{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000017.html",
  "dc:date": "2016-12-27T11:49+09:00",
  "dcterms:issued": "2014-02-10T17:21+09:00",
  "dcterms:modified": "2016-12-27T11:49+09:00",
  "description": "Apache Commons FileUpload contains a denial-of-service (DoS) vulnerability.\r\n\r\nApache Commons FileUpload provided by Apache Software Foundation contains an issue in processing a multi-part request, which may cause the process to be in an infinite loop.\r\n\r\nAs of 2014 February 12, an exploit tool to attack against this vulnerability has been confirmed.\r\n\r\nHitachi Incident Response Team (HIRT) reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000017.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:apache:commons_fileupload",
      "@product": "Commons FileUpload",
      "@vendor": "Apache Software Foundation",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:apache:tomcat",
      "@product": "Apache Tomcat",
      "@vendor": "Apache Software Foundation",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "5.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2014-000017",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN14876762/index.html",
      "@id": "JVN#14876762",
      "@source": "JVN"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0050",
      "@id": "CVE-2014-0050",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0050",
      "@id": "CVE-2014-0050",
      "@source": "NVD"
    },
    {
      "#text": "http://advisories.mageia.org/MGASA-2014-0110.html",
      "@id": "MGASA-2014-0110",
      "@source": "Related document"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-20",
      "@title": "Improper Input Validation(CWE-20)"
    }
  ],
  "title": "Apache Commons FileUpload vulnerable to denial-of-service (DoS)"
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Fuse Service Works 6.0.0 roll up patch 1, which fixes\nmultiple security issues and various bugs, is now available from the Red\nHat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nImportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Fuse Service Works is the next-generation ESB and business\nprocess automation infrastructure. Red Hat JBoss Fuse Service Works allows\nIT to leverage existing (MoM and EAI), modern (SOA and BPM-Rules), and\nfuture (EDA and CEP) integration methodologies to dramatically improve\nbusiness process execution speed and quality.\n\nThis roll up patch serves as a cumulative upgrade for Red Hat JBoss Fuse\nService Works 6.0.0. It includes various bug fixes, which are listed in the\nREADME file included with the patch files.\n\nThe following security issues are also fixed with this release:\n\nIt was found that the Apache Camel XSLT component allowed XSL stylesheets\nto call external Java methods. A remote attacker able to submit messages to\na Camel route could use this flaw to perform arbitrary remote code\nexecution in the context of the Camel server process. (CVE-2014-0003)\n\nIt was found that when JBoss Web processed a series of HTTP requests in\nwhich at least one request contained either multiple content-length\nheaders, or one content-length header with a chunked transfer-encoding\nheader, JBoss Web would incorrectly handle the request. A remote attacker\ncould use this flaw to poison a web cache, perform cross-site scripting\n(XSS) attacks, or obtain sensitive information from other requests.\n(CVE-2013-4286)\n\nIt was found that the Apache Camel XSLT component would resolve entities in\nXML messages when transforming them using an XSLT route. A remote attacker\nable to submit messages to an XSLT Camel route could use this flaw to read\nfiles accessible to the user running the application server and,\npotentially, perform other more advanced XML External Entity (XXE) attacks.\n(CVE-2014-0002)\n\nA denial of service flaw was found in the way Apache Commons FileUpload,\nwhich is embedded in the JBoss Web component of JBoss EAP, handled\nsmall-sized buffers used by MultipartStream. A remote attacker could use\nthis flaw to create a malformed Content-Type header for a multipart\nrequest, causing JBoss Web to enter an infinite loop when processing such\nan incoming request. (CVE-2014-0050)\n\nThe CVE-2014-0002 and CVE-2014-0003 issues were discovered by David Jorm of\nthe Red Hat Security Response Team.\n\nAll users of Red Hat JBoss Fuse Service Works 6.0.0 as provided from the\nRed Hat Customer Portal are advised to apply this roll up patch.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:0459",
        "url": "https://access.redhat.com/errata/RHSA-2014:0459"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse.serviceworks\u0026downloadType=securityPatches\u0026version=6.0.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse.serviceworks\u0026downloadType=securityPatches\u0026version=6.0.0"
      },
      {
        "category": "external",
        "summary": "1049675",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
      },
      {
        "category": "external",
        "summary": "1049692",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
      },
      {
        "category": "external",
        "summary": "1062337",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
      },
      {
        "category": "external",
        "summary": "1069921",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0459.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Fuse Service Works 6.0.0 security update",
    "tracking": {
      "current_release_date": "2024-12-08T10:41:06+00:00",
      "generator": {
        "date": "2024-12-08T10:41:06+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2014:0459",
      "initial_release_date": "2014-04-30T19:00:31+00:00",
      "revision_history": [
        {
          "date": "2014-04-30T19:00:31+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:32:11+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-08T10:41:06+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Fuse Service Works 6.0",
                "product": {
                  "name": "Red Hat JBoss Fuse Service Works 6.0",
                  "product_id": "Red Hat JBoss Fuse Service Works 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse_service_works:6.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Fuse Service Works"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2013-4286",
      "discovery_date": "2014-02-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1069921"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that when Tomcat / JBoss Web processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encoding header, Tomcat / JBoss Web would incorrectly handle the request. A remote attacker could use this flaw to poison a web cache, perform cross-site scripting (XSS) attacks, or obtain sensitive information from other requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: multiple content-length header poisoning flaws",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse Service Works 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4286"
        },
        {
          "category": "external",
          "summary": "RHBZ#1069921",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4286",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4286"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286"
        }
      ],
      "release_date": "2014-02-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-30T19:00:31+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss Fuse Service Works 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0459"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse Service Works 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: multiple content-length header poisoning flaws"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "David Jorm"
          ],
          "organization": "Red Hat Security Response Team",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2014-0002",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2014-01-07T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1049675"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Camel: XML eXternal Entity (XXE) flaw in XSLT component",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse Service Works 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0002"
        },
        {
          "category": "external",
          "summary": "RHBZ#1049675",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0002",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0002"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002"
        },
        {
          "category": "external",
          "summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc",
          "url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"
        }
      ],
      "release_date": "2014-02-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-30T19:00:31+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss Fuse Service Works 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0459"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse Service Works 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Camel: XML eXternal Entity (XXE) flaw in XSLT component"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "David Jorm"
          ],
          "organization": "Red Hat Security Response Team",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2014-0003",
      "discovery_date": "2014-01-07T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1049692"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Camel: remote code execution via XSL",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse Service Works 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0003"
        },
        {
          "category": "external",
          "summary": "RHBZ#1049692",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0003",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0003"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003"
        },
        {
          "category": "external",
          "summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc",
          "url": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc"
        }
      ],
      "release_date": "2014-02-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-30T19:00:31+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss Fuse Service Works 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0459"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse Service Works 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Camel: remote code execution via XSL"
    },
    {
      "cve": "CVE-2014-0050",
      "discovery_date": "2014-02-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1062337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in the way Apache Commons FileUpload, which is embedded in Tomcat and JBoss Web, handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing Tomcat to enter an infinite loop when processing such an incoming request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse Service Works 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "RHBZ#1062337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0050",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050"
        }
      ],
      "release_date": "2014-02-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-30T19:00:31+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss Fuse Service Works 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0459"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse Service Works 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated Red Hat JBoss Enterprise Application Platform 6.2.1 packages that\nfix one security issue are now available for Red Hat Enterprise Linux 5\nand 6.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform 6 is a platform for Java\napplications based on JBoss Application Server 7.\n\nA denial of service flaw was found in the way Apache Commons FileUpload,\nwhich is embedded in the JBoss Web component of JBoss EAP, handled\nsmall-sized buffers used by MultipartStream. A remote attacker could use\nthis flaw to create a malformed Content-Type header for a multipart\nrequest, causing JBoss Web to enter an infinite loop when processing such\nan incoming request. (CVE-2014-0050)\n\nWarning: Before applying this update, back up your existing Red Hat JBoss\nEnterprise Application Platform installation and deployed applications.\n\nAll users of Red Hat JBoss Enterprise Application Platform 6.2.1 on Red Hat\nEnterprise Linux 5 and 6 are advised to upgrade to these updated packages.\nThe JBoss server process must be restarted for the update to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:0253",
        "url": "https://access.redhat.com/errata/RHSA-2014:0253"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1062337",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0253.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 security update",
    "tracking": {
      "current_release_date": "2024-11-22T07:51:13+00:00",
      "generator": {
        "date": "2024-11-22T07:51:13+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2014:0253",
      "initial_release_date": "2014-03-05T19:05:24+00:00",
      "revision_history": [
        {
          "date": "2014-03-05T19:05:24+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-03-05T19:05:24+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T07:51:13+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server",
                  "product_id": "5Server-JBEAP-6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server",
                  "product_id": "6Server-JBEAP-6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el5.noarch",
                "product": {
                  "name": "jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el5.noarch",
                  "product_id": "jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbossweb@7.3.0-2.Final_redhat_2.1.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el6.noarch",
                "product": {
                  "name": "jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el6.noarch",
                  "product_id": "jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbossweb@7.3.0-2.Final_redhat_2.1.ep6.el6?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el5.src",
                "product": {
                  "name": "jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el5.src",
                  "product_id": "jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbossweb@7.3.0-2.Final_redhat_2.1.ep6.el5?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el6.src",
                "product": {
                  "name": "jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el6.src",
                  "product_id": "jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbossweb@7.3.0-2.Final_redhat_2.1.ep6.el6?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-6.2:jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el5.noarch"
        },
        "product_reference": "jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEAP-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el5.src as a component of Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-6.2:jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el5.src"
        },
        "product_reference": "jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el5.src",
        "relates_to_product_reference": "5Server-JBEAP-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6.2:jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el6.noarch"
        },
        "product_reference": "jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el6.src as a component of Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6.2:jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el6.src"
        },
        "product_reference": "jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el6.src",
        "relates_to_product_reference": "6Server-JBEAP-6.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-0050",
      "discovery_date": "2014-02-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1062337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in the way Apache Commons FileUpload, which is embedded in Tomcat and JBoss Web, handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing Tomcat to enter an infinite loop when processing such an incoming request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-JBEAP-6.2:jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el5.noarch",
          "5Server-JBEAP-6.2:jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el5.src",
          "6Server-JBEAP-6.2:jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el6.noarch",
          "6Server-JBEAP-6.2:jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el6.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "RHBZ#1062337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0050",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050"
        }
      ],
      "release_date": "2014-02-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-03-05T19:05:24+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied. Also, back up any customized Red\nHat JBoss Enterprise Application Platform 6 configuration files. On update,\nthe configuration files that have been locally modified will not be\nupdated. The updated version of such files will be stored as the rpmnew\nfiles. Make sure to locate any such files after the update and merge any\nchanges manually.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "5Server-JBEAP-6.2:jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.2:jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el5.src",
            "6Server-JBEAP-6.2:jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.2:jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el6.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0253"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "5Server-JBEAP-6.2:jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el5.noarch",
            "5Server-JBEAP-6.2:jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el5.src",
            "6Server-JBEAP-6.2:jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el6.noarch",
            "6Server-JBEAP-6.2:jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el6.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the Apache Commons Fileupload and JBoss Web components that\nfixes two security issues is now available from the Red Hat Customer Portal\nfor Red Hat JBoss BRMS 6.0.1 and Red Hat JBoss BPM Suite 6.0.1.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "JBoss Web Server is an enterprise ready web server designed for medium and\nlarge applications, and is based on Tomcat. JBoss Web Server provides\norganizations with a single deployment platform for Java Server Pages (JSP)\nand Java Servlet technologies, PHP, and CGI. It uses a genuine high\nperformance hybrid technology that incorporates the best of the most recent\nOS technologies for processing high volume data, while keeping all the\nreference Java specifications.\n\nApache Commons FileUpload package makes it easy to add robust,\nhigh-performance, file upload capability to servlets and web applications.\n\nIt was found that when JBoss Web processed a series of HTTP requests in\nwhich at least one request contained either multiple content-length\nheaders, or one content-length header with a chunked transfer-encoding\nheader, JBoss Web would incorrectly handle the request. A remote attacker\ncould use this flaw to poison a web cache, perform cross-site scripting\n(XSS) attacks, or obtain sensitive information from other requests.\n(CVE-2013-4286)\n\nA denial of service flaw was found in the way Apache Commons FileUpload,\nwhich is embedded in the JBoss Web component of JBoss EAP bundled with\nJBoss BRMS and BPM Suite, handled small-sized buffers used by\nMultipartStream. A remote attacker could use this flaw to create a\nmalformed Content-Type header for a multipart request, causing JBoss Web to\nenter an infinite loop when processing such an incoming request.\n(CVE-2014-0050)\n\nAll users of the affected products as provided from the Red Hat Customer\nPortal are advised to apply this update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:0373",
        "url": "https://access.redhat.com/errata/RHSA-2014:0373"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=securityPatches\u0026version=6.0.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=securityPatches\u0026version=6.0.1"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=securityPatches\u0026version=6.0.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=securityPatches\u0026version=6.0.1"
      },
      {
        "category": "external",
        "summary": "1062337",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
      },
      {
        "category": "external",
        "summary": "1069921",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0373.json"
      }
    ],
    "title": "Red Hat Security Advisory: Apache Commons Fileupload and JBoss Web security update",
    "tracking": {
      "current_release_date": "2024-12-08T10:41:49+00:00",
      "generator": {
        "date": "2024-12-08T10:41:49+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2014:0373",
      "initial_release_date": "2014-04-03T21:19:48+00:00",
      "revision_history": [
        {
          "date": "2014-04-03T21:19:48+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2020-06-15T16:41:29+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-08T10:41:49+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss BPMS 6.0",
                "product": {
                  "name": "Red Hat JBoss BPMS 6.0",
                  "product_id": "Red Hat JBoss BPMS 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_bpms:6.0"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss BRMS 6.0",
                "product": {
                  "name": "Red Hat JBoss BRMS 6.0",
                  "product_id": "Red Hat JBoss BRMS 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_brms:6.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Middleware"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2013-4286",
      "discovery_date": "2014-02-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1069921"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that when Tomcat / JBoss Web processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encoding header, Tomcat / JBoss Web would incorrectly handle the request. A remote attacker could use this flaw to poison a web cache, perform cross-site scripting (XSS) attacks, or obtain sensitive information from other requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: multiple content-length header poisoning flaws",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BPMS 6.0",
          "Red Hat JBoss BRMS 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4286"
        },
        {
          "category": "external",
          "summary": "RHBZ#1069921",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4286",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4286"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286"
        }
      ],
      "release_date": "2014-02-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-03T21:19:48+00:00",
          "details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the updates, back up\nyour existing installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss BPMS 6.0",
            "Red Hat JBoss BRMS 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0373"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss BPMS 6.0",
            "Red Hat JBoss BRMS 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: multiple content-length header poisoning flaws"
    },
    {
      "cve": "CVE-2014-0050",
      "discovery_date": "2014-02-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1062337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in the way Apache Commons FileUpload, which is embedded in Tomcat and JBoss Web, handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing Tomcat to enter an infinite loop when processing such an incoming request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BPMS 6.0",
          "Red Hat JBoss BRMS 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "RHBZ#1062337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0050",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050"
        }
      ],
      "release_date": "2014-02-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-03T21:19:48+00:00",
          "details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the updates, back up\nyour existing installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss BPMS 6.0",
            "Red Hat JBoss BRMS 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0373"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss BPMS 6.0",
            "Red Hat JBoss BRMS 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated tomcat6 packages that fix multiple security issues are now\navailable for Red Hat JBoss Web Server 2.0.1 on Red Hat Enterprise Linux 5\nand 6.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Web Server is a fully integrated and certified set of\ncomponents for hosting Java web applications. It is comprised of the Apache\nHTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector\n(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat\nNative library.\n\nIt was found that when Tomcat processed a series of HTTP requests in which\nat least one request contained either multiple content-length headers, or\none content-length header with a chunked transfer-encoding header, Tomcat\nwould incorrectly handle the request. A remote attacker could use this flaw\nto poison a web cache, perform cross-site scripting (XSS) attacks, or\nobtain sensitive information from other requests. (CVE-2013-4286)\n\nIt was discovered that the fix for CVE-2012-3544 did not properly resolve a\ndenial of service flaw in the way Tomcat processed chunk extensions and\ntrailing headers in chunked requests. A remote attacker could use this flaw\nto send an excessively long request that, when processed by Tomcat, could\nconsume network bandwidth, CPU, and memory on the Tomcat server. Note that\nchunked transfer encoding is enabled by default. (CVE-2013-4322)\n\nIt was found that previous fixes in Tomcat 6 to path parameter handling\nintroduced a regression that caused Tomcat to not properly disable URL\nrewriting to track session IDs when the disableURLRewriting option was\nenabled. A man-in-the-middle attacker could potentially use this flaw to\nhijack a user\u0027s session. (CVE-2014-0033)\n\nA denial of service flaw was found in the way Apache Commons FileUpload,\nwhich is embedded in Tomcat, handled small-sized buffers used by\nMultipartStream. A remote attacker could use this flaw to create a\nmalformed Content-Type header for a multipart request, causing Tomcat to\nenter an infinite loop when processing such an incoming request.\n(CVE-2014-0050)\n\nAll users of Red Hat JBoss Web Server 2.0.1 are advised to upgrade to these\nupdated tomcat6 packages, which contain backported patches to correct these\nissues. The Red Hat JBoss Web Server process must be restarted for the\nupdate to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:0525",
        "url": "https://access.redhat.com/errata/RHSA-2014:0525"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1062337",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
      },
      {
        "category": "external",
        "summary": "1069905",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069905"
      },
      {
        "category": "external",
        "summary": "1069919",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069919"
      },
      {
        "category": "external",
        "summary": "1069921",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0525.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat6 security update",
    "tracking": {
      "current_release_date": "2024-12-08T10:41:36+00:00",
      "generator": {
        "date": "2024-12-08T10:41:36+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2014:0525",
      "initial_release_date": "2014-05-21T15:45:35+00:00",
      "revision_history": [
        {
          "date": "2014-05-21T15:45:35+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-05-21T15:45:35+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-08T10:41:36+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
                  "product_id": "5Server-JBEWS-2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
                  "product_id": "6Server-JBEWS-2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Web Server"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat6-javadoc-0:6.0.37-19_patch_04.ep6.el5.noarch",
                "product": {
                  "name": "tomcat6-javadoc-0:6.0.37-19_patch_04.ep6.el5.noarch",
                  "product_id": "tomcat6-javadoc-0:6.0.37-19_patch_04.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-javadoc@6.0.37-19_patch_04.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-el-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
                "product": {
                  "name": "tomcat6-el-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
                  "product_id": "tomcat6-el-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-el-2.1-api@6.0.37-19_patch_04.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-servlet-2.5-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
                "product": {
                  "name": "tomcat6-servlet-2.5-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
                  "product_id": "tomcat6-servlet-2.5-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-servlet-2.5-api@6.0.37-19_patch_04.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-admin-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
                "product": {
                  "name": "tomcat6-admin-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
                  "product_id": "tomcat6-admin-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-admin-webapps@6.0.37-19_patch_04.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-lib-0:6.0.37-19_patch_04.ep6.el5.noarch",
                "product": {
                  "name": "tomcat6-lib-0:6.0.37-19_patch_04.ep6.el5.noarch",
                  "product_id": "tomcat6-lib-0:6.0.37-19_patch_04.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-lib@6.0.37-19_patch_04.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-docs-webapp-0:6.0.37-19_patch_04.ep6.el5.noarch",
                "product": {
                  "name": "tomcat6-docs-webapp-0:6.0.37-19_patch_04.ep6.el5.noarch",
                  "product_id": "tomcat6-docs-webapp-0:6.0.37-19_patch_04.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-docs-webapp@6.0.37-19_patch_04.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-log4j-0:6.0.37-19_patch_04.ep6.el5.noarch",
                "product": {
                  "name": "tomcat6-log4j-0:6.0.37-19_patch_04.ep6.el5.noarch",
                  "product_id": "tomcat6-log4j-0:6.0.37-19_patch_04.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-log4j@6.0.37-19_patch_04.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-0:6.0.37-19_patch_04.ep6.el5.noarch",
                "product": {
                  "name": "tomcat6-0:6.0.37-19_patch_04.ep6.el5.noarch",
                  "product_id": "tomcat6-0:6.0.37-19_patch_04.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6@6.0.37-19_patch_04.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
                "product": {
                  "name": "tomcat6-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
                  "product_id": "tomcat6-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-webapps@6.0.37-19_patch_04.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-jsp-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
                "product": {
                  "name": "tomcat6-jsp-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
                  "product_id": "tomcat6-jsp-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-jsp-2.1-api@6.0.37-19_patch_04.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-docs-webapp-0:6.0.37-27_patch_04.ep6.el6.noarch",
                "product": {
                  "name": "tomcat6-docs-webapp-0:6.0.37-27_patch_04.ep6.el6.noarch",
                  "product_id": "tomcat6-docs-webapp-0:6.0.37-27_patch_04.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-docs-webapp@6.0.37-27_patch_04.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-el-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
                "product": {
                  "name": "tomcat6-el-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
                  "product_id": "tomcat6-el-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-el-2.1-api@6.0.37-27_patch_04.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-admin-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch",
                "product": {
                  "name": "tomcat6-admin-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch",
                  "product_id": "tomcat6-admin-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-admin-webapps@6.0.37-27_patch_04.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-0:6.0.37-27_patch_04.ep6.el6.noarch",
                "product": {
                  "name": "tomcat6-0:6.0.37-27_patch_04.ep6.el6.noarch",
                  "product_id": "tomcat6-0:6.0.37-27_patch_04.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6@6.0.37-27_patch_04.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-servlet-2.5-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
                "product": {
                  "name": "tomcat6-servlet-2.5-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
                  "product_id": "tomcat6-servlet-2.5-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-servlet-2.5-api@6.0.37-27_patch_04.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch",
                "product": {
                  "name": "tomcat6-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch",
                  "product_id": "tomcat6-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-webapps@6.0.37-27_patch_04.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-javadoc-0:6.0.37-27_patch_04.ep6.el6.noarch",
                "product": {
                  "name": "tomcat6-javadoc-0:6.0.37-27_patch_04.ep6.el6.noarch",
                  "product_id": "tomcat6-javadoc-0:6.0.37-27_patch_04.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-javadoc@6.0.37-27_patch_04.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-lib-0:6.0.37-27_patch_04.ep6.el6.noarch",
                "product": {
                  "name": "tomcat6-lib-0:6.0.37-27_patch_04.ep6.el6.noarch",
                  "product_id": "tomcat6-lib-0:6.0.37-27_patch_04.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-lib@6.0.37-27_patch_04.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-jsp-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
                "product": {
                  "name": "tomcat6-jsp-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
                  "product_id": "tomcat6-jsp-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-jsp-2.1-api@6.0.37-27_patch_04.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-log4j-0:6.0.37-27_patch_04.ep6.el6.noarch",
                "product": {
                  "name": "tomcat6-log4j-0:6.0.37-27_patch_04.ep6.el6.noarch",
                  "product_id": "tomcat6-log4j-0:6.0.37-27_patch_04.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-log4j@6.0.37-27_patch_04.ep6.el6?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat6-0:6.0.37-19_patch_04.ep6.el5.src",
                "product": {
                  "name": "tomcat6-0:6.0.37-19_patch_04.ep6.el5.src",
                  "product_id": "tomcat6-0:6.0.37-19_patch_04.ep6.el5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6@6.0.37-19_patch_04.ep6.el5?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-0:6.0.37-27_patch_04.ep6.el6.src",
                "product": {
                  "name": "tomcat6-0:6.0.37-27_patch_04.ep6.el6.src",
                  "product_id": "tomcat6-0:6.0.37-27_patch_04.ep6.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6@6.0.37-27_patch_04.ep6.el6?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-0:6.0.37-19_patch_04.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.noarch"
        },
        "product_reference": "tomcat6-0:6.0.37-19_patch_04.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-0:6.0.37-19_patch_04.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.src"
        },
        "product_reference": "tomcat6-0:6.0.37-19_patch_04.ep6.el5.src",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-admin-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch"
        },
        "product_reference": "tomcat6-admin-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-docs-webapp-0:6.0.37-19_patch_04.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-19_patch_04.ep6.el5.noarch"
        },
        "product_reference": "tomcat6-docs-webapp-0:6.0.37-19_patch_04.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-el-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch"
        },
        "product_reference": "tomcat6-el-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-javadoc-0:6.0.37-19_patch_04.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-19_patch_04.ep6.el5.noarch"
        },
        "product_reference": "tomcat6-javadoc-0:6.0.37-19_patch_04.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-jsp-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch"
        },
        "product_reference": "tomcat6-jsp-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-lib-0:6.0.37-19_patch_04.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat6-lib-0:6.0.37-19_patch_04.ep6.el5.noarch"
        },
        "product_reference": "tomcat6-lib-0:6.0.37-19_patch_04.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-log4j-0:6.0.37-19_patch_04.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-19_patch_04.ep6.el5.noarch"
        },
        "product_reference": "tomcat6-log4j-0:6.0.37-19_patch_04.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-servlet-2.5-api-0:6.0.37-19_patch_04.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-19_patch_04.ep6.el5.noarch"
        },
        "product_reference": "tomcat6-servlet-2.5-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch"
        },
        "product_reference": "tomcat6-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-0:6.0.37-27_patch_04.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.noarch"
        },
        "product_reference": "tomcat6-0:6.0.37-27_patch_04.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-0:6.0.37-27_patch_04.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.src"
        },
        "product_reference": "tomcat6-0:6.0.37-27_patch_04.ep6.el6.src",
        "relates_to_product_reference": "6Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-admin-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch"
        },
        "product_reference": "tomcat6-admin-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-docs-webapp-0:6.0.37-27_patch_04.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-27_patch_04.ep6.el6.noarch"
        },
        "product_reference": "tomcat6-docs-webapp-0:6.0.37-27_patch_04.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-el-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch"
        },
        "product_reference": "tomcat6-el-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-javadoc-0:6.0.37-27_patch_04.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-27_patch_04.ep6.el6.noarch"
        },
        "product_reference": "tomcat6-javadoc-0:6.0.37-27_patch_04.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-jsp-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch"
        },
        "product_reference": "tomcat6-jsp-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-lib-0:6.0.37-27_patch_04.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat6-lib-0:6.0.37-27_patch_04.ep6.el6.noarch"
        },
        "product_reference": "tomcat6-lib-0:6.0.37-27_patch_04.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-log4j-0:6.0.37-27_patch_04.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-27_patch_04.ep6.el6.noarch"
        },
        "product_reference": "tomcat6-log4j-0:6.0.37-27_patch_04.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-servlet-2.5-api-0:6.0.37-27_patch_04.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-27_patch_04.ep6.el6.noarch"
        },
        "product_reference": "tomcat6-servlet-2.5-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch"
        },
        "product_reference": "tomcat6-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWS-2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2013-4286",
      "discovery_date": "2014-02-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1069921"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that when Tomcat / JBoss Web processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encoding header, Tomcat / JBoss Web would incorrectly handle the request. A remote attacker could use this flaw to poison a web cache, perform cross-site scripting (XSS) attacks, or obtain sensitive information from other requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: multiple content-length header poisoning flaws",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.src",
          "5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-lib-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.src",
          "6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-lib-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4286"
        },
        {
          "category": "external",
          "summary": "RHBZ#1069921",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4286",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4286"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286"
        }
      ],
      "release_date": "2014-02-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-05-21T15:45:35+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.src",
