBoss Application Server 7.\n\nIt was found that the fix for CVE-2012-5783 was incomplete: the code added\nto check that the server host name matches the domain name in a subject\u0027s\nCommon Name (CN) field in X.509 certificates was flawed.\nA man-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2012-6153)\n\nIt was discovered that the HttpClient incorrectly extracted host name from\nan X.509 certificate subject\u0027s Common Name (CN) field. A man-in-the-middle\nattacker could use this flaw to spoof an SSL server using a specially\ncrafted X.509 certificate. (CVE-2014-3577)\n\nThe CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat\nProduct Security.\n\nFor additional information on these flaws, refer to the Knowledgebase\narticle in the References section.\n\nAll users of Red Hat JBoss Enterprise Application Platform 6.3.0 on Red Hat\nEnterprise Linux 5, 6, and 7 are advised to upgrade to these updated\npackages. The JBoss server process must be restarted for the update to\ntake effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:1162",
        "url": "https://access.redhat.com/errata/RHSA-2014:1162"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/1165533",
        "url": "https://access.redhat.com/solutions/1165533"
      },
      {
        "category": "external",
        "summary": "1129074",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
      },
      {
        "category": "external",
        "summary": "1129916",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1162.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 security update",
    "tracking": {
      "current_release_date": "2024-11-14T14:30:05+00:00",
      "generator": {
        "date": "2024-11-14T14:30:05+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2014:1162",
      "initial_release_date": "2014-09-04T16:26:13+00:00",
      "revision_history": [
        {
          "date": "2014-09-04T16:26:13+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-09-04T16:26:13+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T14:30:05+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server",
                  "product_id": "5Server-JBEAP-6.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server",
                  "product_id": "6Server-JBEAP-6.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server",
                  "product_id": "7Server-JBEAP-6.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
                "product": {
                  "name": "httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
                  "product_id": "httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpmime-eap6@4.2.1-12.redhat_2.1.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
                "product": {
                  "name": "httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
                  "product_id": "httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpcore-eap6@4.2.1-12.redhat_2.1.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
                "product": {
                  "name": "httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
                  "product_id": "httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpcomponents-client-eap6@4.2.1-12.redhat_2.1.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el5.noarch",
                "product": {
                  "name": "httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el5.noarch",
                  "product_id": "httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpcomponents-project-eap6@6-12.redhat_2.1.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
                "product": {
                  "name": "httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
                  "product_id": "httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpclient-eap6@4.2.1-12.redhat_2.1.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
                "product": {
                  "name": "httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
                  "product_id": "httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpcomponents-core-eap6@4.2.1-12.redhat_2.1.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
                "product": {
                  "name": "httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
                  "product_id": "httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpmime-eap6@4.2.1-12.redhat_2.1.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
                "product": {
                  "name": "httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
                  "product_id": "httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpcore-eap6@4.2.1-12.redhat_2.1.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
                "product": {
                  "name": "httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
                  "product_id": "httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpcomponents-client-eap6@4.2.1-12.redhat_2.1.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el6.noarch",
                "product": {
                  "name": "httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el6.noarch",
                  "product_id": "httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpcomponents-project-eap6@6-12.redhat_2.1.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
                "product": {
                  "name": "httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
                  "product_id": "httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpclient-eap6@4.2.1-12.redhat_2.1.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
                "product": {
                  "name": "httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
                  "product_id": "httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpcomponents-core-eap6@4.2.1-12.redhat_2.1.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
                "product": {
                  "name": "httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
                  "product_id": "httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpmime-eap6@4.2.1-12.redhat_2.1.ep6.el7?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
                "product": {
                  "name": "httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
                  "product_id": "httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpcore-eap6@4.2.1-12.redhat_2.1.ep6.el7?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
                "product": {
                  "name": "httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
                  "product_id": "httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpcomponents-client-eap6@4.2.1-12.redhat_2.1.ep6.el7?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el7.noarch",
                "product": {
                  "name": "httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el7.noarch",
                  "product_id": "httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpcomponents-project-eap6@6-12.redhat_2.1.ep6.el7?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
                "product": {
                  "name": "httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
                  "product_id": "httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpclient-eap6@4.2.1-12.redhat_2.1.ep6.el7?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
                "product": {
                  "name": "httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
                  "product_id": "httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpcomponents-core-eap6@4.2.1-12.redhat_2.1.ep6.el7?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el5.src",
                "product": {
                  "name": "httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el5.src",
                  "product_id": "httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpcomponents-eap6@6-12.redhat_2.1.ep6.el5?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el6.src",
                "product": {
                  "name": "httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el6.src",
                  "product_id": "httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpcomponents-eap6@6-12.redhat_2.1.ep6.el6?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el7.src",
                "product": {
                  "name": "httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el7.src",
                  "product_id": "httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpcomponents-eap6@6-12.redhat_2.1.ep6.el7?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-6.3:httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch"
        },
        "product_reference": "httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-6.3:httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch"
        },
        "product_reference": "httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-6.3:httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch"
        },
        "product_reference": "httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el5.src as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-6.3:httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el5.src"
        },
        "product_reference": "httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el5.src",