            "5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-lib-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.src",
            "6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-lib-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0525"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.src",
            "5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-lib-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.src",
            "6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-lib-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: multiple content-length header poisoning flaws"
    },
    {
      "cve": "CVE-2013-4322",
      "discovery_date": "2014-02-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1069905"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that the fix for CVE-2012-3544 did not properly resolve a denial of service flaw in the way Tomcat and JBoss Web processed chunk extensions and trailing headers in chunked requests. A remote attacker could use this flaw to send an excessively long request that, when processed by Tomcat, could consume network bandwidth, CPU, and memory on the Tomcat server. Note that chunked transfer encoding is enabled by default.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: incomplete fix for CVE-2012-3544",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.src",
          "5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-lib-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.src",
          "6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-lib-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4322"
        },
        {
          "category": "external",
          "summary": "RHBZ#1069905",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069905"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4322",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4322"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4322",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4322"
        }
      ],
      "release_date": "2014-02-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-05-21T15:45:35+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.src",
            "5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-lib-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.src",
            "6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-lib-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0525"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.src",
            "5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-lib-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.src",
            "6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-lib-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: incomplete fix for CVE-2012-3544"
    },
    {
      "cve": "CVE-2014-0033",
      "cwe": {
        "id": "CWE-384",
        "name": "Session Fixation"
      },
      "discovery_date": "2014-02-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1069919"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that previous fixes in Tomcat 6 to path parameter handling introduced a regression that caused Tomcat to not properly disable URL rewriting to track session IDs when the disableURLRewriting option was enabled. A man-in-the-middle attacker could potentially use this flaw to hijack a user\u0027s session.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: session fixation still possible with disableURLRewriting enabled",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did not affect JBoss Web, as shipped with various Red Hat JBoss products.\n\nThe disableURLRewriting property was introduced in Apache Tomcat 6.0.30. All versions of Apache Tomcat prior to 6.0.30 are not affected by this flaw, as the affected feature is not present.\n\nTomcat 6 as shipped with Red Hat JBoss Web Server 2.0.0 and above is affected by this flaw. Tomcat 6 as shipped with Red Hat JBoss Web Server 1.0.2 is not affected by this flaw. Tomcat 6 as shipped with Red Hat JBoss Web Server prior to 1.0.2 is not affected by this flaw, as the disableURLRewriting property is not supported. \n\nTomcat 6 as shipped with Red Hat Enterprise Linux 6 is based on Apache Tomcat 6.0.24 and is not affected by this flaw, as this flaw was introduced only in Apache Tomcat 6.0.33.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.src",
          "5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-lib-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.src",
          "6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-lib-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0033"
        },
        {
          "category": "external",
          "summary": "RHBZ#1069919",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069919"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0033",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0033"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0033",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0033"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/site/solutions/88203",
          "url": "https://access.redhat.com/site/solutions/88203"
        }
      ],
      "release_date": "2014-02-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-05-21T15:45:35+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.src",
            "5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-lib-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.src",
            "6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-lib-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0525"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.src",
            "5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-lib-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.src",
            "6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-lib-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: session fixation still possible with disableURLRewriting enabled"
    },
    {
      "cve": "CVE-2014-0050",
      "discovery_date": "2014-02-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1062337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in the way Apache Commons FileUpload, which is embedded in Tomcat and JBoss Web, handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing Tomcat to enter an infinite loop when processing such an incoming request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.src",
          "5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-lib-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
          "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.src",
          "6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-lib-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "RHBZ#1062337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0050",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050"
        }
      ],
      "release_date": "2014-02-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-05-21T15:45:35+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.src",
            "5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-lib-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.src",
            "6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-lib-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0525"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-0:6.0.37-19_patch_04.ep6.el5.src",
            "5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-lib-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-19_patch_04.ep6.el5.noarch",
            "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-0:6.0.37-27_patch_04.ep6.el6.src",
            "6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-lib-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-27_patch_04.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-27_patch_04.ep6.el6.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss A-MQ 6.1.0, which fixes multiple security issues, several\nbugs, and adds various enhancements, is now available from the Red Hat\nCustomer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nModerate security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards-compliant\nmessaging system that is tailored for use in mission critical applications.\n\nRed Hat JBoss A-MQ 6.1.0 is a minor product release that updates Red Hat\nJBoss A-MQ 6.0.0 and includes several bug fixes and enhancements. Refer to\nthe Release Notes document, available from the link in the References\nsection, for a list of changes.\n\nThe following security issues are resolved with this update:\n\nA flaw was found in the Apache Hadoop RPC protocol. A man-in-the-middle\nattacker could possibly use this flaw to unilaterally disable bidirectional\nauthentication between a client and a server, forcing a downgrade to simple\n(unidirectional) authentication. This flaw only affected users who have\nenabled Hadoop\u0027s Kerberos security features. (CVE-2013-2192)\n\nIt was discovered that the Spring OXM wrapper did not expose any property\nfor disabling entity resolution when using the JAXB unmarshaller. A remote\nattacker could use this flaw to conduct XML External Entity (XXE) attacks\non web sites, and read files in the context of the user running the\napplication server. The patch for this flaw disables external entity\nprocessing by default, and provides a configuration directive to re-enable\nit. (CVE-2013-4152)\n\nIt was found that the Spring MVC SourceHttpMessageConverter enabled entity\nresolution by default. A remote attacker could use this flaw to conduct XXE\nattacks on web sites, and read files in the context of the user running the\napplication server. The patch for this flaw disables external entity\nprocessing by default, and introduces a property to re-enable it.\n(CVE-2013-6429)\n\nThe Spring JavaScript escape method insufficiently escaped some characters.\nApplications using this method to escape user-supplied content, which would\nbe rendered in HTML5 documents, could be exposed to cross-site scripting\n(XSS) flaws. (CVE-2013-6430)\n\nA denial of service flaw was found in the way Apache Commons FileUpload\nhandled small-sized buffers used by MultipartStream. A remote attacker\ncould use this flaw to create a malformed Content-Type header for a\nmultipart request, causing Apache Commons FileUpload to enter an infinite\nloop when processing such an incoming request. (CVE-2014-0050)\n\nIt was found that fixes for the CVE-2013-4152 and CVE-2013-6429 XXE issues\nin Spring were incomplete. Spring MVC processed user-provided XML and\nneither disabled XML external entities nor provided an option to disable\nthem, possibly allowing a remote attacker to conduct XXE attacks.\n(CVE-2014-0054)\n\nA cross-site scripting (XSS) flaw was found in the Spring Framework when\nusing Spring MVC. When the action was not specified in a Spring form, the\naction field would be populated with the requested URI, allowing an\nattacker to inject malicious content into the form. (CVE-2014-1904)\n\nThe HawtJNI Library class wrote native libraries to a predictable file name\nin /tmp when the native libraries were bundled in a JAR file, and no custom\nlibrary path was specified. A local attacker could overwrite these native\nlibraries with malicious versions during the window between when HawtJNI\nwrites them and when they are executed. (CVE-2013-2035)\n\nAn information disclosure flaw was found in the way Apache Zookeeper stored\nthe password of an administrative user in the log files. A local user with\naccess to these log files could use the exposed sensitive information to\ngain administrative access to an application using Apache Zookeeper.\n(CVE-2014-0085)\n\nThe CVE-2013-6430 issue was discovered by Jon Passki of Coverity SRL and\nArun Neelicattu of the Red Hat Security Response Team, the CVE-2013-2035\nissue was discovered by Florian Weimer of the Red Hat Product Security\nTeam, and the CVE-2014-0085 issue was discovered by Graeme Colman of\nRed Hat.\n\nAll users of Red Hat JBoss A-MQ 6.0.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:0401",
        "url": "https://access.redhat.com/errata/RHSA-2014:0401"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=distributions\u0026version=6.1.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=distributions\u0026version=6.1.0"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_A-MQ/",
        "url": "https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_A-MQ/"
      },
      {
        "category": "external",
        "summary": "958618",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=958618"
      },
      {
        "category": "external",
        "summary": "1000186",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1000186"
      },
      {
        "category": "external",
        "summary": "1001326",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1001326"
      },
      {
        "category": "external",
        "summary": "1039783",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1039783"
      },
      {
        "category": "external",
        "summary": "1053290",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1053290"
      },
      {
        "category": "external",
        "summary": "1062337",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
      },
      {
        "category": "external",
        "summary": "1067265",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1067265"
      },
      {
        "category": "external",
        "summary": "1075296",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1075296"
      },
      {
        "category": "external",
        "summary": "1075328",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1075328"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0401.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss A-MQ 6.1.0 update",
    "tracking": {
      "current_release_date": "2024-11-22T08:11:43+00:00",
      "generator": {
        "date": "2024-11-22T08:11:43+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2014:0401",
      "initial_release_date": "2014-04-14T13:46:41+00:00",
      "revision_history": [
        {
          "date": "2014-04-14T13:46:41+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:33:04+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T08:11:43+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss A-MQ 6.1",
                "product": {
                  "name": "Red Hat JBoss A-MQ 6.1",
                  "product_id": "Red Hat JBoss A-MQ 6.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_amq:6.1.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss AMQ"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2013-1624",
      "cwe": {
        "id": "CWE-385",
        "name": "Covert Timing Channel"
      },
      "discovery_date": "2013-02-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "908428"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that bouncycastle leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bouncycastle: TLS CBC padding timing attack",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-1624"
        },
        {
          "category": "external",
          "summary": "RHBZ#908428",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=908428"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-1624",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-1624"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1624",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1624"
        },
        {
          "category": "external",
          "summary": "http://www.isg.rhul.ac.uk/tls/",
          "url": "http://www.isg.rhul.ac.uk/tls/"
        },
        {
          "category": "external",
          "summary": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf",
          "url": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf"
        }
      ],
      "release_date": "2013-02-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:41+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0401"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "bouncycastle: TLS CBC padding timing attack"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Florian Weimer"
          ],
          "organization": "Red Hat Product Security Team",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2013-2035",
      "cwe": {
        "id": "CWE-377",
        "name": "Insecure Temporary File"
      },
      "discovery_date": "2013-04-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "958618"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The HawtJNI Library class wrote native libraries to a predictable file name in /tmp when the native libraries were bundled in a JAR file, and no custom library path was specified. A local attacker could overwrite these native libraries with malicious versions during the window between when HawtJNI writes them and when they are executed.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "HawtJNI: predictable temporary file name leading to local arbitrary code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-2035"
        },
        {
          "category": "external",
          "summary": "RHBZ#958618",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=958618"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-2035",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-2035"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-2035",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2035"
        }
      ],
      "release_date": "2013-05-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:41+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0401"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "HawtJNI: predictable temporary file name leading to local arbitrary code execution"
    },
    {
      "cve": "CVE-2013-2192",
      "discovery_date": "2013-08-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1001326"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "hadoop: man-in-the-middle vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-2192"
        },
        {
          "category": "external",
          "summary": "RHBZ#1001326",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1001326"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-2192",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-2192"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-2192",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2192"
        }
      ],
      "release_date": "2013-08-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:41+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0401"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "ADJACENT_NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 3.2,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:A/AC:H/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "hadoop: man-in-the-middle vulnerability"
    },
    {
      "cve": "CVE-2013-4152",
      "discovery_date": "2013-08-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1000186"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Framework: XML External Entity (XXE) injection flaw",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4152"
        },
        {
          "category": "external",
          "summary": "RHBZ#1000186",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1000186"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4152",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4152"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4152",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4152"
        },
        {
          "category": "external",
          "summary": "http://www.gopivotal.com/security/cve-2013-4152",
          "url": "http://www.gopivotal.com/security/cve-2013-4152"
        },
        {
          "category": "external",
          "summary": "https://github.com/SpringSource/spring-framework/pull/317",
          "url": "https://github.com/SpringSource/spring-framework/pull/317"
        },
        {
          "category": "external",
          "summary": "https://jira.springsource.org/browse/SPR-10806",
          "url": "https://jira.springsource.org/browse/SPR-10806"
        }
      ],
      "release_date": "2013-08-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:41+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0401"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Framework: XML External Entity (XXE) injection flaw"
    },
    {
      "cve": "CVE-2013-6429",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2014-01-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1053290"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Framework: XML External Entity (XXE) injection flaw",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-6429"
        },
        {
          "category": "external",
          "summary": "RHBZ#1053290",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1053290"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-6429",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-6429"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6429",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6429"
        },
        {
          "category": "external",
          "summary": "http://www.gopivotal.com/security/cve-2013-6429",
          "url": "http://www.gopivotal.com/security/cve-2013-6429"
        }
      ],
      "release_date": "2014-01-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:41+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0401"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Framework: XML External Entity (XXE) injection flaw"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Jon Passki"
          ],
          "organization": "Coverity SRL"
        },
        {
          "names": [
            "Arun Neelicattu"
          ],
          "organization": "Red Hat Security Response Team",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2013-6430",
      "discovery_date": "2013-12-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1039783"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Framework: org.spring.web.util.JavaScriptUtils.javaScriptEscape insufficient escaping of characters",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-6430"
        },
        {
          "category": "external",
          "summary": "RHBZ#1039783",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1039783"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-6430",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-6430"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6430",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6430"
        },
        {
          "category": "external",
          "summary": "http://www.gopivotal.com/security/cve-2013-6430",
          "url": "http://www.gopivotal.com/security/cve-2013-6430"
        }
      ],
      "release_date": "2014-01-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:41+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0401"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Framework: org.spring.web.util.JavaScriptUtils.javaScriptEscape insufficient escaping of characters"
    },
    {
      "cve": "CVE-2014-0050",
      "discovery_date": "2014-02-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1062337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in the way Apache Commons FileUpload, which is embedded in Tomcat and JBoss Web, handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing Tomcat to enter an infinite loop when processing such an incoming request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "RHBZ#1062337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0050",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050"
        }
      ],
      "release_date": "2014-02-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:41+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0401"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream"
    },
    {
      "cve": "CVE-2014-0054",
      "discovery_date": "2014-03-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1075328"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Framework: incomplete fix for CVE-2013-7315/CVE-2013-6429",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Security Response Team has rated this issue as having Moderate security impact. OpenShift Enterprise 1 is currently in the Production 1 phase of its lifecycle, as such this issue is not currently planned to be addressed in future updates. For additional information, refer to the Satellite Life Cycle: https://access.redhat.com/site/support/policy/updates/openshift page.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0054"
        },
        {
          "category": "external",
          "summary": "RHBZ#1075328",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1075328"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0054",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0054"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0054",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0054"
        },
        {
          "category": "external",
          "summary": "http://www.gopivotal.com/security/cve-2014-0054",
          "url": "http://www.gopivotal.com/security/cve-2014-0054"
        }
      ],
      "release_date": "2014-01-31T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:41+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0401"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Framework: incomplete fix for CVE-2013-7315/CVE-2013-6429"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Graeme Colman"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2014-0085",
      "cwe": {
        "id": "CWE-522",
        "name": "Insufficiently Protected Credentials"
      },
      "discovery_date": "2014-02-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1067265"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. This issue is a vulnerability in JBoss Fuse\u0027s usage of Apache Zookeeper, not in Zookeeper itself as was previously stated.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Fuse: admin user cleartext password appears in logging",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw only affects Apache Zookeeper in conjunction with Fuse Fabric. Fuse Fabric was storing cleartext passwords, which would appear as cleartext in Apache Zookeeper\u0027s log files. Fuse Fabric now encrypts passwords by default.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0085"
        },
        {
          "category": "external",
          "summary": "RHBZ#1067265",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1067265"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0085",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0085"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0085",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0085"
        }
      ],
      "release_date": "2014-04-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:41+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0401"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 2.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Fuse: admin user cleartext password appears in logging"
    },
    {
      "cve": "CVE-2014-1904",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2014-03-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1075296"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Framework: cross-site scripting flaw when using Spring MVC",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Security Response Team has rated this issue as having Moderate security impact. OpenShift Enterprise 1 is currently in the Production 1 phase of its lifecycle, as such this issue is not currently planned to be addressed in future updates. For additional information, refer to the Satellite Life Cycle: https://access.redhat.com/site/support/policy/updates/openshift page.\n\nFuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-1904"
        },
        {
          "category": "external",
          "summary": "RHBZ#1075296",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1075296"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-1904",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-1904"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-1904",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1904"
        },
        {
          "category": "external",
          "summary": "http://www.gopivotal.com/security/cve-2014-1904",
          "url": "http://www.gopivotal.com/security/cve-2014-1904"
        }
      ],
      "release_date": "2014-02-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:41+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0401"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Framework: cross-site scripting flaw when using Spring MVC"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the Apache Tomcat 7 component for Red Hat JBoss Web Server\n2.0.1 that fixes three security issues is now available from the Red Hat\nCustomer Portal.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Web Server is a fully integrated and certified set of\ncomponents for hosting Java web applications. It is comprised of the Apache\nHTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector\n(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat\nNative library.\n\nIt was found that when Tomcat processed a series of HTTP requests in which\nat least one request contained either multiple content-length headers, or\none content-length header with a chunked transfer-encoding header, Tomcat\nwould incorrectly handle the request. A remote attacker could use this flaw\nto poison a web cache, perform cross-site scripting (XSS) attacks, or\nobtain sensitive information from other requests. (CVE-2013-4286)\n\nIt was discovered that the fix for CVE-2012-3544 did not properly resolve a\ndenial of service flaw in the way Tomcat processed chunk extensions and\ntrailing headers in chunked requests. A remote attacker could use this flaw\nto send an excessively long request that, when processed by Tomcat, could\nconsume network bandwidth, CPU, and memory on the Tomcat server. Note that\nchunked transfer encoding is enabled by default. (CVE-2013-4322)\n\nA denial of service flaw was found in the way Apache Commons FileUpload,\nwhich is embedded in Tomcat, handled small-sized buffers used by\nMultipartStream. A remote attacker could use this flaw to create a\nmalformed Content-Type header for a multipart request, causing Tomcat to\nenter an infinite loop when processing such an incoming request.\n(CVE-2014-0050)\n\nAll users of Red Hat JBoss Web Server 2.0.1 as provided from the Red Hat\nCustomer Portal are advised to apply this update. The Red Hat JBoss Web\nServer process must be restarted for the update to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:0527",
        "url": "https://access.redhat.com/errata/RHSA-2014:0527"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver\u0026downloadType=securityPatches\u0026version=2.0.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver\u0026downloadType=securityPatches\u0026version=2.0.1"
      },
      {
        "category": "external",
        "summary": "1062337",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
      },
      {
        "category": "external",
        "summary": "1069905",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069905"
      },
      {
        "category": "external",
        "summary": "1069921",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0527.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat7 security update",
    "tracking": {
      "current_release_date": "2024-12-08T10:42:16+00:00",
      "generator": {
        "date": "2024-12-08T10:42:16+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2014:0527",
      "initial_release_date": "2014-05-21T15:45:31+00:00",
      "revision_history": [
        {
          "date": "2014-05-21T15:45:31+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:33:13+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-08T10:42:16+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Web Server 2.0",
                "product": {
                  "name": "Red Hat JBoss Web Server 2.0",
                  "product_id": "Red Hat JBoss Web Server 2.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Web Server"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2013-4286",
      "discovery_date": "2014-02-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1069921"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that when Tomcat / JBoss Web processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encoding header, Tomcat / JBoss Web would incorrectly handle the request. A remote attacker could use this flaw to poison a web cache, perform cross-site scripting (XSS) attacks, or obtain sensitive information from other requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: multiple content-length header poisoning flaws",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Web Server 2.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4286"
        },
        {
          "category": "external",
          "summary": "RHBZ#1069921",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4286",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4286"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286"
        }
      ],
      "release_date": "2014-02-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-05-21T15:45:31+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files).",
          "product_ids": [
            "Red Hat JBoss Web Server 2.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0527"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Web Server 2.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: multiple content-length header poisoning flaws"
    },
    {
      "cve": "CVE-2013-4322",
      "discovery_date": "2014-02-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1069905"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that the fix for CVE-2012-3544 did not properly resolve a denial of service flaw in the way Tomcat and JBoss Web processed chunk extensions and trailing headers in chunked requests. A remote attacker could use this flaw to send an excessively long request that, when processed by Tomcat, could consume network bandwidth, CPU, and memory on the Tomcat server. Note that chunked transfer encoding is enabled by default.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: incomplete fix for CVE-2012-3544",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Web Server 2.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4322"
        },
        {
          "category": "external",
          "summary": "RHBZ#1069905",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069905"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4322",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4322"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4322",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4322"
        }
      ],
      "release_date": "2014-02-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-05-21T15:45:31+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files).",
          "product_ids": [
            "Red Hat JBoss Web Server 2.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0527"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Web Server 2.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: incomplete fix for CVE-2012-3544"
    },
    {
      "cve": "CVE-2014-0050",
      "discovery_date": "2014-02-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1062337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in the way Apache Commons FileUpload, which is embedded in Tomcat and JBoss Web, handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing Tomcat to enter an infinite loop when processing such an incoming request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Web Server 2.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "RHBZ#1062337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0050",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050"
        }
      ],
      "release_date": "2014-02-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-05-21T15:45:31+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files).",
          "product_ids": [
            "Red Hat JBoss Web Server 2.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0527"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Web Server 2.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat JBoss Enterprise Application Platform 6.2.1 that\nfixes one security issue is now available from the Red Hat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform 6 is a platform for Java\napplications based on JBoss Application Server 7.\n\nA denial of service flaw was found in the way Apache Commons FileUpload,\nwhich is embedded in the JBoss Web component of JBoss EAP, handled\nsmall-sized buffers used by MultipartStream. A remote attacker could use\nthis flaw to create a malformed Content-Type header for a multipart\nrequest, causing JBoss Web to enter an infinite loop when processing such\nan incoming request. (CVE-2014-0050)\n\nAll users of Red Hat JBoss Enterprise Application Platform 6.2.1 as\nprovided from the Red Hat Customer Portal are advised to apply this update.\nThe JBoss server process must be restarted for the update to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:0252",
        "url": "https://access.redhat.com/errata/RHSA-2014:0252"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform\u0026downloadType=securityPatches\u0026version=6.2.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform\u0026downloadType=securityPatches\u0026version=6.2.0"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/site/solutions/625683",
        "url": "https://access.redhat.com/site/solutions/625683"
      },
      {
        "category": "external",
        "summary": "1062337",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0252.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 security update",
    "tracking": {
      "current_release_date": "2024-11-22T07:51:09+00:00",
      "generator": {
        "date": "2024-11-22T07:51:09+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2014:0252",
      "initial_release_date": "2014-03-05T19:05:35+00:00",
      "revision_history": [
        {
          "date": "2014-03-05T19:05:35+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:31:39+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T07:51:09+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6.2",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6.2",
                  "product_id": "Red Hat JBoss Enterprise Application Platform 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-0050",
      "discovery_date": "2014-02-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1062337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in the way Apache Commons FileUpload, which is embedded in Tomcat and JBoss Web, handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing Tomcat to enter an infinite loop when processing such an incoming request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "RHBZ#1062337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0050",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050"
        }
      ],
      "release_date": "2014-02-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-03-05T19:05:35+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting Red Hat JBoss Enterprise Application Platform installation and\ndeployed applications.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0252"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated tomcat7 packages that fix three security issues are now available\nfor Red Hat JBoss Web Server 2.0.1 on Red Hat Enterprise Linux 5 and 6.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Web Server is a fully integrated and certified set of\ncomponents for hosting Java web applications. It is comprised of the Apache\nHTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector\n(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat\nNative library.\n\nIt was found that when Tomcat processed a series of HTTP requests in which\nat least one request contained either multiple content-length headers, or\none content-length header with a chunked transfer-encoding header, Tomcat\nwould incorrectly handle the request. A remote attacker could use this flaw\nto poison a web cache, perform cross-site scripting (XSS) attacks, or\nobtain sensitive information from other requests. (CVE-2013-4286)\n\nIt was discovered that the fix for CVE-2012-3544 did not properly resolve a\ndenial of service flaw in the way Tomcat processed chunk extensions and\ntrailing headers in chunked requests. A remote attacker could use this flaw\nto send an excessively long request that, when processed by Tomcat, could\nconsume network bandwidth, CPU, and memory on the Tomcat server. Note that\nchunked transfer encoding is enabled by default. (CVE-2013-4322)\n\nA denial of service flaw was found in the way Apache Commons FileUpload,\nwhich is embedded in Tomcat, handled small-sized buffers used by\nMultipartStream. A remote attacker could use this flaw to create a\nmalformed Content-Type header for a multipart request, causing Tomcat to\nenter an infinite loop when processing such an incoming request.\n(CVE-2014-0050)\n\nAll users of Red Hat JBoss Web Server 2.0.1 are advised to upgrade to these\nupdated tomcat7 packages, which contain backported patches to correct these\nissues. The Red Hat JBoss Web Server process must be restarted for the\nupdate to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:0526",
        "url": "https://access.redhat.com/errata/RHSA-2014:0526"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1062337",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
      },
      {
        "category": "external",
        "summary": "1069905",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069905"
      },
      {
        "category": "external",
        "summary": "1069921",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0526.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat7 security update",
    "tracking": {
      "current_release_date": "2024-12-08T10:42:21+00:00",
      "generator": {
        "date": "2024-12-08T10:42:21+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2014:0526",
      "initial_release_date": "2014-05-21T16:06:31+00:00",
      "revision_history": [
        {
          "date": "2014-05-21T16:06:31+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-05-21T16:06:31+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-08T10:42:21+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
                  "product_id": "5Server-JBEWS-2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
                  "product_id": "6Server-JBEWS-2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Web Server"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat7-docs-webapp-0:7.0.40-13_patch_02.ep6.el5.noarch",
                "product": {
                  "name": "tomcat7-docs-webapp-0:7.0.40-13_patch_02.ep6.el5.noarch",
                  "product_id": "tomcat7-docs-webapp-0:7.0.40-13_patch_02.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7-docs-webapp@7.0.40-13_patch_02.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat7-jsp-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
                "product": {
                  "name": "tomcat7-jsp-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
                  "product_id": "tomcat7-jsp-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7-jsp-2.2-api@7.0.40-13_patch_02.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat7-el-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
                "product": {
                  "name": "tomcat7-el-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
                  "product_id": "tomcat7-el-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7-el-2.2-api@7.0.40-13_patch_02.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat7-log4j-0:7.0.40-13_patch_02.ep6.el5.noarch",
                "product": {
                  "name": "tomcat7-log4j-0:7.0.40-13_patch_02.ep6.el5.noarch",
                  "product_id": "tomcat7-log4j-0:7.0.40-13_patch_02.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7-log4j@7.0.40-13_patch_02.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat7-servlet-3.0-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
                "product": {
                  "name": "tomcat7-servlet-3.0-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
                  "product_id": "tomcat7-servlet-3.0-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7-servlet-3.0-api@7.0.40-13_patch_02.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat7-0:7.0.40-13_patch_02.ep6.el5.noarch",
                "product": {
                  "name": "tomcat7-0:7.0.40-13_patch_02.ep6.el5.noarch",
                  "product_id": "tomcat7-0:7.0.40-13_patch_02.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7@7.0.40-13_patch_02.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat7-lib-0:7.0.40-13_patch_02.ep6.el5.noarch",
                "product": {
                  "name": "tomcat7-lib-0:7.0.40-13_patch_02.ep6.el5.noarch",
                  "product_id": "tomcat7-lib-0:7.0.40-13_patch_02.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7-lib@7.0.40-13_patch_02.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat7-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
                "product": {
                  "name": "tomcat7-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
                  "product_id": "tomcat7-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7-webapps@7.0.40-13_patch_02.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat7-javadoc-0:7.0.40-13_patch_02.ep6.el5.noarch",
                "product": {
                  "name": "tomcat7-javadoc-0:7.0.40-13_patch_02.ep6.el5.noarch",
                  "product_id": "tomcat7-javadoc-0:7.0.40-13_patch_02.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7-javadoc@7.0.40-13_patch_02.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat7-admin-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
                "product": {
                  "name": "tomcat7-admin-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
                  "product_id": "tomcat7-admin-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7-admin-webapps@7.0.40-13_patch_02.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat7-0:7.0.40-9_patch_02.ep6.el6.noarch",
                "product": {
                  "name": "tomcat7-0:7.0.40-9_patch_02.ep6.el6.noarch",
                  "product_id": "tomcat7-0:7.0.40-9_patch_02.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7@7.0.40-9_patch_02.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat7-log4j-0:7.0.40-9_patch_02.ep6.el6.noarch",
                "product": {
                  "name": "tomcat7-log4j-0:7.0.40-9_patch_02.ep6.el6.noarch",
                  "product_id": "tomcat7-log4j-0:7.0.40-9_patch_02.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7-log4j@7.0.40-9_patch_02.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat7-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch",
                "product": {
                  "name": "tomcat7-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch",
                  "product_id": "tomcat7-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7-webapps@7.0.40-9_patch_02.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat7-admin-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch",
                "product": {
                  "name": "tomcat7-admin-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch",
                  "product_id": "tomcat7-admin-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7-admin-webapps@7.0.40-9_patch_02.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat7-el-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
                "product": {
                  "name": "tomcat7-el-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
                  "product_id": "tomcat7-el-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7-el-2.2-api@7.0.40-9_patch_02.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat7-jsp-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
                "product": {
                  "name": "tomcat7-jsp-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
                  "product_id": "tomcat7-jsp-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7-jsp-2.2-api@7.0.40-9_patch_02.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat7-javadoc-0:7.0.40-9_patch_02.ep6.el6.noarch",
                "product": {
                  "name": "tomcat7-javadoc-0:7.0.40-9_patch_02.ep6.el6.noarch",
                  "product_id": "tomcat7-javadoc-0:7.0.40-9_patch_02.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7-javadoc@7.0.40-9_patch_02.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat7-servlet-3.0-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
                "product": {
                  "name": "tomcat7-servlet-3.0-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
                  "product_id": "tomcat7-servlet-3.0-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7-servlet-3.0-api@7.0.40-9_patch_02.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat7-docs-webapp-0:7.0.40-9_patch_02.ep6.el6.noarch",
                "product": {
                  "name": "tomcat7-docs-webapp-0:7.0.40-9_patch_02.ep6.el6.noarch",
                  "product_id": "tomcat7-docs-webapp-0:7.0.40-9_patch_02.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7-docs-webapp@7.0.40-9_patch_02.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat7-lib-0:7.0.40-9_patch_02.ep6.el6.noarch",
                "product": {
                  "name": "tomcat7-lib-0:7.0.40-9_patch_02.ep6.el6.noarch",
                  "product_id": "tomcat7-lib-0:7.0.40-9_patch_02.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7-lib@7.0.40-9_patch_02.ep6.el6?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat7-0:7.0.40-13_patch_02.ep6.el5.src",
                "product": {
                  "name": "tomcat7-0:7.0.40-13_patch_02.ep6.el5.src",
                  "product_id": "tomcat7-0:7.0.40-13_patch_02.ep6.el5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7@7.0.40-13_patch_02.ep6.el5?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat7-0:7.0.40-9_patch_02.ep6.el6.src",
                "product": {
                  "name": "tomcat7-0:7.0.40-9_patch_02.ep6.el6.src",
                  "product_id": "tomcat7-0:7.0.40-9_patch_02.ep6.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat7@7.0.40-9_patch_02.ep6.el6?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-0:7.0.40-13_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat7-0:7.0.40-13_patch_02.ep6.el5.noarch"
        },
        "product_reference": "tomcat7-0:7.0.40-13_patch_02.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-0:7.0.40-13_patch_02.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat7-0:7.0.40-13_patch_02.ep6.el5.src"
        },
        "product_reference": "tomcat7-0:7.0.40-13_patch_02.ep6.el5.src",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-admin-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch"
        },
        "product_reference": "tomcat7-admin-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-docs-webapp-0:7.0.40-13_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-13_patch_02.ep6.el5.noarch"
        },
        "product_reference": "tomcat7-docs-webapp-0:7.0.40-13_patch_02.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-el-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch"
        },
        "product_reference": "tomcat7-el-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-javadoc-0:7.0.40-13_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-13_patch_02.ep6.el5.noarch"
        },
        "product_reference": "tomcat7-javadoc-0:7.0.40-13_patch_02.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-jsp-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch"
        },
        "product_reference": "tomcat7-jsp-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-lib-0:7.0.40-13_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat7-lib-0:7.0.40-13_patch_02.ep6.el5.noarch"
        },
        "product_reference": "tomcat7-lib-0:7.0.40-13_patch_02.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-log4j-0:7.0.40-13_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat7-log4j-0:7.0.40-13_patch_02.ep6.el5.noarch"
        },
        "product_reference": "tomcat7-log4j-0:7.0.40-13_patch_02.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-servlet-3.0-api-0:7.0.40-13_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-13_patch_02.ep6.el5.noarch"
        },
        "product_reference": "tomcat7-servlet-3.0-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-2:tomcat7-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch"
        },
        "product_reference": "tomcat7-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-0:7.0.40-9_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat7-0:7.0.40-9_patch_02.ep6.el6.noarch"
        },
        "product_reference": "tomcat7-0:7.0.40-9_patch_02.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-0:7.0.40-9_patch_02.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat7-0:7.0.40-9_patch_02.ep6.el6.src"
        },
        "product_reference": "tomcat7-0:7.0.40-9_patch_02.ep6.el6.src",
        "relates_to_product_reference": "6Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-admin-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch"
        },
        "product_reference": "tomcat7-admin-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-docs-webapp-0:7.0.40-9_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-9_patch_02.ep6.el6.noarch"
        },
        "product_reference": "tomcat7-docs-webapp-0:7.0.40-9_patch_02.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-el-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch"
        },
        "product_reference": "tomcat7-el-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-javadoc-0:7.0.40-9_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-9_patch_02.ep6.el6.noarch"
        },
        "product_reference": "tomcat7-javadoc-0:7.0.40-9_patch_02.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-jsp-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch"
        },
        "product_reference": "tomcat7-jsp-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-lib-0:7.0.40-9_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat7-lib-0:7.0.40-9_patch_02.ep6.el6.noarch"
        },
        "product_reference": "tomcat7-lib-0:7.0.40-9_patch_02.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-log4j-0:7.0.40-9_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat7-log4j-0:7.0.40-9_patch_02.ep6.el6.noarch"
        },
        "product_reference": "tomcat7-log4j-0:7.0.40-9_patch_02.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-servlet-3.0-api-0:7.0.40-9_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-9_patch_02.ep6.el6.noarch"
        },
        "product_reference": "tomcat7-servlet-3.0-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWS-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat7-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
          "product_id": "6Server-JBEWS-2:tomcat7-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch"
        },
        "product_reference": "tomcat7-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEWS-2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2013-4286",
      "discovery_date": "2014-02-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1069921"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that when Tomcat / JBoss Web processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encoding header, Tomcat / JBoss Web would incorrectly handle the request. A remote attacker could use this flaw to poison a web cache, perform cross-site scripting (XSS) attacks, or obtain sensitive information from other requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: multiple content-length header poisoning flaws",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-JBEWS-2:tomcat7-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-0:7.0.40-13_patch_02.ep6.el5.src",
          "5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-lib-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-log4j-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "6Server-JBEWS-2:tomcat7-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-0:7.0.40-9_patch_02.ep6.el6.src",
          "6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-lib-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-log4j-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4286"
        },
        {
          "category": "external",
          "summary": "RHBZ#1069921",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4286",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4286"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286"
        }
      ],
      "release_date": "2014-02-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-05-21T16:06:31+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "5Server-JBEWS-2:tomcat7-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-0:7.0.40-13_patch_02.ep6.el5.src",
            "5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-lib-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-log4j-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "6Server-JBEWS-2:tomcat7-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-0:7.0.40-9_patch_02.ep6.el6.src",
            "6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-lib-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-log4j-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0526"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "5Server-JBEWS-2:tomcat7-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-0:7.0.40-13_patch_02.ep6.el5.src",
            "5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-lib-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-log4j-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "6Server-JBEWS-2:tomcat7-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-0:7.0.40-9_patch_02.ep6.el6.src",
            "6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-lib-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-log4j-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: multiple content-length header poisoning flaws"
    },
    {
      "cve": "CVE-2013-4322",
      "discovery_date": "2014-02-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1069905"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that the fix for CVE-2012-3544 did not properly resolve a denial of service flaw in the way Tomcat and JBoss Web processed chunk extensions and trailing headers in chunked requests. A remote attacker could use this flaw to send an excessively long request that, when processed by Tomcat, could consume network bandwidth, CPU, and memory on the Tomcat server. Note that chunked transfer encoding is enabled by default.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: incomplete fix for CVE-2012-3544",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-JBEWS-2:tomcat7-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-0:7.0.40-13_patch_02.ep6.el5.src",
          "5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-lib-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-log4j-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "6Server-JBEWS-2:tomcat7-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-0:7.0.40-9_patch_02.ep6.el6.src",
          "6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-lib-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-log4j-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4322"
        },
        {
          "category": "external",
          "summary": "RHBZ#1069905",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069905"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4322",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4322"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4322",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4322"
        }
      ],
      "release_date": "2014-02-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-05-21T16:06:31+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "5Server-JBEWS-2:tomcat7-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-0:7.0.40-13_patch_02.ep6.el5.src",
            "5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-lib-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-log4j-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "6Server-JBEWS-2:tomcat7-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-0:7.0.40-9_patch_02.ep6.el6.src",
            "6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-lib-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-log4j-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0526"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "5Server-JBEWS-2:tomcat7-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-0:7.0.40-13_patch_02.ep6.el5.src",
            "5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-lib-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-log4j-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "6Server-JBEWS-2:tomcat7-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-0:7.0.40-9_patch_02.ep6.el6.src",
            "6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-lib-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-log4j-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: incomplete fix for CVE-2012-3544"
    },
    {
      "cve": "CVE-2014-0050",
      "discovery_date": "2014-02-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1062337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in the way Apache Commons FileUpload, which is embedded in Tomcat and JBoss Web, handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing Tomcat to enter an infinite loop when processing such an incoming request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-JBEWS-2:tomcat7-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-0:7.0.40-13_patch_02.ep6.el5.src",
          "5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-lib-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-log4j-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "5Server-JBEWS-2:tomcat7-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
          "6Server-JBEWS-2:tomcat7-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-0:7.0.40-9_patch_02.ep6.el6.src",
          "6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-lib-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-log4j-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
          "6Server-JBEWS-2:tomcat7-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "RHBZ#1062337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0050",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050"
        }
      ],
      "release_date": "2014-02-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-05-21T16:06:31+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "5Server-JBEWS-2:tomcat7-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-0:7.0.40-13_patch_02.ep6.el5.src",
            "5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-lib-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-log4j-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "6Server-JBEWS-2:tomcat7-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-0:7.0.40-9_patch_02.ep6.el6.src",
            "6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-lib-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-log4j-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0526"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "5Server-JBEWS-2:tomcat7-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-0:7.0.40-13_patch_02.ep6.el5.src",
            "5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-lib-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-log4j-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "5Server-JBEWS-2:tomcat7-webapps-0:7.0.40-13_patch_02.ep6.el5.noarch",
            "6Server-JBEWS-2:tomcat7-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-0:7.0.40-9_patch_02.ep6.el6.src",
            "6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-lib-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-log4j-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-9_patch_02.ep6.el6.noarch",
            "6Server-JBEWS-2:tomcat7-webapps-0:7.0.40-9_patch_02.ep6.el6.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated tomcat6 packages that fix three security issues are now available\nfor Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer\nPages (JSP) technologies.\n\nIt was found that when Tomcat processed a series of HTTP requests in which\nat least one request contained either multiple content-length headers, or\none content-length header with a chunked transfer-encoding header, Tomcat\nwould incorrectly handle the request. A remote attacker could use this flaw\nto poison a web cache, perform cross-site scripting (XSS) attacks, or\nobtain sensitive information from other requests. (CVE-2013-4286)\n\nIt was discovered that the fix for CVE-2012-3544 did not properly resolve a\ndenial of service flaw in the way Tomcat processed chunk extensions and\ntrailing headers in chunked requests. A remote attacker could use this flaw\nto send an excessively long request that, when processed by Tomcat, could\nconsume network bandwidth, CPU, and memory on the Tomcat server. Note that\nchunked transfer encoding is enabled by default. (CVE-2013-4322)\n\nA denial of service flaw was found in the way Apache Commons FileUpload\nhandled small-sized buffers used by MultipartStream. A remote attacker\ncould use this flaw to create a malformed Content-Type header for a\nmultipart request, causing JBoss Web to enter an infinite loop when\nprocessing such an incoming request. (CVE-2014-0050)\n\nAll Tomcat users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues. Tomcat must be\nrestarted for this update to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:0429",
        "url": "https://access.redhat.com/errata/RHSA-2014:0429"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://tomcat.apache.org/security-6.html",
        "url": "https://tomcat.apache.org/security-6.html"
      },
      {
        "category": "external",
        "summary": "1062337",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
      },
      {
        "category": "external",
        "summary": "1069905",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069905"
      },
      {
        "category": "external",
        "summary": "1069921",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0429.json"
      }
    ],
    "title": "Red Hat Security Advisory: tomcat6 security update",
    "tracking": {
      "current_release_date": "2024-12-08T10:41:30+00:00",
      "generator": {
        "date": "2024-12-08T10:41:30+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2014:0429",
      "initial_release_date": "2014-04-23T18:27:58+00:00",
      "revision_history": [
        {
          "date": "2014-04-23T18:27:58+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-04-23T18:27:58+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-08T10:41:30+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Desktop Optional (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Desktop Optional (v. 6)",
                  "product_id": "6Client-optional-6.5.z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::client"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux HPC Node Optional (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux HPC Node Optional (v. 6)",
                  "product_id": "6ComputeNode-optional-6.5.z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::computenode"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server (v. 6)",
                  "product_id": "6Server-6.5.z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server Optional (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server Optional (v. 6)",
                  "product_id": "6Server-optional-6.5.z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Workstation (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Workstation (v. 6)",
                  "product_id": "6Workstation-6.5.z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Workstation Optional (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Workstation Optional (v. 6)",
                  "product_id": "6Workstation-optional-6.5.z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
                "product": {
                  "name": "tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
                  "product_id": "tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-docs-webapp@6.0.24-64.el6_5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
                "product": {
                  "name": "tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
                  "product_id": "tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-webapps@6.0.24-64.el6_5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
                "product": {
                  "name": "tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
                  "product_id": "tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-javadoc@6.0.24-64.el6_5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
                "product": {
                  "name": "tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
                  "product_id": "tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-admin-webapps@6.0.24-64.el6_5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
                "product": {
                  "name": "tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
                  "product_id": "tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-jsp-2.1-api@6.0.24-64.el6_5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-lib-0:6.0.24-64.el6_5.noarch",
                "product": {
                  "name": "tomcat6-lib-0:6.0.24-64.el6_5.noarch",
                  "product_id": "tomcat6-lib-0:6.0.24-64.el6_5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-lib@6.0.24-64.el6_5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
                "product": {
                  "name": "tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
                  "product_id": "tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-servlet-2.5-api@6.0.24-64.el6_5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
                "product": {
                  "name": "tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
                  "product_id": "tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-el-2.1-api@6.0.24-64.el6_5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-0:6.0.24-64.el6_5.noarch",
                "product": {
                  "name": "tomcat6-0:6.0.24-64.el6_5.noarch",
                  "product_id": "tomcat6-0:6.0.24-64.el6_5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6@6.0.24-64.el6_5?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat6-0:6.0.24-64.el6_5.src",
                "product": {
                  "name": "tomcat6-0:6.0.24-64.el6_5.src",
                  "product_id": "tomcat6-0:6.0.24-64.el6_5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6@6.0.24-64.el6_5?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
          "product_id": "6Client-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Client-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-0:6.0.24-64.el6_5.src as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
          "product_id": "6Client-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src"
        },
        "product_reference": "tomcat6-0:6.0.24-64.el6_5.src",
        "relates_to_product_reference": "6Client-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
          "product_id": "6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Client-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
          "product_id": "6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Client-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
          "product_id": "6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Client-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-javadoc-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
          "product_id": "6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Client-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
          "product_id": "6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Client-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-lib-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
          "product_id": "6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-lib-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Client-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
          "product_id": "6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Client-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-webapps-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
          "product_id": "6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Client-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
          "product_id": "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6ComputeNode-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-0:6.0.24-64.el6_5.src as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
          "product_id": "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src"
        },
        "product_reference": "tomcat6-0:6.0.24-64.el6_5.src",
        "relates_to_product_reference": "6ComputeNode-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
          "product_id": "6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6ComputeNode-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
          "product_id": "6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6ComputeNode-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
          "product_id": "6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6ComputeNode-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-javadoc-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
          "product_id": "6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6ComputeNode-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
          "product_id": "6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6ComputeNode-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-lib-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
          "product_id": "6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-lib-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6ComputeNode-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
          "product_id": "6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6ComputeNode-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-webapps-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
          "product_id": "6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6ComputeNode-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Server-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-0:6.0.24-64.el6_5.src as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.5.z:tomcat6-0:6.0.24-64.el6_5.src"
        },
        "product_reference": "tomcat6-0:6.0.24-64.el6_5.src",
        "relates_to_product_reference": "6Server-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Server-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Server-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Server-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-javadoc-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Server-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Server-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-lib-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-lib-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Server-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Server-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-webapps-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Server-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
          "product_id": "6Server-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Server-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-0:6.0.24-64.el6_5.src as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
          "product_id": "6Server-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src"
        },
        "product_reference": "tomcat6-0:6.0.24-64.el6_5.src",
        "relates_to_product_reference": "6Server-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
          "product_id": "6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Server-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
          "product_id": "6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Server-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
          "product_id": "6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Server-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-javadoc-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
          "product_id": "6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Server-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
          "product_id": "6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Server-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-lib-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
          "product_id": "6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-lib-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Server-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
          "product_id": "6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Server-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-webapps-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
          "product_id": "6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Server-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Workstation-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-0:6.0.24-64.el6_5.src as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-6.5.z:tomcat6-0:6.0.24-64.el6_5.src"
        },
        "product_reference": "tomcat6-0:6.0.24-64.el6_5.src",
        "relates_to_product_reference": "6Workstation-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Workstation-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Workstation-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Workstation-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-javadoc-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Workstation-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Workstation-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-lib-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-lib-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Workstation-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Workstation-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-webapps-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Workstation-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
          "product_id": "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Workstation-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-0:6.0.24-64.el6_5.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
          "product_id": "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src"
        },
        "product_reference": "tomcat6-0:6.0.24-64.el6_5.src",
        "relates_to_product_reference": "6Workstation-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
          "product_id": "6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Workstation-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
          "product_id": "6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Workstation-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
          "product_id": "6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Workstation-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-javadoc-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
          "product_id": "6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Workstation-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
          "product_id": "6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Workstation-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-lib-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
          "product_id": "6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-lib-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Workstation-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
          "product_id": "6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Workstation-optional-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-webapps-0:6.0.24-64.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
          "product_id": "6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch"
        },
        "product_reference": "tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
        "relates_to_product_reference": "6Workstation-optional-6.5.z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2013-4286",
      "discovery_date": "2014-02-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1069921"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that when Tomcat / JBoss Web processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encoding header, Tomcat / JBoss Web would incorrectly handle the request. A remote attacker could use this flaw to poison a web cache, perform cross-site scripting (XSS) attacks, or obtain sensitive information from other requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: multiple content-length header poisoning flaws",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Client-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
          "6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
          "6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
          "6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
          "6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
          "6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
          "6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4286"
        },
        {
          "category": "external",
          "summary": "RHBZ#1069921",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4286",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4286"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286"
        }
      ],
      "release_date": "2014-02-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-23T18:27:58+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "6Client-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0429"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Client-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: multiple content-length header poisoning flaws"
    },
    {
      "cve": "CVE-2013-4322",
      "discovery_date": "2014-02-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1069905"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that the fix for CVE-2012-3544 did not properly resolve a denial of service flaw in the way Tomcat and JBoss Web processed chunk extensions and trailing headers in chunked requests. A remote attacker could use this flaw to send an excessively long request that, when processed by Tomcat, could consume network bandwidth, CPU, and memory on the Tomcat server. Note that chunked transfer encoding is enabled by default.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: incomplete fix for CVE-2012-3544",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Client-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
          "6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
          "6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
          "6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
          "6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
          "6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
          "6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4322"
        },
        {
          "category": "external",