        "relates_to_product_reference": "5Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-6.3:httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el5.noarch"
        },
        "product_reference": "httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-6.3:httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch"
        },
        "product_reference": "httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-6.3:httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch"
        },
        "product_reference": "httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6.3:httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch"
        },
        "product_reference": "httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6.3:httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch"
        },
        "product_reference": "httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6.3:httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch"
        },
        "product_reference": "httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el6.src as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6.3:httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el6.src"
        },
        "product_reference": "httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el6.src",
        "relates_to_product_reference": "6Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6.3:httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el6.noarch"
        },
        "product_reference": "httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6.3:httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch"
        },
        "product_reference": "httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6.3:httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch"
        },
        "product_reference": "httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server",
          "product_id": "7Server-JBEAP-6.3:httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch"
        },
        "product_reference": "httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
        "relates_to_product_reference": "7Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server",
          "product_id": "7Server-JBEAP-6.3:httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch"
        },
        "product_reference": "httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
        "relates_to_product_reference": "7Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server",
          "product_id": "7Server-JBEAP-6.3:httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch"
        },
        "product_reference": "httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
        "relates_to_product_reference": "7Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el7.src as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server",
          "product_id": "7Server-JBEAP-6.3:httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el7.src"
        },
        "product_reference": "httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el7.src",
        "relates_to_product_reference": "7Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server",
          "product_id": "7Server-JBEAP-6.3:httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el7.noarch"
        },
        "product_reference": "httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el7.noarch",
        "relates_to_product_reference": "7Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server",
          "product_id": "7Server-JBEAP-6.3:httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch"
        },
        "product_reference": "httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
        "relates_to_product_reference": "7Server-JBEAP-6.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server",
          "product_id": "7Server-JBEAP-6.3:httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch"
        },
        "product_reference": "httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
        "relates_to_product_reference": "7Server-JBEAP-6.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Florian Weimer"
          ],
          "organization": "Red Hat Product Security",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2012-6153",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2012-11-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1129916"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-JBEAP-6.3:httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
          "5Server-JBEAP-6.3:httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
          "5Server-JBEAP-6.3:httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
          "5Server-JBEAP-6.3:httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el5.src",
          "5Server-JBEAP-6.3:httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el5.noarch",
          "5Server-JBEAP-6.3:httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
          "5Server-JBEAP-6.3:httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
          "6Server-JBEAP-6.3:httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
          "6Server-JBEAP-6.3:httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
          "6Server-JBEAP-6.3:httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
          "6Server-JBEAP-6.3:httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el6.src",
          "6Server-JBEAP-6.3:httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el6.noarch",
          "6Server-JBEAP-6.3:httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
          "6Server-JBEAP-6.3:httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
          "7Server-JBEAP-6.3:httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
          "7Server-JBEAP-6.3:httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
          "7Server-JBEAP-6.3:httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
          "7Server-JBEAP-6.3:httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el7.src",
          "7Server-JBEAP-6.3:httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el7.noarch",
          "7Server-JBEAP-6.3:httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
          "7Server-JBEAP-6.3:httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "RHBZ#1129916",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
        }
      ],
      "release_date": "2014-08-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-09-04T16:26:13+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied. Also, back up any customized Red\nHat JBoss Enterprise Application Platform 6 configuration files. On update,\nthe configuration files that have been locally modified will not be\nupdated. The updated version of such files will be stored as the rpmnew\nfiles. Make sure to locate any such files after the update and merge any\nchanges manually.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "5Server-JBEAP-6.3:httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el5.src",
            "5Server-JBEAP-6.3:httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
            "6Server-JBEAP-6.3:httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el6.src",
            "6Server-JBEAP-6.3:httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
            "7Server-JBEAP-6.3:httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el7.src",
            "7Server-JBEAP-6.3:httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1162"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "5Server-JBEAP-6.3:httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el5.src",
            "5Server-JBEAP-6.3:httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
            "6Server-JBEAP-6.3:httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el6.src",
            "6Server-JBEAP-6.3:httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
            "7Server-JBEAP-6.3:httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el7.src",
            "7Server-JBEAP-6.3:httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
    },
    {
      "cve": "CVE-2014-3577",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2014-08-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1129074"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-JBEAP-6.3:httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
          "5Server-JBEAP-6.3:httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
          "5Server-JBEAP-6.3:httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
          "5Server-JBEAP-6.3:httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el5.src",
          "5Server-JBEAP-6.3:httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el5.noarch",
          "5Server-JBEAP-6.3:httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
          "5Server-JBEAP-6.3:httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
          "6Server-JBEAP-6.3:httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
          "6Server-JBEAP-6.3:httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
          "6Server-JBEAP-6.3:httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
          "6Server-JBEAP-6.3:httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el6.src",
          "6Server-JBEAP-6.3:httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el6.noarch",
          "6Server-JBEAP-6.3:httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
          "6Server-JBEAP-6.3:httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
          "7Server-JBEAP-6.3:httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