          "summary": "RHBZ#1069905",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069905"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4322",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4322"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4322",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4322"
        }
      ],
      "release_date": "2014-02-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-23T18:27:58+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "6Client-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0429"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "6Client-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: incomplete fix for CVE-2012-3544"
    },
    {
      "cve": "CVE-2014-0050",
      "discovery_date": "2014-02-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1062337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in the way Apache Commons FileUpload, which is embedded in Tomcat and JBoss Web, handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing Tomcat to enter an infinite loop when processing such an incoming request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Client-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
          "6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
          "6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
          "6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
          "6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
          "6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
          "6Server-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
          "6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
          "6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
          "6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
          "6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
          "6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
          "6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "RHBZ#1062337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0050",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050"
        }
      ],
      "release_date": "2014-02-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-23T18:27:58+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "6Client-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0429"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "6Client-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Server-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-64.el6_5.src",
            "6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-64.el6_5.noarch",
            "6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-64.el6_5.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Fuse ESB Enterprise/MQ Enterprise 7.1.0 R1 P3 (Patch 3 on Rollup Patch 1),\nwhich addresses several security issues and contains multiple bug fixes, is\nnow available from the Red Hat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nImportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Fuse ESB Enterprise is an integration platform based on Apache ServiceMix.\nFuse MQ Enterprise, based on Apache ActiveMQ, is a standards-compliant\nmessaging system that is tailored for use in mission critical applications.\n\nThis release of Fuse ESB Enterprise/MQ Enterprise 7.1.0 R1 P3 is an update\nto Fuse ESB Enterprise 7.1.0 and Fuse MQ Enterprise 7.1.0. It includes\nvarious bug fixes, which are listed in the README file included with the\npatch files.\n\nThe following security issues are also addressed with this release:\n\nIt was found that XStream could deserialize arbitrary user-supplied XML\ncontent, representing objects of any type. A remote attacker able to pass\nXML to XStream could use this flaw to perform a variety of attacks,\nincluding remote code execution in the context of the server running the\nXStream application. (CVE-2013-7285)\n\nIt was found that the Apache Camel XSLT component allowed XSL stylesheets\nto call external Java methods. A remote attacker able to submit messages to\na Camel route could use this flaw to perform arbitrary remote code\nexecution in the context of the Camel server process. (CVE-2014-0003)\n\nIt was found that the ParserPool and Decrypter classes in the OpenSAML Java\nimplementation resolved external entities, permitting XML External Entity\n(XXE) attacks. A remote attacker could use this flaw to read files\naccessible to the user running the application server and, potentially,\nperform other more advanced XXE attacks. (CVE-2013-6440)\n\nIt was found that the Apache Camel XSLT component would resolve entities in\nXML messages when transforming them using an XSLT route. A remote attacker\nable to submit messages to an XSLT Camel route could use this flaw to read\nfiles accessible to the user running the application server and,\npotentially, perform other more advanced XXE attacks. (CVE-2014-0002)\n\nA denial of service flaw was found in the way Apache Commons FileUpload\nhandled small-sized buffers used by MultipartStream. A remote attacker\ncould use this flaw to create a malformed Content-Type header for a\nmultipart request, causing Apache Commons FileUpload to enter an infinite\nloop when processing such an incoming request. (CVE-2014-0050)\n\nThe CVE-2014-0002 and CVE-2014-0003 issues were discovered by David Jorm of\nthe Red Hat Security Response Team, and the CVE-2013-6440 issue was\ndiscovered by David Illsley, Ron Gutierrez of Gotham Digital Science, and\nDavid Jorm of the Red Hat Security Response Team.\n\nAll users of Fuse ESB Enterprise/MQ Enterprise 7.1.0 as provided from the\nRed Hat Customer Portal are advised to upgrade to Fuse ESB Enterprise/MQ\nEnterprise 7.1.0 R1 P3.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:0452",
        "url": "https://access.redhat.com/errata/RHSA-2014:0452"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.esb.enterprise\u0026downloadType=securityPatches\u0026version=7.1.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.esb.enterprise\u0026downloadType=securityPatches\u0026version=7.1.0"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.mq.enterprise\u0026downloadType=securityPatches\u0026version=7.1.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.mq.enterprise\u0026downloadType=securityPatches\u0026version=7.1.0"
      },
      {
        "category": "external",
        "summary": "1043332",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1043332"
      },
      {
        "category": "external",
        "summary": "1049675",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
      },
      {
        "category": "external",
        "summary": "1049692",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
      },
      {
        "category": "external",
        "summary": "1051277",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
      },
      {
        "category": "external",
        "summary": "1062337",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0452.json"
      }
    ],
    "title": "Red Hat Security Advisory: Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update",
    "tracking": {
      "current_release_date": "2024-11-22T07:50:58+00:00",
      "generator": {
        "date": "2024-11-22T07:50:58+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2014:0452",
      "initial_release_date": "2014-04-30T18:49:57+00:00",
      "revision_history": [
        {
          "date": "2014-04-30T18:49:57+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-04-30T18:49:57+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T07:50:58+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Fuse ESB Enterprise 7.1.0",
                "product": {
                  "name": "Fuse ESB Enterprise 7.1.0",
                  "product_id": "Fuse ESB Enterprise 7.1.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:fuse_esb_enterprise:7.1.0"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Fuse Management Console 7.1.0",
                "product": {
                  "name": "Fuse Management Console 7.1.0",
                  "product_id": "Fuse Management Console 7.1.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:fuse_management_console:7.1.0"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Fuse MQ Enterprise 7.1.0",
                "product": {
                  "name": "Fuse MQ Enterprise 7.1.0",
                  "product_id": "Fuse MQ Enterprise 7.1.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:fuse_mq_enterprise:7.1.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Fuse Enterprise Middleware"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Illsley"
          ]
        },
        {
          "names": [
            "Ron Gutierrez"
          ],
          "organization": "Gotham Digital Science"
        },
        {
          "names": [
            "David Jorm"
          ],
          "organization": "Red Hat Security Response Team",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2013-6440",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2013-12-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1043332"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the ParserPool and Decrypter classes in the OpenSAML Java implementation resolved external entities, permitting XML External Entity (XXE) attacks. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Java: XML eXternal Entity (XXE) flaw in ParserPool and Decrypter",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Fuse ESB Enterprise 7.1.0",
          "Fuse MQ Enterprise 7.1.0",
          "Fuse Management Console 7.1.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-6440"
        },
        {
          "category": "external",
          "summary": "RHBZ#1043332",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1043332"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-6440",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-6440"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6440",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6440"
        },
        {
          "category": "external",
          "summary": "http://blog.sendsafely.com/post/69590974866/web-based-single-sign-on-and-the-dangers-of-saml-xml",
          "url": "http://blog.sendsafely.com/post/69590974866/web-based-single-sign-on-and-the-dangers-of-saml-xml"
        }
      ],
      "release_date": "2013-12-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-30T18:49:57+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Fuse ESB Enterprise 7.1.0",
            "Fuse MQ Enterprise 7.1.0",
            "Fuse Management Console 7.1.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0452"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Fuse ESB Enterprise 7.1.0",
            "Fuse MQ Enterprise 7.1.0",
            "Fuse Management Console 7.1.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Java: XML eXternal Entity (XXE) flaw in ParserPool and Decrypter"
    },
    {
      "cve": "CVE-2013-7285",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2013-12-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1051277"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: remote code execution due to insecure XML deserialization",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Fuse ESB Enterprise 7.1.0",
          "Fuse MQ Enterprise 7.1.0",
          "Fuse Management Console 7.1.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-7285"
        },
        {
          "category": "external",
          "summary": "RHBZ#1051277",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-7285",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-7285"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285"
        },
        {
          "category": "external",
          "summary": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html",
          "url": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html"
        },
        {
          "category": "external",
          "summary": "http://xstream.codehaus.org/security.html",
          "url": "http://xstream.codehaus.org/security.html"
        },
        {
          "category": "external",
          "summary": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/",
          "url": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/"
        }
      ],
      "release_date": "2013-12-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-30T18:49:57+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Fuse ESB Enterprise 7.1.0",
            "Fuse MQ Enterprise 7.1.0",
            "Fuse Management Console 7.1.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0452"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Fuse ESB Enterprise 7.1.0",
            "Fuse MQ Enterprise 7.1.0",
            "Fuse Management Console 7.1.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "XStream: remote code execution due to insecure XML deserialization"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "David Jorm"
          ],
          "organization": "Red Hat Security Response Team",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2014-0002",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2014-01-07T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1049675"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Camel: XML eXternal Entity (XXE) flaw in XSLT component",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Fuse ESB Enterprise 7.1.0",
          "Fuse MQ Enterprise 7.1.0",
          "Fuse Management Console 7.1.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0002"
        },
        {
          "category": "external",
          "summary": "RHBZ#1049675",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0002",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0002"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002"
        },
        {
          "category": "external",
          "summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc",
          "url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"
        }
      ],
      "release_date": "2014-02-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-30T18:49:57+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Fuse ESB Enterprise 7.1.0",
            "Fuse MQ Enterprise 7.1.0",
            "Fuse Management Console 7.1.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0452"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Fuse ESB Enterprise 7.1.0",
            "Fuse MQ Enterprise 7.1.0",
            "Fuse Management Console 7.1.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Camel: XML eXternal Entity (XXE) flaw in XSLT component"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "David Jorm"
          ],
          "organization": "Red Hat Security Response Team",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2014-0003",
      "discovery_date": "2014-01-07T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1049692"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Camel: remote code execution via XSL",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Fuse ESB Enterprise 7.1.0",
          "Fuse MQ Enterprise 7.1.0",
          "Fuse Management Console 7.1.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0003"
        },
        {
          "category": "external",
          "summary": "RHBZ#1049692",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0003",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0003"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003"
        },
        {
          "category": "external",
          "summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc",
          "url": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc"
        }
      ],
      "release_date": "2014-02-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-30T18:49:57+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Fuse ESB Enterprise 7.1.0",
            "Fuse MQ Enterprise 7.1.0",
            "Fuse Management Console 7.1.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0452"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Fuse ESB Enterprise 7.1.0",
            "Fuse MQ Enterprise 7.1.0",
            "Fuse Management Console 7.1.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Camel: remote code execution via XSL"
    },
    {
      "cve": "CVE-2014-0050",
      "discovery_date": "2014-02-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1062337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in the way Apache Commons FileUpload, which is embedded in Tomcat and JBoss Web, handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing Tomcat to enter an infinite loop when processing such an incoming request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Fuse ESB Enterprise 7.1.0",
          "Fuse MQ Enterprise 7.1.0",
          "Fuse Management Console 7.1.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "RHBZ#1062337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0050",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050"
        }
      ],
      "release_date": "2014-02-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-30T18:49:57+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Fuse ESB Enterprise 7.1.0",
            "Fuse MQ Enterprise 7.1.0",
            "Fuse Management Console 7.1.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0452"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Fuse ESB Enterprise 7.1.0",
            "Fuse MQ Enterprise 7.1.0",
            "Fuse Management Console 7.1.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Operations Network 3.2.1, which fixes two security issues and\nseveral bugs, is now available from the Red Hat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Operations Network is a middleware management solution that\nprovides a single point of control to deploy, manage, and monitor JBoss\nEnterprise Middleware, applications, and services.\n\nThis JBoss Operations Network 3.2.1 release serves as a replacement for\nJBoss Operations Network 3.2.0, and includes several bug fixes. Refer to\nthe release description, available from the Customer Portal for this\nupdate, for a list of these changes.\n\nThe following security issues are also fixed with this release:\n\nIt was discovered that the Apache Santuario XML Security for Java project\nallowed Document Type Definitions (DTDs) to be processed when applying\nTransforms even when secure validation was enabled. A remote attacker could\nuse this flaw to exhaust all available memory on the system, causing a\ndenial of service. (CVE-2013-4517)\n\nA denial of service flaw was found in the way Apache Commons FileUpload,\nwhich is embedded in the JBoss Web component of JBoss Operations Network as\nwell as provided as a standalone component, handled small-sized buffers\nused by MultipartStream. A remote attacker could use this flaw to create a\nmalformed Content-Type header for a multipart request, causing JBoss Web or\nApache Commons FileUpload itself to enter an infinite loop when processing\nsuch an incoming request. (CVE-2014-0050)\n\nAll users of JBoss Operations Network 3.2.0 as provided from the Red Hat\nCustomer Portal are advised to upgrade to JBoss Operations Network 3.2.1.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:0473",
        "url": "https://access.redhat.com/errata/RHSA-2014:0473"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=em\u0026downloadType=securityPatches\u0026version=3.2.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=em\u0026downloadType=securityPatches\u0026version=3.2.0"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/site/documentation/Red_Hat_JBoss_Operations_Network/",
        "url": "https://access.redhat.com/site/documentation/Red_Hat_JBoss_Operations_Network/"
      },
      {
        "category": "external",
        "summary": "1045257",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1045257"
      },
      {
        "category": "external",
        "summary": "1062337",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0473.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Operations Network 3.2.1 update",
    "tracking": {
      "current_release_date": "2024-11-22T08:00:49+00:00",
      "generator": {
        "date": "2024-11-22T08:00:49+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2014:0473",
      "initial_release_date": "2014-05-06T18:01:23+00:00",
      "revision_history": [
        {
          "date": "2014-05-06T18:01:23+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-05-06T18:01:24+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T08:00:49+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Operations Network 3.2",
                "product": {
                  "name": "Red Hat JBoss Operations Network 3.2",
                  "product_id": "Red Hat JBoss Operations Network 3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_operations_network:3.2.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Operations Network"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2013-4517",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2013-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1045257"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that the Apache Santuario XML Security for Java project allowed Document Type Definitions (DTDs) to be processed when applying Transforms even when secure validation was enabled. A remote attacker could use this flaw to exhaust all available memory on the system, causing a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Java: Java XML Signature DoS Attack",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Fuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4, Fuse Mediation Router 2.7, 2.8 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nFuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 4;  Red Hat JBoss Enterprise Data Services Platform 5; Red Hat JBoss Enterprise Portal Platform 4 and 5; and Red Hat JBoss Enterprise SOA Platform 4 and 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Operations Network 3.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4517"
        },
        {
          "category": "external",
          "summary": "RHBZ#1045257",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1045257"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4517",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4517"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4517",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4517"
        }
      ],
      "release_date": "2013-11-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-05-06T18:01:23+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nRefer to the \"Manual Instructions\" section of the release description,\navailable from the Customer Portal for this update, for installation\ninformation.",
          "product_ids": [
            "Red Hat JBoss Operations Network 3.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0473"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Operations Network 3.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Java: Java XML Signature DoS Attack"
    },
    {
      "cve": "CVE-2014-0050",
      "discovery_date": "2014-02-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1062337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in the way Apache Commons FileUpload, which is embedded in Tomcat and JBoss Web, handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing Tomcat to enter an infinite loop when processing such an incoming request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Operations Network 3.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "RHBZ#1062337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0050",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050"
        }
      ],
      "release_date": "2014-02-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-05-06T18:01:23+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nRefer to the \"Manual Instructions\" section of the release description,\navailable from the Customer Portal for this update, for installation\ninformation.",
          "product_ids": [
            "Red Hat JBoss Operations Network 3.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0473"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Operations Network 3.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Portal 6.2.0, which fixes multiple security issues and\nvarious bugs, is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.\n\nRed Hat JBoss Portal is the open source implementation of the Java EE suite\nof services and Portal services running atop Red Hat JBoss Enterprise\nApplication Platform.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of Red Hat JBoss Portal 6.2.0 serves as a replacement for\nRed Hat JBoss BPM Suite 6.1.1, and includes bug fixes and enhancements.\nRefer to the Red Hat JBoss BPM Suite 6.2.0 Release Notes for information on\nthe most significant of these changes. The Release Notes are available at\nhttps://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Portal/\n\nThe following security issues are also fixed with this release,\ndescriptions of which can be found on the respective CVE pages linked in\nthe References section.\n\nCVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass\n\nCVE-2013-1624 bouncycastle: TLS CBC padding timing attack\n\nCVE-2013-2133 JBoss WS: EJB3 role restrictions are not applied to jaxws\nhandlers\n\nCVE-2013-4286 JBossWeb: multiple content-length header poisoning flaws\n\nCVE-2013-5855 Mojarra JSF2: XSS due to insufficient escaping of\nuser-supplied content in outputText tags and EL expressions\n\nCVE-2013-7285 XStream: remote code execution due to insecure XML\ndeserialization\n\nCVE-2014-0005 PicketBox/JBossSX: Security domain authentication\nconfiguration modifiable by application\n\nCVE-2014-0018 JBoss AS Server: Unchecked access to MSC Service Registry\nunder JSM\n\nCVE-2014-0034 Apache CXF: The SecurityTokenService accepts certain invalid\nSAML Tokens as valid\n\nCVE-2014-0035 Apache CXF: UsernameTokens are sent in plaintext with a\nSymmetric EncryptBeforeSigning policy\n\nCVE-2014-0050 JBossWeb: denial of service due to too-small buffer size used\nbt MultipartStream\n\nCVE-2014-0058 Red Hat JBoss EAP 6: Plain text password logging\n\nCVE-2014-0059 PicketBox/JBossSX: World readable audit.log file\n\nCVE-2014-0075 JBossWeb: Limited DoS in chunked transfer encoding input\nfilter\n\nCVE-2014-0086 JBoss RichFaces: remote denial of service via memory\nexhaustion\n\nCVE-2014-0093 Red Hat JBoss EAP 6: JSM policy not respected by deployed\napplications\n\nCVE-2014-0096 JBossWeb: XXE vulnerability via user supplied XSLTs\n\nCVE-2014-0099 JBossWeb: Request smuggling via malicious content length\nheader\n\nCVE-2014-0107 Xalan-Java: insufficient constraints in secure processing\nfeature (oCERT-2014-002)\n\nCVE-2014-0109 Apache CXF: HTML content posted to SOAP endpoint could cause\nOOM errors\n\nCVE-2014-0110 Apache CXF: Large invalid content fills temporary space\n\nCVE-2014-0119 JBossWeb: XML parser hijack by malicious web application\n\nCVE-2014-0193 Netty: DoS via memory exhaustion during data aggregation\n\nCVE-2014-0227 JBossWeb: Limited DoS in chunked transfer encoding input\nfilter\n\nCVE-2014-0245 GateIn WSRP: Information disclosure via unsafe concurrency\nhandling in interceptor\n\nCVE-2014-3472 JBoss AS Controller: Invalid EJB caller role check\n\nCVE-2014-3481 JBoss AS JAX RS Integration: Information disclosure via XML\nXXE\n\nCVE-2014-3490 RESTEasy: XXE via parameter entities\n\nCVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage\n\nCVE-2014-3574 Apache POI: entity expansion (billion laughs) flaw\n\nCVE-2014-3529 Apache POI: XXE flaw\n\nCVE-2014-3577 Apache HttpComponents incomplete fix for CVE-2012-6153\n\nCVE-2014-3586 JBoss AS CLI: Insecure default permissions on history file\n\nCVE-2014-4172 Cas-client: Bypass of security constraints via URL parameter\ninjection\n\nRed Hat would like to thank James Roper of Typesafe for reporting\nCVE-2014-0193, CA Technologies for reporting CVE-2014-3472, and Alexander\nPapadakis for reporting CVE-2014-3530. The CVE-2013-2133 issue was\ndiscovered by Richard Opalka and Arun Neelicattu of Red Hat, the\nCVE-2014-0005 issue was discovered by Josef Cacek of the Red Hat JBoss EAP\nQuality Engineering team, the CVE-2014-0018 issue was discovered by Stuart\nDouglas of Red Hat, the CVE-2014-3481 issue was discovered by the Red Hat\nJBoss Enterprise Application Platform QE team, the CVE-2014-0075 and\nCVE-2014-3490 issues were discovered by David Jorm of Red Hat Product\nSecurity, and the CVE-2014-0093 issue was discovered by Josef Cacek of the\nRed Hat JBoss EAP Quality Engineering team.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:1009",
        "url": "https://access.redhat.com/errata/RHSA-2015:1009"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal\u0026downloadType=distributions",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal\u0026downloadType=distributions"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Portal/",
        "url": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Portal/"
      },
      {
        "category": "external",
        "summary": "908428",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=908428"
      },
      {
        "category": "external",
        "summary": "969924",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=969924"
      },
      {
        "category": "external",
        "summary": "1049736",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049736"
      },
      {
        "category": "external",
        "summary": "1051277",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
      },
      {
        "category": "external",
        "summary": "1052783",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1052783"
      },
      {
        "category": "external",
        "summary": "1058454",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1058454"
      },
      {
        "category": "external",
        "summary": "1062337",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
      },
      {
        "category": "external",
        "summary": "1063641",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063641"
      },
      {
        "category": "external",
        "summary": "1063642",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063642"
      },
      {
        "category": "external",
        "summary": "1065139",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
      },
      {
        "category": "external",
        "summary": "1067268",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1067268"
      },
      {
        "category": "external",
        "summary": "1069921",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
      },
      {
        "category": "external",
        "summary": "1070046",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1070046"
      },
      {
        "category": "external",
        "summary": "1072776",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
      },
      {
        "category": "external",
        "summary": "1080248",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1080248"
      },
      {
        "category": "external",
        "summary": "1088342",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
      },
      {
        "category": "external",
        "summary": "1092783",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
      },
      {
        "category": "external",
        "summary": "1093526",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093526"
      },
      {
        "category": "external",
        "summary": "1093527",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093527"
      },
      {
        "category": "external",
        "summary": "1093529",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093529"
      },
      {
        "category": "external",
        "summary": "1093530",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093530"
      },
      {
        "category": "external",
        "summary": "1101303",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1101303"
      },
      {
        "category": "external",
        "summary": "1102030",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
      },
      {
        "category": "external",
        "summary": "1102038",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
      },
      {
        "category": "external",
        "summary": "1103815",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103815"
      },
      {
        "category": "external",
        "summary": "1105242",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1105242"
      },
      {
        "category": "external",
        "summary": "1107901",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
      },
      {
        "category": "external",
        "summary": "1109196",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
      },
      {
        "category": "external",
        "summary": "1112987",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
      },
      {
        "category": "external",
        "summary": "1126687",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1126687"
      },
      {
        "category": "external",
        "summary": "1129074",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
      },
      {
        "category": "external",
        "summary": "1129916",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
      },
      {
        "category": "external",
        "summary": "1131350",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131350"
      },
      {
        "category": "external",
        "summary": "1138135",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1138135"
      },
      {
        "category": "external",
        "summary": "1138140",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1138140"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1009.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Portal 6.2.0 update",
    "tracking": {
      "current_release_date": "2024-12-08T10:44:08+00:00",
      "generator": {
        "date": "2024-12-08T10:44:08+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2015:1009",
      "initial_release_date": "2015-05-14T15:14:47+00:00",
      "revision_history": [
        {
          "date": "2015-05-14T15:14:47+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:35:39+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-08T10:44:08+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Portal 6.2",
                "product": {
                  "name": "Red Hat JBoss Portal 6.2",
                  "product_id": "Red Hat JBoss Portal 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_portal_platform:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Portal"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Florian Weimer"
          ],
          "organization": "Red Hat Product Security",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2012-6153",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2012-11-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1129916"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "RHBZ#1129916",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
        }
      ],
      "release_date": "2014-08-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
    },
    {
      "cve": "CVE-2013-1624",
      "cwe": {
        "id": "CWE-385",
        "name": "Covert Timing Channel"
      },
      "discovery_date": "2013-02-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "908428"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that bouncycastle leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bouncycastle: TLS CBC padding timing attack",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-1624"
        },
        {
          "category": "external",
          "summary": "RHBZ#908428",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=908428"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-1624",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-1624"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1624",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1624"
        },
        {
          "category": "external",
          "summary": "http://www.isg.rhul.ac.uk/tls/",
          "url": "http://www.isg.rhul.ac.uk/tls/"
        },
        {
          "category": "external",
          "summary": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf",
          "url": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf"
        }
      ],
      "release_date": "2013-02-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "bouncycastle: TLS CBC padding timing attack"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Richard Opalka"
          ]
        },
        {
          "names": [
            "Arun Neelicattu"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2013-2133",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2013-06-03T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "969924"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the way method-level authorization for JAX-WS Service endpoints was performed by the EJB invocation handler implementation. Any restrictions declared on EJB methods were ignored when executing the JAX-WS handlers, and only class-level restrictions were applied. A remote attacker who is authorized to access the EJB class, could invoke a JAX-WS handler which they were not authorized to invoke.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "WS: EJB3 role restrictions are not applied to jaxws handlers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 4 and 5; Red Hat JBoss Enterprise Portal Platform 5; and Red Hat JBoss Enterprise SOA Platform 4 and 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-2133"
        },
        {
          "category": "external",
          "summary": "RHBZ#969924",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=969924"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-2133",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-2133"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-2133",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2133"
        }
      ],
      "release_date": "2013-12-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "WS: EJB3 role restrictions are not applied to jaxws handlers"
    },
    {
      "cve": "CVE-2013-4286",
      "discovery_date": "2014-02-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1069921"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that when Tomcat / JBoss Web processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encoding header, Tomcat / JBoss Web would incorrectly handle the request. A remote attacker could use this flaw to poison a web cache, perform cross-site scripting (XSS) attacks, or obtain sensitive information from other requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: multiple content-length header poisoning flaws",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4286"
        },
        {
          "category": "external",
          "summary": "RHBZ#1069921",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4286",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4286"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286"
        }
      ],
      "release_date": "2014-02-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: multiple content-length header poisoning flaws"
    },
    {
      "cve": "CVE-2013-5855",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2014-02-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1065139"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that Mojarra JavaServer Faces did not properly escape user-supplied content in certain circumstances. Contents of outputText tags and raw EL expressions that immediately follow script or style elements were not escaped. A remote attacker could use a specially crafted URL to execute arbitrary web script in the user\u0027s browser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-5855"
        },
        {
          "category": "external",
          "summary": "RHBZ#1065139",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-5855",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-5855"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855"
        },
        {
          "category": "external",
          "summary": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209",
          "url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209"
        }
      ],
      "release_date": "2014-02-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions"
    },
    {
      "cve": "CVE-2013-7285",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2013-12-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1051277"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: remote code execution due to insecure XML deserialization",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-7285"
        },
        {
          "category": "external",
          "summary": "RHBZ#1051277",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-7285",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-7285"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285"
        },
        {
          "category": "external",
          "summary": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html",
          "url": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html"
        },
        {
          "category": "external",
          "summary": "http://xstream.codehaus.org/security.html",
          "url": "http://xstream.codehaus.org/security.html"
        },
        {
          "category": "external",
          "summary": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/",
          "url": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/"
        }
      ],
      "release_date": "2013-12-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "XStream: remote code execution due to insecure XML deserialization"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Josef Cacek"
          ],