          "7Server-JBEAP-6.3:httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
          "7Server-JBEAP-6.3:httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
          "7Server-JBEAP-6.3:httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el7.src",
          "7Server-JBEAP-6.3:httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el7.noarch",
          "7Server-JBEAP-6.3:httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
          "7Server-JBEAP-6.3:httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3577"
        },
        {
          "category": "external",
          "summary": "RHBZ#1129074",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
        }
      ],
      "release_date": "2014-08-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-09-04T16:26:13+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied. Also, back up any customized Red\nHat JBoss Enterprise Application Platform 6 configuration files. On update,\nthe configuration files that have been locally modified will not be\nupdated. The updated version of such files will be stored as the rpmnew\nfiles. Make sure to locate any such files after the update and merge any\nchanges manually.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "5Server-JBEAP-6.3:httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el5.src",
            "5Server-JBEAP-6.3:httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
            "6Server-JBEAP-6.3:httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el6.src",
            "6Server-JBEAP-6.3:httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
            "7Server-JBEAP-6.3:httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el7.src",
            "7Server-JBEAP-6.3:httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1162"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "5Server-JBEAP-6.3:httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el5.src",
            "5Server-JBEAP-6.3:httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.3:httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el5.noarch",
            "6Server-JBEAP-6.3:httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el6.src",
            "6Server-JBEAP-6.3:httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.3:httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el6.noarch",
            "7Server-JBEAP-6.3:httpclient-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:httpcomponents-client-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:httpcomponents-core-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:httpcomponents-eap6-0:6-12.redhat_2.1.ep6.el7.src",
            "7Server-JBEAP-6.3:httpcomponents-project-eap6-0:6-12.redhat_2.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:httpcore-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch",
            "7Server-JBEAP-6.3:httpmime-eap6-0:4.2.1-12.redhat_2.1.ep6.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat JBoss Enterprise Application Platform 6.3.0 that\nfixes two security issues is now available from the Red Hat Customer\nPortal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform 6 is a platform for Java\napplications based on JBoss Application Server 7.\n\nIt was found that the fix for CVE-2012-5783 was incomplete: the code added\nto check that the server host name matches the domain name in a subject\u0027s\nCommon Name (CN) field in X.509 certificates was flawed.\nA man-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2012-6153)\n\nIt was discovered that the HttpClient incorrectly extracted host name from\nan X.509 certificate subject\u0027s Common Name (CN) field. A man-in-the-middle\nattacker could use this flaw to spoof an SSL server using a specially\ncrafted X.509 certificate. (CVE-2014-3577)\n\nThe CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat\nProduct Security.\n\nFor additional information on these flaws, refer to the Knowledgebase\narticle in the References section.\n\nAll users of Red Hat JBoss Enterprise Application Platform 6.3.0 as\nprovided from the Red Hat Customer Portal are advised to apply this update.\nThe JBoss server process must be restarted for the update to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:1163",
        "url": "https://access.redhat.com/errata/RHSA-2014:1163"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform\u0026downloadType=securityPatches\u0026version=6.3",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform\u0026downloadType=securityPatches\u0026version=6.3"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/1165533",
        "url": "https://access.redhat.com/solutions/1165533"
      },
      {
        "category": "external",
        "summary": "1129074",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
      },
      {
        "category": "external",
        "summary": "1129916",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1163.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 security update",
    "tracking": {
      "current_release_date": "2024-11-14T14:30:12+00:00",
      "generator": {
        "date": "2024-11-14T14:30:12+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2014:1163",
      "initial_release_date": "2014-09-04T16:11:04+00:00",
      "revision_history": [
        {
          "date": "2014-09-04T16:11:04+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-09-04T17:16:45+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T14:30:12+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6.3",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6.3",
                  "product_id": "Red Hat JBoss Enterprise Application Platform 6.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Florian Weimer"
          ],
          "organization": "Red Hat Product Security",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2012-6153",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2012-11-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1129916"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 6.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "RHBZ#1129916",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
        }
      ],
      "release_date": "2014-08-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-09-04T16:11:04+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting Red Hat JBoss Enterprise Application Platform installation and\ndeployed applications.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 6.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1163"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 6.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
    },
    {
      "cve": "CVE-2014-3577",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2014-08-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1129074"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 6.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3577"
        },
        {
          "category": "external",
          "summary": "RHBZ#1129074",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
        }
      ],
      "release_date": "2014-08-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-09-04T16:11:04+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting Red Hat JBoss Enterprise Application Platform installation and\ndeployed applications.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 6.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1163"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 6.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated packages for Red Hat JBoss Enterprise Web Platform 5.2.0 that fix\ntwo security issues are now available for Red Hat Enterprise Linux 4, 5,\nand 6.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Web Platform is a platform for Java applications,\nwhich integrates the JBoss Web Server with JBoss Hibernate and JBoss Seam.\n\nIt was found that the fix for CVE-2012-5783 was incomplete: the code added\nto check that the server host name matches the domain name in a subject\u0027s\nCommon Name (CN) field in X.509 certificates was flawed.\nA man-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2012-6153)\n\nIt was discovered that the HttpClient incorrectly extracted host name from\nan X.509 certificate subject\u0027s Common Name (CN) field. A man-in-the-middle\nattacker could use this flaw to spoof an SSL server using a specially\ncrafted X.509 certificate. (CVE-2014-3577)\n\nThe CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat\nProduct Security.\n\nFor additional information on these flaws, refer to the Knowledgebase\narticle in the References section.\n\nAll users of Red Hat JBoss Enterprise Web Platform 5.2.0 on Red Hat\nEnterprise Linux 4, 5, and 6 are advised to upgrade to these updated\npackages. The JBoss server process must be restarted for the update to take\neffect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:1320",
        "url": "https://access.redhat.com/errata/RHSA-2014:1320"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/1165533",
        "url": "https://access.redhat.com/solutions/1165533"
      },
      {
        "category": "external",
        "summary": "1129074",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
      },
      {
        "category": "external",
        "summary": "1129916",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1320.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Web Platform 5.2.0 security update",
    "tracking": {
      "current_release_date": "2024-11-14T14:31:37+00:00",
      "generator": {
        "date": "2024-11-14T14:31:37+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2014:1320",
      "initial_release_date": "2014-09-29T20:11:40+00:00",
      "revision_history": [
        {
          "date": "2014-09-29T20:11:40+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-09-29T20:11:40+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T14:31:37+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Web Platform 5 for RHEL 5 Server",
                "product": {
                  "name": "Red Hat JBoss Web Platform 5 for RHEL 5 Server",
                  "product_id": "5Server-JBEWP-5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_platform:5::el5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Web Platform 5 for RHEL 6 Server",
                "product": {
                  "name": "Red Hat JBoss Web Platform 5 for RHEL 6 Server",
                  "product_id": "6Server-JBEWP-5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_platform:5::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Web Platform 5 for RHEL 4 AS",
                "product": {
                  "name": "Red Hat JBoss Web Platform 5 for RHEL 4 AS",
                  "product_id": "4AS-JBEWP-5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_platform:5::el4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Web Platform 5 for RHEL 4 ES",
                "product": {
                  "name": "Red Hat JBoss Web Platform 5 for RHEL 4 ES",
                  "product_id": "4ES-JBEWP-5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_platform:5::el4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Web Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch",
                "product": {
                  "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch",
                  "product_id": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-httpclient@3.1-4_patch_02.ep5.el5?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                "product": {
                  "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                  "product_id": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2@2.2.6.EAP5-22_patch_01.ep5.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                "product": {
                  "name": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                  "product_id": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2-docs@2.2.6.EAP5-22_patch_01.ep5.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                "product": {
                  "name": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                  "product_id": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2-runtime@2.2.6.EAP5-22_patch_01.ep5.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                "product": {
                  "name": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                  "product_id": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2-examples@2.2.6.EAP5-22_patch_01.ep5.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch",
                "product": {
                  "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch",
                  "product_id": "jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-httpclient@3.1-4_patch_02.el6_5?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                "product": {
                  "name": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                  "product_id": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2-examples@2.2.6.EAP5-22_patch_01.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                "product": {
                  "name": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                  "product_id": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2-docs@2.2.6.EAP5-22_patch_01.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                "product": {
                  "name": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                  "product_id": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2-runtime@2.2.6.EAP5-22_patch_01.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                "product": {
                  "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                  "product_id": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2@2.2.6.EAP5-22_patch_01.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
                "product": {
                  "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
                  "product_id": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-httpclient@3.1-4_patch_02.ep5.el4?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                "product": {
                  "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                  "product_id": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2@2.2.6.EAP5-22_patch_01.ep5.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                "product": {
                  "name": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                  "product_id": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2-docs@2.2.6.EAP5-22_patch_01.ep5.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                "product": {
                  "name": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                  "product_id": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2-runtime@2.2.6.EAP5-22_patch_01.ep5.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                "product": {
                  "name": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                  "product_id": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2-examples@2.2.6.EAP5-22_patch_01.ep5.el4?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src",
                "product": {
                  "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src",
                  "product_id": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-httpclient@3.1-4_patch_02.ep5.el5?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src",
                "product": {
                  "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src",
                  "product_id": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2@2.2.6.EAP5-22_patch_01.ep5.el5?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src",
                "product": {
                  "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src",
                  "product_id": "jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-httpclient@3.1-4_patch_02.el6_5?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src",
                "product": {
                  "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src",
                  "product_id": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2@2.2.6.EAP5-22_patch_01.el6?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
                "product": {
                  "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
                  "product_id": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-httpclient@3.1-4_patch_02.ep5.el4?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
                "product": {
                  "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
                  "product_id": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2@2.2.6.EAP5-22_patch_01.ep5.el4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 4 AS",
          "product_id": "4AS-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch"
        },
        "product_reference": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src as a component of Red Hat JBoss Web Platform 5 for RHEL 4 AS",
          "product_id": "4AS-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src"
        },
        "product_reference": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
        "relates_to_product_reference": "4AS-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 4 AS",
          "product_id": "4AS-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch"
        },
        "product_reference": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src as a component of Red Hat JBoss Web Platform 5 for RHEL 4 AS",
          "product_id": "4AS-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src"
        },
        "product_reference": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
        "relates_to_product_reference": "4AS-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 4 AS",
          "product_id": "4AS-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch"
        },
        "product_reference": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 4 AS",
          "product_id": "4AS-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch"
        },
        "product_reference": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 4 AS",
          "product_id": "4AS-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch"
        },
        "product_reference": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 4 ES",
          "product_id": "4ES-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch"
        },
        "product_reference": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src as a component of Red Hat JBoss Web Platform 5 for RHEL 4 ES",
          "product_id": "4ES-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src"
        },
        "product_reference": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