          "organization": "Red Hat JBoss EAP Quality Engineering team",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2014-0005",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2014-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1049736"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was identified that PicketBox/JBossSX allowed any deployed application to alter or read the underlying application server configuration and state without any authorization checks. An attacker able to deploy applications could use this flaw to circumvent security constraints applied to other applications deployed on the same system, disclose privileged information, and in certain cases allow arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0005"
        },
        {
          "category": "external",
          "summary": "RHBZ#1049736",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049736"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0005",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0005"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0005",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0005"
        }
      ],
      "release_date": "2014-03-31T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 3.6,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Stuart Douglas"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2014-0018",
      "discovery_date": "2014-01-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1052783"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "In Red Hat JBoss Enterprise Application Platform, when running under a security manager, it was possible for deployed code to get access to the Modular Service Container (MSC) service registry without any permission checks. This could allow malicious deployments to modify the internal state of the server in various ways.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jboss-as-server: Unchecked access to MSC Service Registry under JSM",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0018"
        },
        {
          "category": "external",
          "summary": "RHBZ#1052783",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1052783"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0018",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0018"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0018",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0018"
        }
      ],
      "release_date": "2014-01-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 1.9,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "jboss-as-server: Unchecked access to MSC Service Registry under JSM"
    },
    {
      "cve": "CVE-2014-0034",
      "cwe": {
        "id": "CWE-345",
        "name": "Insufficient Verification of Data Authenticity"
      },
      "discovery_date": "2014-05-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1093529"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the SecurityTokenService (STS), provided as a part of Apache CXF, could under certain circumstances accept invalid SAML tokens as valid. A remote attacker could use a specially crafted SAML token to gain access to an application that uses STS for validation of SAML tokens.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0034"
        },
        {
          "category": "external",
          "summary": "RHBZ#1093529",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093529"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0034",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0034"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0034",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0034"
        }
      ],
      "release_date": "2014-05-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid"
    },
    {
      "cve": "CVE-2014-0035",
      "cwe": {
        "id": "CWE-522",
        "name": "Insufficiently Protected Credentials"
      },
      "discovery_date": "2014-05-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1093530"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that UsernameTokens were sent in plain text by an Apache CXF client that used a Symmetric EncryptBeforeSigning password policy. A man-in-the-middle attacker could use this flaw to obtain the user name and password used by the client application using Apache CXF.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0035"
        },
        {
          "category": "external",
          "summary": "RHBZ#1093530",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093530"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0035",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0035"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0035",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0035"
        }
      ],
      "release_date": "2014-05-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy"
    },
    {
      "cve": "CVE-2014-0050",
      "discovery_date": "2014-02-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1062337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in the way Apache Commons FileUpload, which is embedded in Tomcat and JBoss Web, handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing Tomcat to enter an infinite loop when processing such an incoming request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "RHBZ#1062337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0050",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050"
        }
      ],
      "release_date": "2014-02-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream"
    },
    {
      "cve": "CVE-2014-0058",
      "discovery_date": "2014-02-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1063641"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain application or server authentication credentials.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "EAP6: Plain text password logging during security audit",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0058"
        },
        {
          "category": "external",
          "summary": "RHBZ#1063641",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063641"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0058",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0058"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0058",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0058"
        }
      ],
      "release_date": "2014-02-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 1.9,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "EAP6: Plain text password logging during security audit"
    },
    {
      "cve": "CVE-2014-0059",
      "cwe": {
        "id": "CWE-532",
        "name": "Insertion of Sensitive Information into Log File"
      },
      "discovery_date": "2014-02-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1063642"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the security auditing functionality provided by PicketBox and JBossSX, both security frameworks for Java applications, used a world-readable audit.log file to record sensitive information. A local user could possibly use this flaw to gain access to the sensitive information in the audit.log file.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "JBossSX/PicketBox: World readable audit.log file",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0059"
        },
        {
          "category": "external",
          "summary": "RHBZ#1063642",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063642"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0059",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0059"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0059",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0059"
        }
      ],
      "release_date": "2014-05-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 2.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "JBossSX/PicketBox: World readable audit.log file"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "David Jorm"
          ],
          "organization": "Red Hat Product Security",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2014-0075",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2014-02-28T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1072776"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for  Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0075"
        },
        {
          "category": "external",
          "summary": "RHBZ#1072776",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0075",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075"
        }
      ],
      "release_date": "2014-05-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter"
    },
    {
      "cve": "CVE-2014-0086",
      "discovery_date": "2014-02-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1067268"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that certain malformed requests caused RichFaces to leak memory. A remote, unauthenticated attacker could use this flaw to send a large number of malformed requests to a RichFaces application that uses the Atmosphere framework, leading to a denial of service (excessive memory consumption) on the application server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "RichFaces: remote denial of service via memory exhaustion",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0086"
        },
        {
          "category": "external",
          "summary": "RHBZ#1067268",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1067268"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0086",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0086"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0086",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0086"
        }
      ],
      "release_date": "2014-02-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "RichFaces: remote denial of service via memory exhaustion"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Josef Cacek"
          ],
          "organization": "Red Hat JBoss EAP Quality Engineering team",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2014-0093",
      "discovery_date": "2014-02-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1070046"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that Java Security Manager permissions configured via a policy file were not properly applied, causing all deployed applications to be granted the java.security.AllPermission permission. In certain cases, an attacker could use this flaw to circumvent expected security measures to perform actions which would otherwise be restricted.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "6: JSM policy not respected by deployed applications",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0093"
        },
        {
          "category": "external",
          "summary": "RHBZ#1070046",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1070046"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0093",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0093"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0093",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0093"
        }
      ],
      "release_date": "2014-02-21T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "6: JSM policy not respected by deployed applications"
    },
    {
      "cve": "CVE-2014-0096",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2014-04-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1088342"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for  Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0096"
        },
        {
          "category": "external",
          "summary": "RHBZ#1088342",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0096",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
        }
      ],
      "release_date": "2014-05-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 2.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs"
    },
    {
      "cve": "CVE-2014-0099",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2014-05-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1102030"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Tomcat/JBossWeb: Request smuggling via malicious content length header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for  Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0099"
        },
        {
          "category": "external",
          "summary": "RHBZ#1102030",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0099",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099"
        }
      ],
      "release_date": "2014-05-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Tomcat/JBossWeb: Request smuggling via malicious content length header"
    },
    {
      "cve": "CVE-2014-0107",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2014-03-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1080248"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the secure processing feature of Xalan-Java had insufficient restrictions defined for certain properties and features. A remote attacker able to provide Extensible Stylesheet Language Transformations (XSLT) content to be processed by an application using Xalan-Java could use this flaw to bypass the intended constraints of the secure processing feature. Depending on the components available in the classpath, this could lead to arbitrary remote code execution in the context of the application server running the application that uses Xalan-Java.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Xalan-Java: insufficient constraints in secure processing feature",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0107"
        },
        {
          "category": "external",
          "summary": "RHBZ#1080248",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1080248"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0107",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0107"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0107",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0107"
        },
        {
          "category": "external",
          "summary": "http://www.ocert.org/advisories/ocert-2014-002.html",
          "url": "http://www.ocert.org/advisories/ocert-2014-002.html"
        }
      ],
      "release_date": "2014-03-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Xalan-Java: insufficient constraints in secure processing feature"
    },
    {
      "cve": "CVE-2014-0109",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2014-05-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1093526"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in the way Apache CXF created error messages for certain POST requests. A remote attacker could send a specially crafted request which, when processed by an application using Apache CXF, could consume an excessive amount of memory on the system, possibly triggering an Out Of Memory (OOM) error.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: HTML content posted to SOAP endpoint could cause OOM errors",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0109"
        },
        {
          "category": "external",
          "summary": "RHBZ#1093526",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093526"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0109",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0109"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0109",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0109"
        }
      ],
      "release_date": "2014-05-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "CXF: HTML content posted to SOAP endpoint could cause OOM errors"
    },
    {
      "cve": "CVE-2014-0110",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2014-05-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1093527"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that when a large invalid SOAP message was processed by Apache CXF, it could be saved to a temporary file in the /tmp directory. A remote attacker could send a specially crafted SOAP message that, when processed by an application using Apache CXF, would use an excessive amount of disk space, possibly causing a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: Large invalid content could cause temporary space to fill",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0110"
        },
        {
          "category": "external",
          "summary": "RHBZ#1093527",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093527"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0110",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0110"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0110",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0110"
        }
      ],
      "release_date": "2014-05-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "CXF: Large invalid content could cause temporary space to fill"
    },
    {
      "cve": "CVE-2014-0119",
      "cwe": {
        "id": "CWE-470",
        "name": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)"
      },
      "discovery_date": "2014-05-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1102038"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Tomcat/JBossWeb: XML parser hijack by malicious web application",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0119"
        },
        {
          "category": "external",
          "summary": "RHBZ#1102038",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0119",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0119"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119"
        }
      ],
      "release_date": "2014-05-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 2.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Tomcat/JBossWeb: XML parser hijack by malicious web application"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "James Roper"
          ],
          "organization": "Typesafe"
        }
      ],
      "cve": "CVE-2014-0193",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2014-04-28T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1092783"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: DoS via memory exhaustion during data aggregation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0193"
        },
        {
          "category": "external",
          "summary": "RHBZ#1092783",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0193",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0193"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193"
        }
      ],
      "release_date": "2014-05-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "netty: DoS via memory exhaustion during data aggregation"
    },
    {
      "cve": "CVE-2014-0227",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2014-06-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1109196"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0227"
        },
        {
          "category": "external",
          "summary": "RHBZ#1109196",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0227",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0227"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227"
        },
        {
          "category": "external",
          "summary": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43",
          "url": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43"
        },
        {
          "category": "external",
          "summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55",
          "url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55"
        }
      ],
      "release_date": "2015-02-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter"
    },
    {
      "cve": "CVE-2014-0245",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "discovery_date": "2014-05-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1101303"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe. For a specific WSRP endpoint, under high-concurrency scenarios or scenarios where SOAP messages take long to execute, it was possible for an unauthenticated remote attacker to gain privileged information if WS-Security is enabled for the WSRP Consumer, and the endpoint in question is being used by a privileged user.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "WSRP: Information disclosure via unsafe concurrency handling in interceptor",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0245"
        },
        {
          "category": "external",
          "summary": "RHBZ#1101303",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1101303"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0245",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0245"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0245",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0245"
        }
      ],
      "release_date": "2015-03-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "WSRP: Information disclosure via unsafe concurrency handling in interceptor"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "CA Technologies"
          ]
        }
      ],
      "cve": "CVE-2014-3472",
      "cwe": {
        "id": "CWE-184",
        "name": "Incomplete List of Disallowed Inputs"
      },
      "discovery_date": "2014-05-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1103815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the isCallerInRole() method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Security: Invalid EJB caller role check implementation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3472"
        },
        {
          "category": "external",
          "summary": "RHBZ#1103815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3472",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3472"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3472",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3472"
        }
      ],
      "release_date": "2014-08-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 2.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Security: Invalid EJB caller role check implementation"
    },
    {
      "acknowledgments": [
        {
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2014-3481",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2014-06-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1105242"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the default context parameters as provided to RESTEasy deployments by JBoss EAP did not explicitly disable external entity expansion for RESTEasy. A remote attacker could use this flaw to perform XML External Entity (XXE) attacks on RESTEasy applications accepting XML input.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "JAX-RS: Information disclosure via XML eXternal Entity (XXE)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3481"
        },
        {
          "category": "external",
          "summary": "RHBZ#1105242",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1105242"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3481",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3481"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3481",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3481"
        }
      ],
      "release_date": "2014-06-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "JAX-RS: Information disclosure via XML eXternal Entity (XXE)"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "David Jorm"
          ],
          "organization": "Red Hat Product Security",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2014-3490",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2014-06-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1107901"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "RESTEasy: XXE via parameter entities",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3490"
        },
        {
          "category": "external",
          "summary": "RHBZ#1107901",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3490",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3490"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490"
        }
      ],
      "release_date": "2014-07-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "RESTEasy: XXE via parameter entities"
    },
    {
      "cve": "CVE-2014-3529",
      "discovery_date": "2014-09-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1138135"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that Apache POI would resolve entities in OOXML documents. A remote attacker able to supply OOXML documents that are parsed by Apache POI could use this flaw to read files accessible to the user running the application server, and potentially perform more advanced XML External Entity (XXE) attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-poi: XML eXternal Entity (XXE) flaw",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has determined that CVE-2014-3529 is not exploitable by default in JBoss Portal Platform as provided by Red Hat. This flaw would only be exploitable if the Apache POI library provided by JBoss Portal Platform were used by a custom application to process user-supplied XML documents.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3529"
        },
        {
          "category": "external",
          "summary": "RHBZ#1138135",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1138135"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3529",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3529"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3529",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3529"
        }
      ],
      "release_date": "2014-08-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-poi: XML eXternal Entity (XXE) flaw"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Alexander Papadakis"
          ]
        }
      ],
      "cve": "CVE-2014-3530",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2014-06-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1112987"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "PicketLink: XXE via insecure DocumentBuilderFactory usage",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw could allow remote, unauthenticated attackers to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. All systems hosting PicketLink applications using SAML Identity Providers and Service Providers may be affected. It is strongly advised that anyone running an affected system applies patches to address this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3530"
        },
        {
          "category": "external",
          "summary": "RHBZ#1112987",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3530",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3530"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530"
        }
      ],
      "release_date": "2014-07-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "PicketLink: XXE via insecure DocumentBuilderFactory usage"
    },
    {
      "cve": "CVE-2014-3574",
      "discovery_date": "2014-09-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1138140"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that Apache POI would expand an unlimited number of entities in OOXML documents. A remote attacker able to supply OOXML documents that are parsed by Apache POI could use this flaw to trigger a denial of service attack via excessive CPU and memory consumption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-poi: entity expansion (billion laughs) flaw",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has determined that CVE-2014-3574 is not exploitable by default in JBoss Portal Platform as provided by Red Hat. This flaw would only be exploitable if the Apache POI library provided by JBoss Portal Platform were used by a custom application to process user-supplied XML documents.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3574"
        },
        {
          "category": "external",
          "summary": "RHBZ#1138140",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1138140"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3574",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3574"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3574",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3574"
        }
      ],
      "release_date": "2014-08-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-poi: entity expansion (billion laughs) flaw"
    },
    {
      "cve": "CVE-2014-3577",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2014-08-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1129074"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3577"
        },
        {
          "category": "external",
          "summary": "RHBZ#1129074",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
        }
      ],
      "release_date": "2014-08-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
    },
    {
      "cve": "CVE-2014-3586",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "discovery_date": "2014-07-31T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1126687"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Command Line Interface, as provided by Red Hat Enterprise Application Platform, created a history file named .jboss-cli-history in the user\u0027s home directory with insecure default file permissions. This could allow a malicious local user to gain information otherwise not accessible to them.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CLI: Insecure default permissions on history file",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3586"
        },
        {
          "category": "external",
          "summary": "RHBZ#1126687",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1126687"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3586",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3586"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3586",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3586"
        }
      ],
      "release_date": "2015-03-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 2.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "CLI: Insecure default permissions on history file"
    },
    {
      "cve": "CVE-2014-4172",
      "discovery_date": "2014-08-19T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1131350"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cas-client: Bypass of security constraints via URL parameter injection",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-4172"
        },
        {
          "category": "external",
          "summary": "RHBZ#1131350",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131350"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-4172",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-4172"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-4172",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4172"
        },
        {
          "category": "external",
          "summary": "https://www.mail-archive.com/cas-user@lists.jasig.org/msg17338.html",
          "url": "https://www.mail-archive.com/cas-user@lists.jasig.org/msg17338.html"
        }
      ],
      "release_date": "2014-08-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "cas-client: Bypass of security constraints via URL parameter injection"
    },
    {
      "cve": "CVE-2014-7839",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2014-11-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1165328"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the RESTEasy DocumentProvider did not set the external-parameter-entities and external-general-entities features appropriately, thus allowing external entity expansion. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XML eXternal Entity (XXE) attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "RESTeasy: External entities expanded by DocumentProvider",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Web Framework Kit has moved out of maintenance phase and is no longer supported by Red Hat Product Security. This issue is not currently planned to be addressed in any future updates. For additional information, refer to the Red Hat JBoss Middleware Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-7839"
        },
        {
          "category": "external",
          "summary": "RHBZ#1165328",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1165328"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-7839",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-7839"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-7839",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7839"
        }
      ],
      "release_date": "2014-11-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "RESTeasy: External entities expanded by DocumentProvider"
    },
    {
      "cve": "CVE-2015-0226",
      "cwe": {
        "id": "CWE-327",
        "name": "Use of a Broken or Risky Cryptographic Algorithm"
      },
      "discovery_date": "2015-02-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1191446"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that a prior countermeasure in Apache WSS4J for Bleichenbacher\u0027s attack on XML Encryption (CVE-2011-2487) threw an exception that permitted an attacker to determine the failure of the attempted attack, thereby leaving WSS4J vulnerable to the attack. The original flaw allowed a remote attacker to recover the entire plain text form of a symmetric key.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wss4j: Apache WSS4J is vulnerable to Bleichenbacher\u0027s attack (incomplete fix for CVE-2011-2487)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-0226"
        },
        {
          "category": "external",
          "summary": "RHBZ#1191446",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1191446"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-0226",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-0226"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-0226",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0226"
        }
      ],
      "release_date": "2015-02-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 7.8,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "wss4j: Apache WSS4J is vulnerable to Bleichenbacher\u0027s attack (incomplete fix for CVE-2011-2487)"
    },
    {
      "cve": "CVE-2015-0227",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2015-02-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1191451"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that Apache WSS4J permitted bypass of the requireSignedEncryptedDataElements configuration property via XML Signature wrapping attacks. A remote attacker could use this flaw to modify the contents of a signed request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wss4j: Apache WSS4J doesn\u0027t correctly enforce the requireSignedEncryptedDataElements property",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-0227"
        },
        {
          "category": "external",
          "summary": "RHBZ#1191451",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1191451"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-0227",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-0227"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-0227",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0227"
        }
      ],
      "release_date": "2015-02-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-05-14T15:14:47+00:00",
          "details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
          "product_ids": [
            "Red Hat JBoss Portal 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1009"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "wss4j: Apache WSS4J doesn\u0027t correctly enforce the requireSignedEncryptedDataElements property"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Fuse 6.1.0, which fixes multiple security issues, several\nbugs, and adds various enhancements, is now available from the Red Hat\nCustomer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nModerate security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nRed Hat JBoss Fuse 6.1.0 is a minor product release that updates Red Hat\nJBoss Fuse 6.0.0, and includes several bug fixes and enhancements. Refer to\nthe Release Notes document, available from the link in the References\nsection, for a list of changes.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint,\nflexible, open source enterprise service bus and integration platform.\n\nSecurity fixes:\n\nA flaw was found in the way Apache Santuario XML Security for Java\nvalidated XML signatures. Santuario allowed a signature to specify an\narbitrary canonicalization algorithm, which would be applied to the\nSignedInfo XML fragment. A remote attacker could exploit this to spoof an\nXML signature via a specially crafted XML signature block. (CVE-2013-2172)\n\nA flaw was found in the Apache Hadoop RPC protocol. A man-in-the-middle\nattacker could possibly use this flaw to unilaterally disable bidirectional\nauthentication between a client and a server, forcing a downgrade to simple\n(unidirectional) authentication. This flaw only affected users who have\nenabled Hadoop\u0027s Kerberos security features. (CVE-2013-2192)\n\nIt was discovered that the Spring OXM wrapper did not expose any property\nfor disabling entity resolution when using the JAXB unmarshaller. A remote\nattacker could use this flaw to conduct XML External Entity (XXE) attacks\non web sites, and read files in the context of the user running the\napplication server. (CVE-2013-4152)\n\nIt was discovered that the Apache Santuario XML Security for Java project\nallowed Document Type Definitions (DTDs) to be processed when applying\nTransforms even when secure validation was enabled. A remote attacker could\nuse this flaw to exhaust all available memory on the system, causing a\ndenial of service. (CVE-2013-4517)\n\nIt was found that the Spring MVC SourceHttpMessageConverter enabled entity\nresolution by default. A remote attacker could use this flaw to conduct XXE\nattacks on web sites, and read files in the context of the user running the\napplication server. (CVE-2013-6429)\n\nThe Spring JavaScript escape method insufficiently escaped some characters.\nApplications using this method to escape user-supplied content, which would\nbe rendered in HTML5 documents, could be exposed to cross-site scripting\n(XSS) flaws. (CVE-2013-6430)\n\nA denial of service flaw was found in the way Apache Commons FileUpload\nhandled small-sized buffers used by MultipartStream. A remote attacker\ncould use this flaw to create a malformed Content-Type header for a\nmultipart request, causing Apache Commons FileUpload to enter an infinite\nloop when processing such an incoming request. (CVE-2014-0050)\n\nIt was found that fixes for the CVE-2013-4152 and CVE-2013-6429 XXE issues\nin Spring were incomplete. Spring MVC processed user-provided XML and\nneither disabled XML external entities nor provided an option to disable\nthem, possibly allowing a remote attacker to conduct XXE attacks.\n(CVE-2014-0054)\n\nA cross-site scripting (XSS) flaw was found in the Spring Framework when\nusing Spring MVC. When the action was not specified in a Spring form, the\naction field would be populated with the requested URI, allowing an\nattacker to inject malicious content into the form. (CVE-2014-1904)\n\nThe HawtJNI Library class wrote native libraries to a predictable file name\nin /tmp when the native libraries were bundled in a JAR file, and no custom\nlibrary path was specified. A local attacker could overwrite these native\nlibraries with malicious versions during the window between when HawtJNI\nwrites them and when they are executed. (CVE-2013-2035)\n\nAn information disclosure flaw was found in the way Apache Zookeeper stored\nthe password of an administrative user in the log files. A local user with\naccess to these log files could use the exposed sensitive information to\ngain administrative access to an application using Apache Zookeeper.\n(CVE-2014-0085)\n\nThe CVE-2013-6430 issue was discovered by Jon Passki of Coverity SRL and\nArun Neelicattu of the Red Hat Security Response Team, the CVE-2013-2035\nissue was discovered by Florian Weimer of the Red Hat Product Security\nTeam, and the CVE-2014-0085 issue was discovered by Graeme Colman of\nRed Hat.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:0400",
        "url": "https://access.redhat.com/errata/RHSA-2014:0400"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=distributions\u0026version=6.1.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=distributions\u0026version=6.1.0"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_Fuse/",
        "url": "https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_Fuse/"
      },
      {
        "category": "external",
        "summary": "958618",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=958618"
      },
      {
        "category": "external",
        "summary": "999263",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=999263"
      },
      {
        "category": "external",
        "summary": "1000186",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1000186"
      },
      {
        "category": "external",
        "summary": "1001326",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1001326"
      },
      {
        "category": "external",
        "summary": "1039783",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1039783"
      },
      {
        "category": "external",
        "summary": "1045257",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1045257"
      },
      {
        "category": "external",
        "summary": "1053290",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1053290"
      },
      {
        "category": "external",
        "summary": "1062337",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
      },
      {
        "category": "external",
        "summary": "1067265",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1067265"
      },
      {
        "category": "external",
        "summary": "1075296",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1075296"
      },
      {
        "category": "external",
        "summary": "1075328",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1075328"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0400.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Fuse 6.1.0 update",
    "tracking": {
      "current_release_date": "2024-11-22T08:11:58+00:00",
      "generator": {
        "date": "2024-11-22T08:11:58+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2014:0400",
      "initial_release_date": "2014-04-14T13:46:50+00:00",
      "revision_history": [
        {