        "relates_to_product_reference": "4ES-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 4 ES",
          "product_id": "4ES-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch"
        },
        "product_reference": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src as a component of Red Hat JBoss Web Platform 5 for RHEL 4 ES",
          "product_id": "4ES-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src"
        },
        "product_reference": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
        "relates_to_product_reference": "4ES-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 4 ES",
          "product_id": "4ES-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch"
        },
        "product_reference": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 4 ES",
          "product_id": "4ES-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch"
        },
        "product_reference": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 4 ES",
          "product_id": "4ES-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch"
        },
        "product_reference": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 5 Server",
          "product_id": "5Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch"
        },
        "product_reference": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src as a component of Red Hat JBoss Web Platform 5 for RHEL 5 Server",
          "product_id": "5Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src"
        },
        "product_reference": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src",
        "relates_to_product_reference": "5Server-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 5 Server",
          "product_id": "5Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch"
        },
        "product_reference": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src as a component of Red Hat JBoss Web Platform 5 for RHEL 5 Server",
          "product_id": "5Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src"
        },
        "product_reference": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src",
        "relates_to_product_reference": "5Server-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 5 Server",
          "product_id": "5Server-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch"
        },
        "product_reference": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 5 Server",
          "product_id": "5Server-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch"
        },
        "product_reference": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 5 Server",
          "product_id": "5Server-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch"
        },
        "product_reference": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 6 Server",
          "product_id": "6Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch"
        },
        "product_reference": "jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch",
        "relates_to_product_reference": "6Server-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src as a component of Red Hat JBoss Web Platform 5 for RHEL 6 Server",
          "product_id": "6Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src"
        },
        "product_reference": "jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src",
        "relates_to_product_reference": "6Server-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 6 Server",
          "product_id": "6Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch"
        },
        "product_reference": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src as a component of Red Hat JBoss Web Platform 5 for RHEL 6 Server",
          "product_id": "6Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src"
        },
        "product_reference": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src",
        "relates_to_product_reference": "6Server-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 6 Server",
          "product_id": "6Server-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch"
        },
        "product_reference": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 6 Server",
          "product_id": "6Server-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch"
        },
        "product_reference": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch as a component of Red Hat JBoss Web Platform 5 for RHEL 6 Server",
          "product_id": "6Server-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch"
        },
        "product_reference": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWP-5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Florian Weimer"
          ],
          "organization": "Red Hat Product Security",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2012-6153",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2012-11-15T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "4AS-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
            "4AS-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
            "4AS-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4AS-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
            "4AS-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4AS-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4AS-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
            "4ES-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
            "4ES-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
            "4ES-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1129916"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch",
          "5Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src",
          "5Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
          "5Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src",
          "5Server-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
          "5Server-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
          "5Server-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
          "6Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch",
          "6Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src",
          "6Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch",
          "6Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src",
          "6Server-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch",
          "6Server-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch",
          "6Server-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch"
        ],
        "known_not_affected": [
          "4AS-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
          "4AS-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
          "4AS-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4AS-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
          "4AS-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4AS-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4AS-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4ES-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
          "4ES-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
          "4ES-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4ES-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
          "4ES-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4ES-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4ES-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "RHBZ#1129916",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
        }
      ],
      "release_date": "2014-08-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-09-29T20:11:40+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied. Also, back up your existing Red\nHat JBoss Enterprise Web Platform 5 installation (including all\napplications and configuration files).\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "5Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch",
            "5Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src",
            "5Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src",
            "5Server-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "6Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch",
            "6Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src",
            "6Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src",
            "6Server-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1320"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "5Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch",
            "5Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src",
            "5Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src",
            "5Server-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "6Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch",
            "6Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src",
            "6Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src",
            "6Server-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
    },
    {
      "cve": "CVE-2014-3577",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2014-08-12T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "4AS-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
            "4AS-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
            "4AS-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4AS-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
            "4AS-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4AS-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4AS-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
            "4ES-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
            "4ES-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
            "4ES-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1129074"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch",
          "5Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src",
          "5Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
          "5Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src",
          "5Server-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
          "5Server-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
          "5Server-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
          "6Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch",
          "6Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src",
          "6Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch",
          "6Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src",
          "6Server-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch",
          "6Server-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch",
          "6Server-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch"
        ],
        "known_not_affected": [
          "4AS-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
          "4AS-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
          "4AS-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4AS-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
          "4AS-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4AS-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4AS-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4ES-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
          "4ES-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
          "4ES-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4ES-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
          "4ES-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4ES-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4ES-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3577"
        },
        {
          "category": "external",
          "summary": "RHBZ#1129074",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
        }
      ],
      "release_date": "2014-08-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-09-29T20:11:40+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied. Also, back up your existing Red\nHat JBoss Enterprise Web Platform 5 installation (including all\napplications and configuration files).\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "5Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch",
            "5Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src",
            "5Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src",
            "5Server-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "6Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch",
            "6Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src",
            "6Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src",
            "6Server-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1320"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "5Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch",
            "5Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src",
            "5Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src",
            "5Server-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "6Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch",
            "6Server-JBEWP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src",
            "6Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEWP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src",
            "6Server-JBEWP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEWP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEWP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated packages for Red Hat JBoss Enterprise Application Platform 5.2.0\nthat fix two security issues are now available for Red Hat Enterprise Linux\n4, 5, and 6.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform is a platform for Java\napplications, which integrates the JBoss Application Server with JBoss\nHibernate and JBoss Seam.\n\nIt was found that the fix for CVE-2012-5783 was incomplete: the code added\nto check that the server host name matches the domain name in a subject\u0027s\nCommon Name (CN) field in X.509 certificates was flawed.\nA man-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2012-6153)\n\nIt was discovered that the HttpClient incorrectly extracted host name from\nan X.509 certificate subject\u0027s Common Name (CN) field. A man-in-the-middle\nattacker could use this flaw to spoof an SSL server using a specially\ncrafted X.509 certificate. (CVE-2014-3577)\n\nThe CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat\nProduct Security.\n\nFor additional information on these flaws, refer to the Knowledgebase\narticle in the References section.\n\nAll users of Red Hat JBoss Enterprise Application Platform 5.2.0 on Red Hat\nEnterprise Linux 4, 5, and 6 are advised to upgrade to these updated\npackages. The JBoss server process must be restarted for the update to take\neffect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:1321",
        "url": "https://access.redhat.com/errata/RHSA-2014:1321"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/1165533",
        "url": "https://access.redhat.com/solutions/1165533"
      },
      {
        "category": "external",
        "summary": "1129074",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
      },
      {
        "category": "external",
        "summary": "1129916",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1321.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2.0 security update",
    "tracking": {
      "current_release_date": "2024-11-14T14:31:42+00:00",
      "generator": {
        "date": "2024-11-14T14:31:42+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2014:1321",
      "initial_release_date": "2014-09-29T20:22:16+00:00",
      "revision_history": [
        {
          "date": "2014-09-29T20:22:16+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-09-29T20:22:16+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T14:31:42+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server",
                  "product_id": "5Server-JBEAP-5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:5::el5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS",
                  "product_id": "4AS-JBEAP-5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:5::el4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES",
                  "product_id": "4ES-JBEAP-5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:5::el4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server",
                  "product_id": "6Server-JBEAP-5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:5::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch",
                "product": {
                  "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch",
                  "product_id": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-httpclient@3.1-4_patch_02.ep5.el5?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                "product": {
                  "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                  "product_id": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2@2.2.6.EAP5-22_patch_01.ep5.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                "product": {
                  "name": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                  "product_id": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2-docs@2.2.6.EAP5-22_patch_01.ep5.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                "product": {
                  "name": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                  "product_id": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2-runtime@2.2.6.EAP5-22_patch_01.ep5.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                "product": {
                  "name": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                  "product_id": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2-examples@2.2.6.EAP5-22_patch_01.ep5.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
                "product": {
                  "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
                  "product_id": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-httpclient@3.1-4_patch_02.ep5.el4?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                "product": {
                  "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                  "product_id": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2@2.2.6.EAP5-22_patch_01.ep5.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                "product": {
                  "name": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                  "product_id": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2-docs@2.2.6.EAP5-22_patch_01.ep5.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                "product": {