          "date": "2014-04-14T13:46:50+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-04-14T14:27:37+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T08:11:58+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Fuse 6.1",
                "product": {
                  "name": "Red Hat JBoss Fuse 6.1",
                  "product_id": "Red Hat JBoss Fuse 6.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse:6.1.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Fuse Enterprise Middleware"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2013-1624",
      "cwe": {
        "id": "CWE-385",
        "name": "Covert Timing Channel"
      },
      "discovery_date": "2013-02-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "908428"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that bouncycastle leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bouncycastle: TLS CBC padding timing attack",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-1624"
        },
        {
          "category": "external",
          "summary": "RHBZ#908428",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=908428"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-1624",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-1624"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1624",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1624"
        },
        {
          "category": "external",
          "summary": "http://www.isg.rhul.ac.uk/tls/",
          "url": "http://www.isg.rhul.ac.uk/tls/"
        },
        {
          "category": "external",
          "summary": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf",
          "url": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf"
        }
      ],
      "release_date": "2013-02-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:50+00:00",
          "details": "All users of Red Hat JBoss Fuse 6.0.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss Fuse 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0400"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "bouncycastle: TLS CBC padding timing attack"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Florian Weimer"
          ],
          "organization": "Red Hat Product Security Team",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2013-2035",
      "cwe": {
        "id": "CWE-377",
        "name": "Insecure Temporary File"
      },
      "discovery_date": "2013-04-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "958618"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The HawtJNI Library class wrote native libraries to a predictable file name in /tmp when the native libraries were bundled in a JAR file, and no custom library path was specified. A local attacker could overwrite these native libraries with malicious versions during the window between when HawtJNI writes them and when they are executed.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "HawtJNI: predictable temporary file name leading to local arbitrary code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-2035"
        },
        {
          "category": "external",
          "summary": "RHBZ#958618",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=958618"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-2035",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-2035"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-2035",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2035"
        }
      ],
      "release_date": "2013-05-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:50+00:00",
          "details": "All users of Red Hat JBoss Fuse 6.0.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss Fuse 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0400"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "HawtJNI: predictable temporary file name leading to local arbitrary code execution"
    },
    {
      "cve": "CVE-2013-2172",
      "cwe": {
        "id": "CWE-290",
        "name": "Authentication Bypass by Spoofing"
      },
      "discovery_date": "2013-08-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "999263"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the way Apache Santuario XML Security for Java validated XML signatures. Santuario allowed a signature to specify an arbitrary canonicalization algorithm, which would be applied to the SignedInfo XML fragment. A remote attacker could exploit this to spoof an XML signature via a specially crafted XML signature block.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Java: XML signature spoofing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-2172"
        },
        {
          "category": "external",
          "summary": "RHBZ#999263",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=999263"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-2172",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-2172"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-2172",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2172"
        },
        {
          "category": "external",
          "summary": "http://santuario.apache.org/secadv.data/CVE-2013-2172.txt.asc",
          "url": "http://santuario.apache.org/secadv.data/CVE-2013-2172.txt.asc"
        }
      ],
      "release_date": "2013-06-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:50+00:00",
          "details": "All users of Red Hat JBoss Fuse 6.0.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss Fuse 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0400"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Java: XML signature spoofing"
    },
    {
      "cve": "CVE-2013-2192",
      "discovery_date": "2013-08-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1001326"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "hadoop: man-in-the-middle vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-2192"
        },
        {
          "category": "external",
          "summary": "RHBZ#1001326",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1001326"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-2192",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-2192"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-2192",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2192"
        }
      ],
      "release_date": "2013-08-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:50+00:00",
          "details": "All users of Red Hat JBoss Fuse 6.0.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss Fuse 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0400"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "ADJACENT_NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 3.2,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:A/AC:H/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "hadoop: man-in-the-middle vulnerability"
    },
    {
      "cve": "CVE-2013-4152",
      "discovery_date": "2013-08-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1000186"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Framework: XML External Entity (XXE) injection flaw",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4152"
        },
        {
          "category": "external",
          "summary": "RHBZ#1000186",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1000186"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4152",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4152"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4152",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4152"
        },
        {
          "category": "external",
          "summary": "http://www.gopivotal.com/security/cve-2013-4152",
          "url": "http://www.gopivotal.com/security/cve-2013-4152"
        },
        {
          "category": "external",
          "summary": "https://github.com/SpringSource/spring-framework/pull/317",
          "url": "https://github.com/SpringSource/spring-framework/pull/317"
        },
        {
          "category": "external",
          "summary": "https://jira.springsource.org/browse/SPR-10806",
          "url": "https://jira.springsource.org/browse/SPR-10806"
        }
      ],
      "release_date": "2013-08-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:50+00:00",
          "details": "All users of Red Hat JBoss Fuse 6.0.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss Fuse 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0400"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Framework: XML External Entity (XXE) injection flaw"
    },
    {
      "cve": "CVE-2013-4517",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2013-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1045257"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that the Apache Santuario XML Security for Java project allowed Document Type Definitions (DTDs) to be processed when applying Transforms even when secure validation was enabled. A remote attacker could use this flaw to exhaust all available memory on the system, causing a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Java: Java XML Signature DoS Attack",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Fuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4, Fuse Mediation Router 2.7, 2.8 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nFuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 4;  Red Hat JBoss Enterprise Data Services Platform 5; Red Hat JBoss Enterprise Portal Platform 4 and 5; and Red Hat JBoss Enterprise SOA Platform 4 and 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4517"
        },
        {
          "category": "external",
          "summary": "RHBZ#1045257",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1045257"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4517",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4517"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4517",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4517"
        }
      ],
      "release_date": "2013-11-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:50+00:00",
          "details": "All users of Red Hat JBoss Fuse 6.0.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss Fuse 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0400"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Java: Java XML Signature DoS Attack"
    },
    {
      "cve": "CVE-2013-6429",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2014-01-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1053290"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Framework: XML External Entity (XXE) injection flaw",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-6429"
        },
        {
          "category": "external",
          "summary": "RHBZ#1053290",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1053290"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-6429",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-6429"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6429",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6429"
        },
        {
          "category": "external",
          "summary": "http://www.gopivotal.com/security/cve-2013-6429",
          "url": "http://www.gopivotal.com/security/cve-2013-6429"
        }
      ],
      "release_date": "2014-01-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:50+00:00",
          "details": "All users of Red Hat JBoss Fuse 6.0.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss Fuse 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0400"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Framework: XML External Entity (XXE) injection flaw"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Jon Passki"
          ],
          "organization": "Coverity SRL"
        },
        {
          "names": [
            "Arun Neelicattu"
          ],
          "organization": "Red Hat Security Response Team",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2013-6430",
      "discovery_date": "2013-12-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1039783"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Framework: org.spring.web.util.JavaScriptUtils.javaScriptEscape insufficient escaping of characters",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-6430"
        },
        {
          "category": "external",
          "summary": "RHBZ#1039783",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1039783"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-6430",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-6430"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6430",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6430"
        },
        {
          "category": "external",
          "summary": "http://www.gopivotal.com/security/cve-2013-6430",
          "url": "http://www.gopivotal.com/security/cve-2013-6430"
        }
      ],
      "release_date": "2014-01-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:50+00:00",
          "details": "All users of Red Hat JBoss Fuse 6.0.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss Fuse 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0400"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Framework: org.spring.web.util.JavaScriptUtils.javaScriptEscape insufficient escaping of characters"
    },
    {
      "cve": "CVE-2014-0050",
      "discovery_date": "2014-02-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1062337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in the way Apache Commons FileUpload, which is embedded in Tomcat and JBoss Web, handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing Tomcat to enter an infinite loop when processing such an incoming request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "RHBZ#1062337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0050",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050"
        }
      ],
      "release_date": "2014-02-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:50+00:00",
          "details": "All users of Red Hat JBoss Fuse 6.0.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss Fuse 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0400"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream"
    },
    {
      "cve": "CVE-2014-0054",
      "discovery_date": "2014-03-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1075328"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Framework: incomplete fix for CVE-2013-7315/CVE-2013-6429",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Security Response Team has rated this issue as having Moderate security impact. OpenShift Enterprise 1 is currently in the Production 1 phase of its lifecycle, as such this issue is not currently planned to be addressed in future updates. For additional information, refer to the Satellite Life Cycle: https://access.redhat.com/site/support/policy/updates/openshift page.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0054"
        },
        {
          "category": "external",
          "summary": "RHBZ#1075328",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1075328"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0054",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0054"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0054",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0054"
        },
        {
          "category": "external",
          "summary": "http://www.gopivotal.com/security/cve-2014-0054",
          "url": "http://www.gopivotal.com/security/cve-2014-0054"
        }
      ],
      "release_date": "2014-01-31T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:50+00:00",
          "details": "All users of Red Hat JBoss Fuse 6.0.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss Fuse 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0400"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Framework: incomplete fix for CVE-2013-7315/CVE-2013-6429"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Graeme Colman"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2014-0085",
      "cwe": {
        "id": "CWE-522",
        "name": "Insufficiently Protected Credentials"
      },
      "discovery_date": "2014-02-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1067265"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. This issue is a vulnerability in JBoss Fuse\u0027s usage of Apache Zookeeper, not in Zookeeper itself as was previously stated.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Fuse: admin user cleartext password appears in logging",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw only affects Apache Zookeeper in conjunction with Fuse Fabric. Fuse Fabric was storing cleartext passwords, which would appear as cleartext in Apache Zookeeper\u0027s log files. Fuse Fabric now encrypts passwords by default.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0085"
        },
        {
          "category": "external",
          "summary": "RHBZ#1067265",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1067265"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0085",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0085"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0085",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0085"
        }
      ],
      "release_date": "2014-04-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:50+00:00",
          "details": "All users of Red Hat JBoss Fuse 6.0.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss Fuse 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0400"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 2.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Fuse: admin user cleartext password appears in logging"
    },
    {
      "cve": "CVE-2014-1904",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2014-03-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1075296"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Framework: cross-site scripting flaw when using Spring MVC",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Security Response Team has rated this issue as having Moderate security impact. OpenShift Enterprise 1 is currently in the Production 1 phase of its lifecycle, as such this issue is not currently planned to be addressed in future updates. For additional information, refer to the Satellite Life Cycle: https://access.redhat.com/site/support/policy/updates/openshift page.\n\nFuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-1904"
        },
        {
          "category": "external",
          "summary": "RHBZ#1075296",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1075296"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-1904",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-1904"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-1904",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1904"
        },
        {
          "category": "external",
          "summary": "http://www.gopivotal.com/security/cve-2014-1904",
          "url": "http://www.gopivotal.com/security/cve-2014-1904"
        }
      ],
      "release_date": "2014-02-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:50+00:00",
          "details": "All users of Red Hat JBoss Fuse 6.0.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss Fuse 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0400"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Framework: cross-site scripting flaw when using Spring MVC"
    },
    {
      "cve": "CVE-2014-3584",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2014-10-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1157330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "CXF: Denial of Service (DoS) via invalid JAX-RS SAML tokens",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did not affect Apache CXF as shipped with Red Hat JBoss Enterprise Application Platform 5 and 6; Red Hat JBoss Enterprise Web Platform 5; Red Hat JBoss SOA Platform 5; Red Hat JBoss Fuse Service Works 6; Red Hat JBoss BRMS 5 and 6; Red Hat JBoss BPM Suite 6; Red Hat JBoss Data Virtualization 6; Red Hat JBoss Operations Network 3 and Red Hat JBoss Portal Platform 6 as the REST Web Services endpoints are not available.\n\nFuse ESB Enterprise 7 is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3584"
        },
        {
          "category": "external",
          "summary": "RHBZ#1157330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1157330"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3584",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3584"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3584",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3584"
        }
      ],
      "release_date": "2014-10-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-04-14T13:46:50+00:00",
          "details": "All users of Red Hat JBoss Fuse 6.0.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss Fuse 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0400"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "CXF: Denial of Service (DoS) via invalid JAX-RS SAML tokens"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the Apache Tomcat 6 component for Red Hat JBoss Web Server\n2.0.1 that fixes multiple security issues is now available from the Red Hat\nCustomer Portal.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Web Server is a fully integrated and certified set of\ncomponents for hosting Java web applications. It is comprised of the Apache\nHTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector\n(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat\nNative library.\n\nIt was found that when Tomcat processed a series of HTTP requests in which\nat least one request contained either multiple content-length headers, or\none content-length header with a chunked transfer-encoding header, Tomcat\nwould incorrectly handle the request. A remote attacker could use this flaw\nto poison a web cache, perform cross-site scripting (XSS) attacks, or\nobtain sensitive information from other requests. (CVE-2013-4286)\n\nIt was discovered that the fix for CVE-2012-3544 did not properly resolve a\ndenial of service flaw in the way Tomcat processed chunk extensions and\ntrailing headers in chunked requests. A remote attacker could use this flaw\nto send an excessively long request that, when processed by Tomcat, could\nconsume network bandwidth, CPU, and memory on the Tomcat server. Note that\nchunked transfer encoding is enabled by default. (CVE-2013-4322)\n\nIt was found that previous fixes in Tomcat 6 to path parameter handling\nintroduced a regression that caused Tomcat to not properly disable URL\nrewriting to track session IDs when the disableURLRewriting option was\nenabled. A man-in-the-middle attacker could potentially use this flaw to\nhijack a user\u0027s session. (CVE-2014-0033)\n\nA denial of service flaw was found in the way Apache Commons FileUpload,\nwhich is embedded in Tomcat, handled small-sized buffers used by\nMultipartStream. A remote attacker could use this flaw to create a\nmalformed Content-Type header for a multipart request, causing Tomcat to\nenter an infinite loop when processing such an incoming request.\n(CVE-2014-0050)\n\nAll users of Red Hat JBoss Web Server 2.0.1 as provided from the Red Hat\nCustomer Portal are advised to apply this update. The Red Hat JBoss Web\nServer process must be restarted for the update to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:0528",
        "url": "https://access.redhat.com/errata/RHSA-2014:0528"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver\u0026downloadType=securityPatches\u0026version=2.0.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver\u0026downloadType=securityPatches\u0026version=2.0.1"
      },
      {
        "category": "external",
        "summary": "1062337",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
      },
      {
        "category": "external",
        "summary": "1069905",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069905"
      },
      {
        "category": "external",
        "summary": "1069919",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069919"
      },
      {
        "category": "external",
        "summary": "1069921",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0528.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat6 security update",
    "tracking": {
      "current_release_date": "2024-12-08T10:42:05+00:00",
      "generator": {
        "date": "2024-12-08T10:42:05+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2014:0528",
      "initial_release_date": "2014-05-21T15:45:27+00:00",
      "revision_history": [
        {
          "date": "2014-05-21T15:45:27+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:33:18+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-08T10:42:05+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Web Server 2.0",
                "product": {
                  "name": "Red Hat JBoss Web Server 2.0",
                  "product_id": "Red Hat JBoss Web Server 2.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Web Server"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2013-4286",
      "discovery_date": "2014-02-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1069921"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that when Tomcat / JBoss Web processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encoding header, Tomcat / JBoss Web would incorrectly handle the request. A remote attacker could use this flaw to poison a web cache, perform cross-site scripting (XSS) attacks, or obtain sensitive information from other requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: multiple content-length header poisoning flaws",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Web Server 2.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4286"
        },
        {
          "category": "external",
          "summary": "RHBZ#1069921",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4286",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4286"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286"
        }
      ],
      "release_date": "2014-02-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-05-21T15:45:27+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files).",
          "product_ids": [
            "Red Hat JBoss Web Server 2.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0528"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Web Server 2.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: multiple content-length header poisoning flaws"
    },
    {
      "cve": "CVE-2013-4322",
      "discovery_date": "2014-02-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1069905"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that the fix for CVE-2012-3544 did not properly resolve a denial of service flaw in the way Tomcat and JBoss Web processed chunk extensions and trailing headers in chunked requests. A remote attacker could use this flaw to send an excessively long request that, when processed by Tomcat, could consume network bandwidth, CPU, and memory on the Tomcat server. Note that chunked transfer encoding is enabled by default.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: incomplete fix for CVE-2012-3544",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Web Server 2.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4322"
        },
        {
          "category": "external",
          "summary": "RHBZ#1069905",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069905"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4322",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4322"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4322",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4322"
        }
      ],
      "release_date": "2014-02-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-05-21T15:45:27+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files).",
          "product_ids": [
            "Red Hat JBoss Web Server 2.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0528"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Web Server 2.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: incomplete fix for CVE-2012-3544"
    },
    {
      "cve": "CVE-2014-0033",
      "cwe": {
        "id": "CWE-384",
        "name": "Session Fixation"
      },
      "discovery_date": "2014-02-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1069919"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that previous fixes in Tomcat 6 to path parameter handling introduced a regression that caused Tomcat to not properly disable URL rewriting to track session IDs when the disableURLRewriting option was enabled. A man-in-the-middle attacker could potentially use this flaw to hijack a user\u0027s session.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: session fixation still possible with disableURLRewriting enabled",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did not affect JBoss Web, as shipped with various Red Hat JBoss products.\n\nThe disableURLRewriting property was introduced in Apache Tomcat 6.0.30. All versions of Apache Tomcat prior to 6.0.30 are not affected by this flaw, as the affected feature is not present.\n\nTomcat 6 as shipped with Red Hat JBoss Web Server 2.0.0 and above is affected by this flaw. Tomcat 6 as shipped with Red Hat JBoss Web Server 1.0.2 is not affected by this flaw. Tomcat 6 as shipped with Red Hat JBoss Web Server prior to 1.0.2 is not affected by this flaw, as the disableURLRewriting property is not supported. \n\nTomcat 6 as shipped with Red Hat Enterprise Linux 6 is based on Apache Tomcat 6.0.24 and is not affected by this flaw, as this flaw was introduced only in Apache Tomcat 6.0.33.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Web Server 2.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0033"
        },
        {
          "category": "external",
          "summary": "RHBZ#1069919",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069919"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0033",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0033"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0033",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0033"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/site/solutions/88203",
          "url": "https://access.redhat.com/site/solutions/88203"
        }
      ],
      "release_date": "2014-02-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-05-21T15:45:27+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files).",
          "product_ids": [
            "Red Hat JBoss Web Server 2.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0528"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Web Server 2.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: session fixation still possible with disableURLRewriting enabled"
    },
    {
      "cve": "CVE-2014-0050",
      "discovery_date": "2014-02-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1062337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in the way Apache Commons FileUpload, which is embedded in Tomcat and JBoss Web, handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing Tomcat to enter an infinite loop when processing such an incoming request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Web Server 2.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "RHBZ#1062337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0050",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0050"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050"
        }
      ],
      "release_date": "2014-02-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-05-21T15:45:27+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files).",
          "product_ids": [
            "Red Hat JBoss Web Server 2.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0528"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Web Server 2.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "commons-fileupload:commons-fileupload"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.1"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0-RC1"
            },
            {
              "fixed": "8.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 7.0.50"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.52"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2014-0050"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T22:04:56Z",
    "nvd_published_at": "2014-04-01T06:27:00Z",
    "severity": "HIGH"
  },
  "details": "MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop\u0027s intended exit conditions.",
  "id": "GHSA-xx68-jfcg-xmmf",
  "modified": "2024-03-05T19:13:45Z",
  "published": "2018-12-21T17:51:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/commons-fileupload/commit/c61ff05b3241cb14d989b67209e57aa71540417a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/29384723d8d9645b87e05be9fa369a4deeb78b9c"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-xx68-jfcg-xmmf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/commons-fileupload"
    },
    {
      "type": "WEB",
      "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755"
    },
    {
      "type": "WEB",
      "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917"
    },
    {
      "type": "WEB",
      "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722"
    },
    {
      "type": "WEB",
      "url": "https://svn.apache.org/viewvc?view=revision\u0026revision=1565143"
    },
    {
      "type": "WEB",
      "url": "https://svn.apache.org/viewvc?view=revision\u0026revision=1565163"
    },
    {
      "type": "WEB",
      "url": "https://svn.apache.org/viewvc?view=revision\u0026revision=1565169"
    },
    {
      "type": "WEB",
      "url": "https://tomcat.apache.org/security-7.html"
    },
    {
      "type": "WEB",
      "url": "https://tomcat.apache.org/security-8.html"
    },
    {
      "type": "WEB",
      "url": "http://advisories.mageia.org/MGASA-2014-0110.html"
    },
    {
      "type": "WEB",
      "url": "http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html"
    },
    {
      "type": "WEB",
      "url": "http://jvn.jp/en/jp/JVN14876762/index.html"
    },
    {
      "type": "WEB",
      "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000017"
    },
    {
      "type": "WEB",
      "url": "http://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907@apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=143136844732487\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0252.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0253.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0400.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2014/Dec/23"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/57915"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58075"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58976"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59039"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59041"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59183"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59184"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59185"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59187"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59232"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59399"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59492"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59500"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59725"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60475"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60753"
    },
    {
      "type": "WEB",
      "url": "http://svn.apache.org/r1565143"
    },
    {
      "type": "WEB",
      "url": "http://tomcat.apache.org/security-7.html"
    },
    {
      "type": "WEB",
      "url": "http://tomcat.apache.org/security-8.html"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21669554"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21675432"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676091"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676092"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676401"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676403"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676405"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676410"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676656"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676853"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677691"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677724"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681214"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2014/dsa-2856"
    },
    {
      "type": "WEB",
      "url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html"
    },
    {
      "type": "WEB",
      "url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html"
    },
    {
      "type": "WEB",
      "url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html"
    },
    {
      "type": "WEB",
      "url": "http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:084"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/532549/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/65400"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-2130-1"
    },
    {
      "type": "WEB",
      "url": "http://www.vmware.com/security/advisories/VMSA-2014-0007.html"
    },
    {
      "type": "WEB",
      "url": "http://www.vmware.com/security/advisories/VMSA-2014-0008.html"
    },
    {
      "type": "WEB",
      "url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Commons FileUpload Denial of service vulnerability"
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201404-0585",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "ucosminexus primary server base )",
        "scope": "eq",
        "trust": 1.5,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "8.0.1"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.50"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.33"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.32"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.31"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.30"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.29"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.28"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.27"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.26"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.25"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.24"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.23"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.16"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.15"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.14"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.13"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.12"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.9"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.8"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.7"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.6"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.4"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.3"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.2"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.1"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.5"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.40"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.22"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.21"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.20"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.19"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.18"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.11"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "7.0.10"
      },
      {
        "model": "commons fileupload",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "1.2.2"
      },
      {
        "model": "commons fileupload",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "1.2.1"
      },
      {
        "model": "commons fileupload",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "1.2"
      },
      {
        "model": "commons fileupload",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "1.1.1"
      },
      {
        "model": "commons fileupload",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "1.1"
      },
      {
        "model": "commons fileupload",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "apache",
        "version": "1.0"
      },
      {
        "model": "ucosminexus service platform )",
        "scope": "eq",
        "trust": 1.2,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "ucosminexus service platform",
        "scope": "eq",
        "trust": 1.2,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "ucosminexus service platform )",
        "scope": "eq",
        "trust": 1.2,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "ucosminexus service platform",
        "scope": "eq",
        "trust": 1.2,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "ucosminexus primary server base",
        "scope": "eq",
        "trust": 1.2,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "ucosminexus primary server base )",
        "scope": "eq",
        "trust": 1.2,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "ucosminexus primary server base",
        "scope": "eq",
        "trust": 1.2,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "ucosminexus application server )",
        "scope": "eq",
        "trust": 1.2,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "retail applications",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.4"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apache",
        "version": "8.0.0"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apache",
        "version": "7.0.0"
      },
      {
        "model": "retail applications",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.0in"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apache",
        "version": "7.0.36"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apache",
        "version": "7.0.35"
      },
      {
        "model": "retail applications",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.2"
      },
      {
        "model": "retail applications",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apache",
        "version": "7.0.37"
      },
      {
        "model": "retail applications",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.0"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apache",
        "version": "7.0.38"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apache",
        "version": "7.0.34"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apache",
        "version": "7.0.42"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apache",
        "version": "7.0.41"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apache",
        "version": "7.0.45"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apache",
        "version": "7.0.48"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apache",
        "version": "7.0.39"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apache",
        "version": "7.0.49"
      },
      {
        "model": "commons fileupload",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "apache",
        "version": "1.3"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apache",
        "version": "7.0.43"
      },
      {
        "model": "retail applications",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.1"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apache",
        "version": "7.0.47"
      },
      {
        "model": "retail applications",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.0"
      },
      {
        "model": "retail applications",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.3"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apache",
        "version": "7.0.44"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apache",
        "version": "7.0.46"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apache",
        "version": "7.0.17"
      },
      {
        "model": "ucosminexus application server",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "ucosminexus application server )",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "ucosminexus service platform",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-60"
      },
      {
        "model": "ucosminexus service platform",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50-02"
      },
      {
        "model": "ucosminexus service platform hp-ux",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "ucosminexus service platform (windows(x8",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "model": "ucosminexus service platform",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "model": "ucosminexus service platform hp-ux",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "ucosminexus service platform (windows(x6",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "ucosminexus service platform",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "ucosminexus service platform hp-ux",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "ucosminexus service architect )",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "ucosminexus service architect",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "ucosminexus service architect )",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "ucosminexus service architect",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "ucosminexus primary server base",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-60"
      },
      {
        "model": "ucosminexus primary server base",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50-02"
      },
      {
        "model": "ucosminexus primary server base (windows(x8",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "model": "ucosminexus primary server base",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "model": "ucosminexus primary server base hp-ux",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "ucosminexus primary server base (windows(x6",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "ucosminexus primary server base",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "ucosminexus primary server base hp-ux",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "ucosminexus developer )",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "ucosminexus developer",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "ucosminexus developer )",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "ucosminexus developer",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "ucosminexus application server-r )",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "ucosminexus application server-r",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "ucosminexus application server-r )",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "ucosminexus application server-r",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "ucosminexus application server hp-ux",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "ucosminexus application server (windows(x8",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "model": "ucosminexus application server hp-ux",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "ucosminexus application server (windows(x6",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "ucosminexus application server",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "ucosminexus application server hp-ux",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "programming environment for java )",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "programming environment for java )",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "cosminexus component container",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50-03"
      },
      {
        "model": "cosminexus component container )",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "cosminexus component container )",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "cosminexus component container window",
        "scope": "ne",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50-04"
      },
      {
        "model": "cosminexus component container",
        "scope": "ne",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50-04"
      },
      {
        "model": "vcenter server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "vmware",
        "version": "5.5"
      },
      {
        "model": "vcenter server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "vmware",
        "version": "5.1"
      },
      {
        "model": "vcenter server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "vmware",
        "version": "5.0"
      },
      {
        "model": "vcenter orchestrator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "vmware",
        "version": "5.5"
      },
      {
        "model": "vcenter orchestrator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "vmware",
        "version": "5.1"
      },
      {
        "model": "vcenter orchestrator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "vmware",
        "version": "4.2"
      },
      {
        "model": "vcenter operations management suite",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "vmware",
        "version": "5.8.1"
      },
      {
        "model": "vcenter operations management suite",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "vmware",
        "version": "5.7.1"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "13.10"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "12.10"
      },
      {
        "model": "linux lts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "12.04"
      },
      {
        "model": "linux 10.04.lts",
        "scope": null,
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": null
      },
      {
        "model": "linux enterprise server sp3 for vmware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "11"
      },
      {
        "model": "linux enterprise server sp3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "11"
      },
      {
        "model": "internet sales",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.54"
      },
      {
        "model": "internet sales",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.33"
      },
      {
        "model": "internet sales",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.32"
      },
      {
        "model": "internet sales",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.31"
      },
      {
        "model": "internet sales",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.30"
      },
      {
        "model": "opensuse",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "s u s e",
        "version": "12.3"
      },
      {
        "model": "jboss operations network",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "3.2.1"
      },
      {
        "model": "jboss operations network",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "3.2.0"
      },
      {
        "model": "jboss fuse service works",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6.0.0"
      },
      {
        "model": "jboss fuse",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6.0"
      },
      {
        "model": "jboss enterprise web server el6",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "2.0"
      },
      {
        "model": "jboss enterprise web server el5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "2.0"
      },
      {
        "model": "jboss enterprise application platform",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6.2.1"
      },
      {
        "model": "jboss enterprise application platform",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6.2"
      },
      {
        "model": "jboss enterprise application platform el6",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6"
      },
      {
        "model": "jboss enterprise application platform el5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6"
      },
      {
        "model": "jboss brms",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6.0.1"
      },
      {
        "model": "jboss brms",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6.0.0"
      },
      {
        "model": "jboss bpms",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6.0.1"
      },
      {
        "model": "jboss bpms",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6.0"
      },
      {
        "model": "jboss a-mq",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6.0.0"
      },
      {
        "model": "fuse esb enterprise",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "7.1.0"
      },
      {
        "model": "enterprise linux workstation optional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6"
      },
      {
        "model": "enterprise linux workstation",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6"
      },
      {
        "model": "enterprise linux server optional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6"
      },
      {
        "model": "enterprise linux server eus 6.5.z",
        "scope": null,
        "trust": 0.3,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "enterprise linux server aus",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6.5"
      },
      {
        "model": "enterprise linux server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6"
      },
      {
        "model": "enterprise linux hpc node optional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6"
      },
      {
        "model": "enterprise linux hpc node",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6"
      },
      {
        "model": "enterprise linux desktop optional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6"
      },
      {
        "model": "enterprise linux desktop",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6"
      },
      {
        "model": "weblogic portal",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "10.3.6.0"
      },
      {
        "model": "webcenter sites",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "11.1.18.0"
      },
      {
        "model": "webcenter sites",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "7.6.2"
      },
      {
        "model": "webcenter sites",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "11.1.1.6.1"
      },
      {
        "model": "retail returns management rm2.0",
        "scope": null,
        "trust": 0.3,
        "vendor": "oracle",
        "version": null
      },
      {
        "model": "retail returns management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "retail returns management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "13.4"
      },
      {
        "model": "retail returns management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "13.3"
      },
      {
        "model": "retail returns management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "13.2"
      },
      {
        "model": "retail returns management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "13.1"
      },
      {
        "model": "retail returns management 12.0in",
        "scope": null,
        "trust": 0.3,
        "vendor": "oracle",
        "version": null
      },
      {
        "model": "retail returns management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.0"
      },
      {
        "model": "retail open commerce platform",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "3.0"
      },
      {
        "model": "retail central office rm2.0",
        "scope": null,
        "trust": 0.3,
        "vendor": "oracle",
        "version": null
      },
      {
        "model": "retail central office",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "retail central office",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "13.4"
      },
      {
        "model": "retail central office",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "13.3"
      },
      {
        "model": "retail central office",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "13.2"
      },
      {
        "model": "retail central office",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "13.1"
      },
      {
        "model": "retail central office",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "13.0"
      },
      {
        "model": "retail central office 12.0in",
        "scope": null,
        "trust": 0.3,
        "vendor": "oracle",
        "version": null
      },
      {
        "model": "retail central office",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.0"
      },
      {
        "model": "retail back office rm2.0",
        "scope": null,
        "trust": 0.3,
        "vendor": "oracle",
        "version": null
      },
      {
        "model": "retail back office",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "retail back office",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "13.4"
      },
      {
        "model": "retail back office",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "13.3"
      },
      {
        "model": "retail back office",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "13.2"
      },
      {
        "model": "retail back office",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "13.1"
      },
      {
        "model": "retail back office",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "13.0"
      },
      {
        "model": "retail back office 12.0in",
        "scope": null,
        "trust": 0.3,
        "vendor": "oracle",
        "version": null
      },
      {
        "model": "retail back office",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.0"
      },
      {
        "model": "mysql enterprise monitor",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "3.0.10"
      },
      {
        "model": "mysql enterprise monitor",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "3.0"
      },
      {
        "model": "mysql enterprise monitor",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2.3.16"
      },
      {
        "model": "mysql enterprise monitor",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2.3.15"
      },
      {
        "model": "mysql enterprise monitor",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2.3.14"
      },
      {
        "model": "mysql enterprise monitor",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2.3.13"
      },
      {
        "model": "mysql enterprise monitor",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2.3"
      },
      {
        "model": "health sciences empirica study",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "3.1.2.0"
      },
      {
        "model": "health sciences empirica signal",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "7.3.3.3"
      },
      {
        "model": "health sciences empirica inspections",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1.0.1.0"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "7"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "6.2"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "6"
      },
      {
        "model": "endeca information discovery studio",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2.2.2"
      },
      {
        "model": "endeca information discovery studio",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "3.1"
      },
      {
        "model": "endeca information discovery studio",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "3.0"
      },
      {
        "model": "endeca information discovery studio",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2.4"
      },
      {
        "model": "endeca information discovery studio",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2.3"
      },
      {
        "model": "communications service broker engineered system edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "6.0"
      },
      {
        "model": "communications service broker",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "6.1"
      },
      {
        "model": "communications service broker",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "6.0"
      },
      {
        "model": "communications policy management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.1.1"
      },
      {
        "model": "communications policy management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "10.4.1"
      },
      {
        "model": "communications policy management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "9.9.1"
      },
      {
        "model": "communications policy management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "9.7.3"
      },
      {
        "model": "communications online mediation controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "6.1"
      },
      {
        "model": "communications converged application server service controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "6.1"
      },
      {
        "model": "application express",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "4.2.1"
      },
      {
        "model": "application express",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "3.2.1.00.10"
      },
      {
        "model": "application express",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2.2.1"
      },
      {
        "model": "application express",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1.1.3"
      },
      {
        "model": "application express",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1.1.2"
      },
      {
        "model": "application express",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1.1.1"
      },
      {
        "model": "application express",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "4.2"
      },
      {
        "model": "application express",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "4.1"
      },
      {
        "model": "application express",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "4.0"
      },
      {
        "model": "application express",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "3.2.0.00.27"
      },
      {
        "model": "application express",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "3.2"
      },
      {
        "model": "application express",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2.2"
      },
      {
        "model": "application express",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2.1"
      },
      {
        "model": "application express",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2.0"
      },
      {
        "model": "application express",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1.5"
      },
      {
        "model": "application express 1.1-ea",
        "scope": null,
        "trust": 0.3,
        "vendor": "oracle",
        "version": null
      },
      {
        "model": "business server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mandriva",
        "version": "1x8664"
      },
      {
        "model": "business server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mandriva",
        "version": "1"
      },
      {
        "model": "websphere portal",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.5"
      },
      {
        "model": "websphere portal",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0"
      },
      {
        "model": "websphere portal",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0"
      },
      {
        "model": "websphere portal",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1"
      },
      {
        "model": "websphere message broker for z/os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0"
      },
      {
        "model": "websphere message broker",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0"
      },
      {
        "model": "websphere message broker",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0"
      },
      {
        "model": "websphere lombardi edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.2.0"
      },
      {
        "model": "websphere lombardi edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1.0"
      },
      {
        "model": "websphere extended deployment compute grid",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0.0.0"
      },
      {
        "model": "websphere extended deployment compute",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1"
      },
      {
        "model": "websphere dashboard framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "model": "websphere business monitor",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0"
      },
      {
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.5.5"
      },
      {
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.5"
      },
      {
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0"
      },
      {
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0"
      },
      {
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1"
      },
      {
        "model": "web experience factory",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.5.0.0"
      },
      {
        "model": "web experience factory",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0"
      },
      {
        "model": "web experience factory",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.1"
      },
      {
        "model": "web experience factory",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0"
      },
      {
        "model": "urbancode release",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.1"
      },
      {
        "model": "urbancode release",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.1.3"
      },
      {
        "model": "urbancode release",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.1.2"
      },
      {
        "model": "urbancode release",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.1.1"
      },
      {
        "model": "urbancode release",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.0.1"
      },
      {
        "model": "urbancode release",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0"
      },
      {
        "model": "urbancode deploy",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.13"
      },
      {
        "model": "urbancode deploy",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.12"
      },
      {
        "model": "urbancode deploy",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.11"
      },
      {
        "model": "urbancode deploy",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.1"
      },
      {
        "model": "urbancode deploy",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0"
      },
      {
        "model": "tivoli storage manager operations center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1100"
      },
      {
        "model": "tivoli storage manager operations center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1000"
      },
      {
        "model": "tivoli storage manager operations center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.4.1000"
      },
      {
        "model": "tivoli storage manager operations center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.4100"
      },
      {
        "model": "tivoli remote control",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.2"
      },
      {
        "model": "tivoli endpoint manager for remote control",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "9.0"
      },
      {
        "model": "tivoli endpoint manager for remote control",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.2.1"
      },
      {
        "model": "tivoli endpoint manager for remote control",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "9.0.1"
      },
      {
        "model": "tivoli endpoint manager for remote control",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.2"
      },
      {
        "model": "tivoli endpoint manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.2.1"
      },
      {
        "model": "tivoli endpoint manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.2"
      },
      {
        "model": "tivoli endpoint manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "model": "tivoli composite application manager for application diagnostics",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1"
      },
      {
        "model": "tivoli asset discovery for distributed",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5"
      },
      {
        "model": "tivoli asset discovery for distributed",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.2.2.0"
      },
      {
        "model": "tivoli application dependency discovery manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.2.21"
      },
      {
        "model": "support assistant",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0"
      },
      {
        "model": "storwize unified software",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "v70001.40"
      },
      {
        "model": "storwize unified software",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "v70001.3.20"
      },
      {
        "model": "storwize unified software",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "v70001.4.3.2"
      },
      {
        "model": "storwize unified software",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "v70001.4.2.1"
      },
      {
        "model": "storwize unified software",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "v70001.4.2.0"
      },
      {
        "model": "storwize unified software",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "v70001.4.1.1"
      },
      {
        "model": "storwize unified software",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "v70001.4.1.0"
      },
      {
        "model": "storwize unified software",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "v70001.4.0.4"
      },
      {
        "model": "storwize unified software",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "v70001.3.2.3"
      },
      {
        "model": "storwize unified software",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "v70001.3.0.0"
      },
      {
        "model": "sterling secure proxy",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.4.1.7"
      },
      {
        "model": "sterling secure proxy",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.4.1.6"
      },
      {
        "model": "sterling secure proxy",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.4.1.5"
      },
      {
        "model": "sterling secure proxy",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.4.1.2"
      },
      {
        "model": "sterling secure proxy",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.4.1.0"
      },
      {
        "model": "sterling secure proxy",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.4.1"
      },
      {
        "model": "sterling secure proxy",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.4.0.6"
      },
      {
        "model": "sterling secure proxy",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.4.0.0"
      },
      {
        "model": "sterling secure proxy",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.4.0"
      },
      {
        "model": "sterling secure proxy",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.3.01"
      },
      {
        "model": "sterling control center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.41"
      },
      {
        "model": "sterling control center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.4.1"
      },
      {
        "model": "sterling control center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.4"
      },
      {
        "model": "sterling control center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.3"
      },
      {
        "model": "sterling control center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.2"
      },
      {
        "model": "sametime proxy server and web client",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "9.0.0.1"
      },
      {
        "model": "sametime proxy server and web client",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "9.0"
      },
      {
        "model": "sametime meeting server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "9.0.0.1"
      },
      {
        "model": "sametime meeting server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "9.0.0"
      },
      {
        "model": "sametime meeting server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.5.2.1"
      },
      {
        "model": "sametime meeting server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.5.2"
      },
      {
        "model": "rational team concert",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.5"
      },
      {
        "model": "rational team concert",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.4"
      },
      {
        "model": "rational team concert",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.3"
      },
      {
        "model": "rational team concert",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.2"
      },
      {
        "model": "rational team concert",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.1"
      },
      {
        "model": "rational team concert",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.16"
      },
      {
        "model": "rational team concert",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.1.2"
      },
      {
        "model": "rational team concert",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "2.02"
      },
      {
        "model": "rational team concert",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "2.01"
      },
      {
        "model": "rational team concert",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.6"
      },
      {
        "model": "rational team concert",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.0.1"
      },
      {
        "model": "rational team concert",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0"
      },
      {
        "model": "rational team concert",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.1.5"
      },
      {
        "model": "rational team concert",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.1.4"
      },
      {
        "model": "rational team concert",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.1.3"
      },
      {
        "model": "rational team concert",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.1"
      },
      {
        "model": "rational team concert",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0"
      },
      {
        "model": "rational team concert",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "2.0"
      },
      {
        "model": "rational software architect design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.3"
      },
      {
        "model": "rational software architect design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.2"
      },
      {
        "model": "rational software architect design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.1"
      },
      {
        "model": "rational software architect design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.1"
      },
      {
        "model": "rational software architect design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.01"
      },
      {
        "model": "rational software architect design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.6"
      },
      {
        "model": "rational software architect design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.5"
      },
      {
        "model": "rational software architect design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.4"
      },
      {
        "model": "rational software architect design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.0"
      },
      {
        "model": "rational software architect design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0"
      },
      {
        "model": "rational software architect design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.0"
      },
      {
        "model": "rational software architect design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0"
      },
      {
        "model": "rational rhapsody design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.4"
      },
      {
        "model": "rational rhapsody design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.3"
      },
      {
        "model": "rational rhapsody design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.2"
      },
      {
        "model": "rational rhapsody design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.1"
      },
      {
        "model": "rational rhapsody design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.6"
      },
      {
        "model": "rational rhapsody design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.5"
      },
      {
        "model": "rational rhapsody design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0"
      },
      {
        "model": "rational rhapsody design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.1"
      },
      {
        "model": "rational rhapsody design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.0.1"
      },
      {
        "model": "rational rhapsody design manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0"
      },
      {
        "model": "rational requirements composer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.5"
      },
      {
        "model": "rational requirements composer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.4"
      },
      {
        "model": "rational requirements composer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.3"
      },
      {
        "model": "rational requirements composer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.1"
      },
      {
        "model": "rational requirements composer ifix1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.16"
      },
      {
        "model": "rational requirements composer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.16"
      },
      {
        "model": "rational requirements composer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.1.2"
      },
      {
        "model": "rational requirements composer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "2.04"
      },
      {
        "model": "rational requirements composer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "2.02"
      },
      {
        "model": "rational requirements composer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "2.01"
      },
      {
        "model": "rational requirements composer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.6"
      },
      {
        "model": "rational requirements composer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.2"
      },
      {
        "model": "rational requirements composer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.0.2"
      },
      {
        "model": "rational requirements composer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.0.1"
      },
      {
        "model": "rational requirements composer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.0"
      },
      {
        "model": "rational requirements composer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0"
      },
      {
        "model": "rational requirements composer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.1"
      },
      {
        "model": "rational requirements composer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0"
      },
      {
        "model": "rational requirements composer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "2.0.0.3"
      },
      {
        "model": "rational requirements composer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "2.0"
      },
      {
        "model": "rational engineering lifecycle manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.5"
      },
      {
        "model": "rational engineering lifecycle manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.4"
      },
      {
        "model": "rational engineering lifecycle manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.3"
      },
      {
        "model": "rational engineering lifecycle manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.6"
      },
      {
        "model": "rational engineering lifecycle manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "1.0.0.1"
      },
      {
        "model": "rational engineering lifecycle manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "1.0"
      },
      {
        "model": "rational doors next generation",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.5"
      },
      {
        "model": "rational doors next generation",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.4"
      },
      {
        "model": "rational doors next generation",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.3"
      },
      {
        "model": "rational doors next generation",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.2"
      },
      {
        "model": "rational doors next generation",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.1"
      },
      {
        "model": "rational doors next generation",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.6"
      },
      {
        "model": "rational doors next generation",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.0"
      },
      {
        "model": "operational decision manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.2"
      },
      {
        "model": "operational decision manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.5"
      },
      {
        "model": "operational decision manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0"
      },
      {
        "model": "operational decision manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5"
      },
      {
        "model": "operational decision manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1"
      },
      {
        "model": "omnifind enterprise edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "9.1"
      },
      {
        "model": "lotus widget factory",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "model": "lotus mashups",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.0.1"
      },
      {
        "model": "lotus mashups",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "2.0.0.2"
      },
      {
        "model": "license metric tool",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5"
      },
      {
        "model": "license metric tool",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.2.2"
      },
      {
        "model": "interact",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "9.1"
      },
      {
        "model": "interact",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5"
      },
      {
        "model": "integration bus for z/os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "9.0.0.0"
      },
      {
        "model": "integration bus",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "9.0.0.0"
      },
      {
        "model": "initiate master data service",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "9.7"
      },
      {
        "model": "initiate master data service",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "9.5"
      },
      {
        "model": "initiate master data service",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "9.2"
      },
      {
        "model": "initiate master data service",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "10.1"
      },
      {
        "model": "initiate master data service",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "10.0"
      },
      {
        "model": "infosphere master data management server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "10.1"
      },
      {
        "model": "infosphere master data management server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "10.0"
      },
      {
        "model": "infosphere master data management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "11.0"
      },
      {
        "model": "infosphere mashuphub",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0"
      },
      {
        "model": "infosphere mashuphub",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "2.0"
      },
      {
        "model": "infosphere guardium data redaction",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "2.5"
      },
      {
        "model": "business monitor",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5.1"
      },
      {
        "model": "business monitor",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5"