                  "name": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                  "product_id": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2-runtime@2.2.6.EAP5-22_patch_01.ep5.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                "product": {
                  "name": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                  "product_id": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2-examples@2.2.6.EAP5-22_patch_01.ep5.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch",
                "product": {
                  "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch",
                  "product_id": "jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-httpclient@3.1-4_patch_02.el6_5?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                "product": {
                  "name": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                  "product_id": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2-examples@2.2.6.EAP5-22_patch_01.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                "product": {
                  "name": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                  "product_id": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2-docs@2.2.6.EAP5-22_patch_01.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                "product": {
                  "name": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                  "product_id": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2-runtime@2.2.6.EAP5-22_patch_01.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                "product": {
                  "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                  "product_id": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2@2.2.6.EAP5-22_patch_01.el6?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src",
                "product": {
                  "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src",
                  "product_id": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-httpclient@3.1-4_patch_02.ep5.el5?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src",
                "product": {
                  "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src",
                  "product_id": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2@2.2.6.EAP5-22_patch_01.ep5.el5?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
                "product": {
                  "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
                  "product_id": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-httpclient@3.1-4_patch_02.ep5.el4?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
                "product": {
                  "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
                  "product_id": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2@2.2.6.EAP5-22_patch_01.ep5.el4?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src",
                "product": {
                  "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src",
                  "product_id": "jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-httpclient@3.1-4_patch_02.el6_5?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src",
                "product": {
                  "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src",
                  "product_id": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-seam2@2.2.6.EAP5-22_patch_01.el6?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS",
          "product_id": "4AS-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch"
        },
        "product_reference": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS",
          "product_id": "4AS-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src"
        },
        "product_reference": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
        "relates_to_product_reference": "4AS-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS",
          "product_id": "4AS-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch"
        },
        "product_reference": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS",
          "product_id": "4AS-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src"
        },
        "product_reference": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
        "relates_to_product_reference": "4AS-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS",
          "product_id": "4AS-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch"
        },
        "product_reference": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS",
          "product_id": "4AS-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch"
        },
        "product_reference": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS",
          "product_id": "4AS-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch"
        },
        "product_reference": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES",
          "product_id": "4ES-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch"
        },
        "product_reference": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES",
          "product_id": "4ES-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src"
        },
        "product_reference": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
        "relates_to_product_reference": "4ES-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES",
          "product_id": "4ES-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch"
        },
        "product_reference": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES",
          "product_id": "4ES-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src"
        },
        "product_reference": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
        "relates_to_product_reference": "4ES-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES",
          "product_id": "4ES-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch"
        },
        "product_reference": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES",
          "product_id": "4ES-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch"
        },
        "product_reference": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES",
          "product_id": "4ES-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch"
        },
        "product_reference": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch"
        },
        "product_reference": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src"
        },
        "product_reference": "jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src",
        "relates_to_product_reference": "5Server-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch"
        },
        "product_reference": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src"
        },
        "product_reference": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src",
        "relates_to_product_reference": "5Server-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch"
        },
        "product_reference": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch"
        },
        "product_reference": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch"
        },
        "product_reference": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch"
        },
        "product_reference": "jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch",
        "relates_to_product_reference": "6Server-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src"
        },
        "product_reference": "jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src",
        "relates_to_product_reference": "6Server-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch"
        },
        "product_reference": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src"
        },
        "product_reference": "jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src",
        "relates_to_product_reference": "6Server-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch"
        },
        "product_reference": "jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch"
        },
        "product_reference": "jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch"
        },
        "product_reference": "jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Florian Weimer"
          ],
          "organization": "Red Hat Product Security",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2012-6153",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2012-11-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1129916"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
          "4AS-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
          "4AS-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4AS-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
          "4AS-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4AS-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4AS-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4ES-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
          "4ES-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
          "4ES-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4ES-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
          "4ES-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4ES-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4ES-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "5Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch",
          "5Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src",
          "5Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
          "5Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src",
          "5Server-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
          "5Server-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
          "5Server-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
          "6Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch",
          "6Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src",
          "6Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch",
          "6Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src",
          "6Server-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch",
          "6Server-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch",
          "6Server-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "RHBZ#1129916",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
        }
      ],
      "release_date": "2014-08-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-09-29T20:22:16+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied. Also, back up your existing Red\nHat JBoss Enterprise Application Platform 5 installation (including all\napplications and configuration files).\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "4AS-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
            "4AS-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
            "4AS-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4AS-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
            "4AS-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4AS-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4AS-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
            "4ES-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
            "4ES-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
            "4ES-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "5Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch",
            "5Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src",
            "5Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src",
            "5Server-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "6Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch",
            "6Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src",
            "6Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src",
            "6Server-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1321"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "4AS-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
            "4AS-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
            "4AS-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4AS-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
            "4AS-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4AS-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4AS-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
            "4ES-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
            "4ES-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
            "4ES-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "5Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch",
            "5Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src",
            "5Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src",
            "5Server-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "6Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch",
            "6Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src",
            "6Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src",
            "6Server-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
    },
    {
      "cve": "CVE-2014-3577",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2014-08-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1129074"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
          "4AS-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
          "4AS-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4AS-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
          "4AS-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4AS-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4AS-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4ES-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
          "4ES-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
          "4ES-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4ES-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
          "4ES-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4ES-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "4ES-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
          "5Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch",
          "5Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src",
          "5Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
          "5Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src",
          "5Server-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
          "5Server-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
          "5Server-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
          "6Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch",
          "6Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src",
          "6Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch",
          "6Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src",
          "6Server-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch",
          "6Server-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch",
          "6Server-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3577"
        },
        {
          "category": "external",
          "summary": "RHBZ#1129074",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
        }
      ],
      "release_date": "2014-08-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-09-29T20:22:16+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied. Also, back up your existing Red\nHat JBoss Enterprise Application Platform 5 installation (including all\napplications and configuration files).\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "4AS-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
            "4AS-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
            "4AS-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4AS-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
            "4AS-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4AS-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4AS-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
            "4ES-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
            "4ES-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
            "4ES-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "5Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch",
            "5Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src",
            "5Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src",
            "5Server-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "6Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch",
            "6Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src",
            "6Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src",
            "6Server-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1321"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "4AS-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
            "4AS-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
            "4AS-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4AS-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
            "4AS-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4AS-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4AS-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.noarch",
            "4ES-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el4.src",
            "4ES-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el4.src",
            "4ES-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "4ES-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el4.noarch",
            "5Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.noarch",
            "5Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.ep5.el5.src",
            "5Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.ep5.el5.src",
            "5Server-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "5Server-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.ep5.el5.noarch",
            "6Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.noarch",
            "6Server-JBEAP-5:jakarta-commons-httpclient-1:3.1-4_patch_02.el6_5.src",
            "6Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEAP-5:jboss-seam2-0:2.2.6.EAP5-22_patch_01.el6.src",
            "6Server-JBEAP-5:jboss-seam2-docs-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEAP-5:jboss-seam2-examples-0:2.2.6.EAP5-22_patch_01.el6.noarch",
            "6Server-JBEAP-5:jboss-seam2-runtime-0:2.2.6.EAP5-22_patch_01.el6.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
    }
  ]
}