      },
      {
        "model": "forms server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0.1"
      },
      {
        "model": "forms server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.02"
      },
      {
        "model": "forms server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0"
      },
      {
        "model": "forms server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0"
      },
      {
        "model": "forms experience builder",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.5"
      },
      {
        "model": "forms experience builder",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0"
      },
      {
        "model": "flashsystem 9848-ae1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "v840"
      },
      {
        "model": "flashsystem 9848-ac1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "v840"
      },
      {
        "model": "flashsystem 9848-ac0",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "v840"
      },
      {
        "model": "flashsystem 9846-ae1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "v840"
      },
      {
        "model": "flashsystem 9846-ac1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "v840"
      },
      {
        "model": "flashsystem 9846-ac0",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "v840"
      },
      {
        "model": "flashsystem 9840-ae1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "v840"
      },
      {
        "model": "flashsystem 9848-ae1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "840"
      },
      {
        "model": "flashsystem 9846-ae1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "840"
      },
      {
        "model": "flashsystem 9843-ae1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "840"
      },
      {
        "model": "flashsystem 9840-ae1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "840"
      },
      {
        "model": "flashsystem",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8400"
      },
      {
        "model": "filenet services for lotus quickr",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "1.1"
      },
      {
        "model": "filenet p8 application engine",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.2"
      },
      {
        "model": "filenet content manager workplace xt",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "1.1.5"
      },
      {
        "model": "filenet content manager workplace xt",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "1.1.4"
      },
      {
        "model": "filenet content manager workplace xt",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "1.1.3"
      },
      {
        "model": "filenet content manager workplace xt",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "1.1.2"
      },
      {
        "model": "filenet content manager workplace xt",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "1.1.1"
      },
      {
        "model": "filenet content manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.2.0"
      },
      {
        "model": "filenet collaboration services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "2.0.2"
      },
      {
        "model": "filenet business process framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.1"
      },
      {
        "model": "endpoint manager for remote control",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "9.1.0"
      },
      {
        "model": "distributed marketing",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "9.1"
      },
      {
        "model": "distributed marketing",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "9.0"
      },
      {
        "model": "distributed marketing",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0"
      },
      {
        "model": "db2 query management facility for websphere fix pack",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "9.122"
      },
      {
        "model": "db2 query management facility for websphere",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "9.1"
      },
      {
        "model": "db2 query management facility for websphere fix pack",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "11.11"
      },
      {
        "model": "db2 query management facility for websphere",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "11.1"
      },
      {
        "model": "db2 query management facility for websphere fix pack",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "10.19"
      },
      {
        "model": "db2 query management facility for websphere",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "10.1"
      },
      {
        "model": "dataquant",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "2.1.1"
      },
      {
        "model": "dataquant",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "1.2.19"
      },
      {
        "model": "content manager services for lotus quickr",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "1.1"
      },
      {
        "model": "content manager services for lotus quickr",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "1.0"
      },
      {
        "model": "content integrator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.5.1"
      },
      {
        "model": "content integrator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.6"
      },
      {
        "model": "content foundation",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.2.0"
      },
      {
        "model": "content analytics with enterprise search",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0"
      },
      {
        "model": "content analytics with enterprise search",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "2.2"
      },
      {
        "model": "connections",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0"
      },
      {
        "model": "connections",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.5"
      },
      {
        "model": "connections",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0"
      },
      {
        "model": "connections",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.1.1"
      },
      {
        "model": "connections",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.1.0"
      },
      {
        "model": "campaign",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "9.1"
      },
      {
        "model": "campaign",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "9.0"
      },
      {
        "model": "campaign",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.6"
      },
      {
        "model": "campaign",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.5"
      },
      {
        "model": "campaign",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.3"
      },
      {
        "model": "campaign",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.2"
      },
      {
        "model": "campaign",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.1"
      },
      {
        "model": "campaign",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0"
      },
      {
        "model": "campaign",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.6"
      },
      {
        "model": "campaign",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5"
      },
      {
        "model": "campaign",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.4"
      },
      {
        "model": "campaign",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.3"
      },
      {
        "model": "campaign",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.2"
      },
      {
        "model": "campaign",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1"
      },
      {
        "model": "campaign",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0"
      },
      {
        "model": "c\u00faram social program management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.5"
      },
      {
        "model": "c\u00faram social program management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.4"
      },
      {
        "model": "c\u00faram social program management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.3"
      },
      {
        "model": "c\u00faram social program management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2"
      },
      {
        "model": "c\u00faram social program management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.2.6"
      },
      {
        "model": "c\u00faram social program management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.2.5"
      },
      {
        "model": "c\u00faram social program management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.2.4"
      },
      {
        "model": "c\u00faram social program management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.2.1"
      },
      {
        "model": "c\u00faram social program management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.2"
      },
      {
        "model": "c\u00faram social program management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.5.4"
      },
      {
        "model": "c\u00faram social program management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.5.3"
      },
      {
        "model": "c\u00faram social program management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.5.2"
      },
      {
        "model": "c\u00faram social program management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.4.5"
      },
      {
        "model": "c\u00faram social program management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.4.4"
      },
      {
        "model": "c\u00faram social program management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.4.3"
      },
      {
        "model": "c\u00faram social program management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.5"
      },
      {
        "model": "business process manager standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.5.5"
      },
      {
        "model": "business process manager standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.5.0"
      },
      {
        "model": "business process manager standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0"
      },
      {
        "model": "business process manager standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5.0"
      },
      {
        "model": "business process manager express",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.5.5"
      },
      {
        "model": "business process manager express",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.5.0"
      },
      {
        "model": "business process manager express",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0.0"
      },
      {
        "model": "business process manager express",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5.0"
      },
      {
        "model": "business process manager advanced on z/os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.5.0"
      },
      {
        "model": "business process manager advanced on z/os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0.0"
      },
      {
        "model": "business process manager advanced on z/os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5.0"
      },
      {
        "model": "business process manager advanced",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.5.5"
      },
      {
        "model": "business process manager advanced",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.5"
      },
      {
        "model": "business process manager advanced",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0.0"
      },
      {
        "model": "business process manager advanced",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5.0"
      },
      {
        "model": "business monitor",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0.1"
      },
      {
        "model": "usg9580 v200r001c00",
        "scope": null,
        "trust": 0.3,
        "vendor": "huawei",
        "version": null
      },
      {
        "model": "usg9560 v200r001c00",
        "scope": null,
        "trust": 0.3,
        "vendor": "huawei",
        "version": null
      },
      {
        "model": "usg9520 v200r001c00",
        "scope": null,
        "trust": 0.3,
        "vendor": "huawei",
        "version": null
      },
      {
        "model": "eudemon8000e-x8 v200r001c00",
        "scope": null,
        "trust": 0.3,
        "vendor": "huawei",
        "version": null
      },
      {
        "model": "eudemon8000e-x3 v200r001c00",
        "scope": null,
        "trust": 0.3,
        "vendor": "huawei",
        "version": null
      },
      {
        "model": "eudemon8000e-x16 v200r001c00",
        "scope": null,
        "trust": 0.3,
        "vendor": "huawei",
        "version": null
      },
      {
        "model": "espace meeting portal v100r001c00",
        "scope": null,
        "trust": 0.3,
        "vendor": "huawei",
        "version": null
      },
      {
        "model": "anyoffice v200r002c10spc500",
        "scope": null,
        "trust": 0.3,
        "vendor": "huawei",
        "version": null
      },
      {
        "model": "antiddos v100r001c00",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "huawei",
        "version": "8080"
      },
      {
        "model": "antiddos v100r001c00",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "huawei",
        "version": "8060"
      },
      {
        "model": "antiddos v100r001c00",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "huawei",
        "version": "8030"
      },
      {
        "model": "antiddos 500-d v100r001c00",
        "scope": null,
        "trust": 0.3,
        "vendor": "huawei",
        "version": null
      },
      {
        "model": "antiddos v100r001c00",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "huawei",
        "version": "1550"
      },
      {
        "model": "antiddos v100r001c00",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "huawei",
        "version": "1520"
      },
      {
        "model": "sitescope monitors 11.32ip1",
        "scope": null,
        "trust": 0.3,
        "vendor": "hp",
        "version": null
      },
      {
        "model": "sitescope monitors",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "11.20"
      },
      {
        "model": "sdn van controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "2.5"
      },
      {
        "model": "insight control",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "7.5.1"
      },
      {
        "model": "insight control",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "7.5"
      },
      {
        "model": "insight control",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "7.4"
      },
      {
        "model": "insight control",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "7.3"
      },
      {
        "model": "insight control",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "7.2"
      },
      {
        "model": "ucosminexus service platform (windows(x6",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50-01"
      },
      {
        "model": "ucosminexus service architect",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-60"
      },
      {
        "model": "ucosminexus service architect",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50-02"
      },
      {
        "model": "ucosminexus service architect hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "ucosminexus service architect (windows(x8",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "model": "ucosminexus service architect",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "model": "ucosminexus service architect hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "ucosminexus service architect (windows(x6",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "ucosminexus service architect",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "ucosminexus service architect hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "ucosminexus primary server base (windows(x6",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50-01"
      },
      {
        "model": "ucosminexus primary server base hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "ucosminexus developer )",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "0109-50"
      },
      {
        "model": "ucosminexus developer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-60"
      },
      {
        "model": "ucosminexus developer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50-02"
      },
      {
        "model": "ucosminexus developer (windows(x6",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50-01"
      },
      {
        "model": "ucosminexus developer hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "ucosminexus developer (windows(x8",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "model": "ucosminexus developer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "model": "ucosminexus developer hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "ucosminexus developer (windows(x6",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "ucosminexus developer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "ucosminexus developer hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "ucosminexus application server-r",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-60"
      },
      {
        "model": "ucosminexus application server-r",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50-02"
      },
      {
        "model": "ucosminexus application server-r hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "ucosminexus application server-r (windows(x8",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "model": "ucosminexus application server-r",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "model": "ucosminexus application server-r hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "ucosminexus application server-r (windows(x6",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "ucosminexus application server-r",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "ucosminexus application server-r hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "ucosminexus application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "ucosminexus application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-60"
      },
      {
        "model": "ucosminexus application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50-02"
      },
      {
        "model": "ucosminexus application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "model": "programming environment for java hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "programming environment for java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "programming environment for java (windows(x8",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "model": "programming environment for java hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "programming environment for java (windows(x6",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "programming environment for java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "programming environment for java hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "programming environment for java",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "jp1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-10-10-03"
      },
      {
        "model": "jp1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-10-10"
      },
      {
        "model": "jp1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-10-02-04"
      },
      {
        "model": "jp1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-10-02"
      },
      {
        "model": "jp1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-10-01-03"
      },
      {
        "model": "jp1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-10-01-02"
      },
      {
        "model": "jp1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-10-01-01"
      },
      {
        "model": "jp1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-10-01"
      },
      {
        "model": "jp1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-10-00-02"
      },
      {
        "model": "jp1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-10-00-01"
      },
      {
        "model": "jp1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-10-00"
      },
      {
        "model": "jp1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-09-51-05"
      },
      {
        "model": "jp1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-09-51-04"
      },
      {
        "model": "jp1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-09-51-03"
      },
      {
        "model": "jp1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-09-51-02"
      },
      {
        "model": "jp1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-09-51-01"
      },
      {
        "model": "jp1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-09-51"
      },
      {
        "model": "jp1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-09-50-03"
      },
      {
        "model": "jp1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-09-50-02"
      },
      {
        "model": "jp1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-09-50"
      },
      {
        "model": "job management partner 1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-10-01-06"
      },
      {
        "model": "job management partner 1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-10-01-03"
      },
      {
        "model": "job management partner 1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-10-01"
      },
      {
        "model": "job management partner 1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-09-50-03"
      },
      {
        "model": "job management partner 1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-09-50-02"
      },
      {
        "model": "job management partner 1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-09-50-01"
      },
      {
        "model": "job management partner 1/it desktop management manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-09-50"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-00-06"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-00-02"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-00-01"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-00"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00-12"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00-11"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00-10"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00-09"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00-08"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00-07"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00-06"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00-04"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00-03"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00-01"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "02-50-07"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "02-50-06"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "02-50-05"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "02-50-04"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "02-50-03"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "02-50-02"
      },
      {
        "model": "it operations director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "02-50-01"
      },
      {
        "model": "it operations analyzer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-02"
      },
      {
        "model": "it operations analyzer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-01-02"
      },
      {
        "model": "it operations analyzer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-01-01"
      },
      {
        "model": "it operations analyzer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-01"
      },
      {
        "model": "it operations analyzer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "02-53-02"
      },
      {
        "model": "it operations analyzer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "02-53-01"
      },
      {
        "model": "it operations analyzer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "02-53"
      },
      {
        "model": "it operations analyzer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "02-51-01"
      },
      {
        "model": "it operations analyzer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "02-51"
      },
      {
        "model": "it operations analyzer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "02-01"
      },
      {
        "model": "cosminexus component container hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50-03"
      },
      {
        "model": "cosminexus component container (windows(x8",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50-03"
      },
      {
        "model": "cosminexus component container (windows(x6",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50-03"
      },
      {
        "model": "cosminexus component container hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50-01"
      },
      {
        "model": "cosminexus component container",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50-01"
      },
      {
        "model": "cosminexus component container",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "model": "cosminexus component container (windows(x8",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-10"
      },
      {
        "model": "cosminexus component container (windows(x6",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-10"
      },
      {
        "model": "cosminexus component container",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-10"
      },
      {
        "model": "cosminexus component container hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-08"
      },
      {
        "model": "cosminexus component container",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-08"
      },
      {
        "model": "cosminexus component container",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "model": "cosminexus component container hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-01"
      },
      {
        "model": "cosminexus component container",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "model": "linux",
        "scope": null,
        "trust": 0.3,
        "vendor": "gentoo",
        "version": null
      },
      {
        "model": "enterprise manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "3.1.1"
      },
      {
        "model": "enterprise manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "3.1"
      },
      {
        "model": "enterprise manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "3.0"
      },
      {
        "model": "enterprise manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "2.3"
      },
      {
        "model": "enterprise manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "2.0"
      },
      {
        "model": "big-ip wom",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "model": "big-ip wom",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.0"
      },
      {
        "model": "big-ip wom",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "model": "big-ip wom",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.2"
      },
      {
        "model": "big-ip wom",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.0"
      },
      {
        "model": "big-ip wom",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "model": "big-ip wom hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip wom hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip wom",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip wom hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "model": "big-ip wom hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "model": "big-ip wom hf7",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "model": "big-ip wom",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "model": "big-ip webaccelerator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.00"
      },
      {
        "model": "big-ip webaccelerator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3"
      },
      {
        "model": "big-ip webaccelerator hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip webaccelerator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip webaccelerator hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "model": "big-ip webaccelerator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1"
      },
      {
        "model": "big-ip webaccelerator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.0"
      },
      {
        "model": "big-ip webaccelerator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "model": "big-ip webaccelerator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.0"
      },
      {
        "model": "big-ip webaccelerator hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip webaccelerator hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "model": "big-ip webaccelerator hf7",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "model": "big-ip psm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.1"
      },
      {
        "model": "big-ip psm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3"
      },
      {
        "model": "big-ip psm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "model": "big-ip psm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1"
      },
      {
        "model": "big-ip psm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.0"
      },
      {
        "model": "big-ip psm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "model": "big-ip psm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.0"
      },
      {
        "model": "big-ip psm hf4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "model": "big-ip psm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip psm hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip psm hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip psm hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip psm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip psm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "model": "big-ip psm hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "model": "big-ip psm hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "model": "big-ip psm hf7",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "model": "big-ip pem",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5.1"
      },
      {
        "model": "big-ip pem",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5"
      },
      {
        "model": "big-ip pem",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3"
      },
      {
        "model": "big-ip pem",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.1"
      },
      {
        "model": "big-ip pem hf4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "model": "big-ip ltm hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip ltm hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.0"
      },
      {
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.2"
      },
      {
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.0"
      },
      {
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5"
      },
      {
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.1"
      },
      {
        "model": "big-ip ltm hf4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "model": "big-ip ltm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip ltm hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip ltm hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip ltm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "model": "big-ip ltm hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "model": "big-ip ltm hf7",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "model": "big-ip ltm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "model": "big-ip ltm hf4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.00"
      },
      {
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5.1"
      },
      {
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5"
      },
      {
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3"
      },
      {
        "model": "big-ip link controller hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip link controller hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1"
      },
      {
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.0"
      },
      {
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.2"
      },
      {
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.0"
      },
      {
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.1"
      },
      {
        "model": "big-ip link controller hf4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "model": "big-ip link controller hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip link controller hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip link controller hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip link controller hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "model": "big-ip link controller hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "model": "big-ip link controller hf7",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5.1"
      },
      {
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5"
      },
      {
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3"
      },
      {
        "model": "big-ip gtm hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.0"
      },
      {
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.2"
      },
      {
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.0"
      },
      {
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.1"
      },
      {
        "model": "big-ip gtm hf4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "model": "big-ip gtm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip gtm hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip gtm hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip gtm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "model": "big-ip gtm hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "model": "big-ip gtm hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "model": "big-ip gtm hf7",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "model": "big-ip edge gateway",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3"
      },
      {
        "model": "big-ip edge gateway hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip edge gateway",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip edge gateway hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "model": "big-ip edge gateway",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "model": "big-ip edge gateway",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1"
      },
      {
        "model": "big-ip edge gateway",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.0"
      },
      {
        "model": "big-ip edge gateway",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "model": "big-ip edge gateway",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.2"
      },
      {
        "model": "big-ip edge gateway hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip edge gateway hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip edge gateway hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "model": "big-ip edge gateway hf7",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "model": "big-ip edge gateway",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.1"
      },
      {
        "model": "big-ip asm hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.00"
      },
      {
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.00"
      },
      {
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.0.00"
      },
      {
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.40"
      },
      {
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.0.00"
      },
      {
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5.1"
      },
      {
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5"
      },
      {
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.2"
      },
      {
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.1"
      },
      {
        "model": "big-ip asm hf4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "model": "big-ip asm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip asm hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip asm hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip asm hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip asm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "model": "big-ip asm hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "model": "big-ip asm hf7",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "model": "big-ip asm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "model": "big-ip asm hf4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5.1"
      },
      {
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.0"
      },
      {
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.2"
      },
      {
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5.0"
      },
      {
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.1"
      },
      {
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.0"
      },
      {
        "model": "big-ip apm hf4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "model": "big-ip apm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip apm hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip apm hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip apm hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip apm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "model": "big-ip apm hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "model": "big-ip apm hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "model": "big-ip apm hf7",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "model": "big-ip apm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "model": "big-ip apm hf4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.1"
      },
      {
        "model": "big-ip analytics",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5.1"
      },
      {
        "model": "big-ip analytics",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3"
      },
      {
        "model": "big-ip analytics hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip analytics",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip analytics hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "model": "big-ip analytics",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "model": "big-ip analytics",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.1"
      },
      {
        "model": "big-ip analytics hf4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "model": "big-ip analytics hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip analytics hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip analytics hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "model": "big-ip analytics hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "model": "big-ip analytics hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "model": "big-ip analytics hf7",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "model": "big-ip analytics",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "model": "big-ip analytics 11.0.0-hf2",
        "scope": null,
        "trust": 0.3,
        "vendor": "f5",
        "version": null
      },
      {
        "model": "big-ip analytics",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.0.0"
      },
      {
        "model": "big-ip afm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5.1"
      },
      {
        "model": "big-ip afm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5"
      },
      {
        "model": "big-ip afm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3"
      },
      {
        "model": "big-ip afm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.1"
      },
      {
        "model": "big-ip afm hf4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "model": "big-ip aam",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5.1"
      },
      {
        "model": "big-ip aam",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5"
      },
      {
        "model": "big-ip aam",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.1"
      },
      {
        "model": "big-ip aam",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.0"
      },
      {
        "model": "linux sparc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "model": "linux s/390",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "model": "linux powerpc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "model": "linux mips",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "model": "linux ia-64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "model": "linux ia-32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "model": "linux arm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "model": "linux amd64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "model": "centos",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "centos",
        "version": "6"
      },
      {
        "model": "ip office server edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "9.0"
      },
      {
        "model": "ip office application server sp",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "9.02"
      },
      {
        "model": "ip office application server sp",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "9.01"
      },
      {
        "model": "ip office application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "9.0"
      },
      {
        "model": "aura conferencing standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "7.0"
      },
      {
        "model": "aura conferencing",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "7.0"
      },
      {
        "model": "clearpass",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "arubanetworks",
        "version": "6.0.2"
      },
      {
        "model": "clearpass",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "arubanetworks",
        "version": "6.0.1"
      },
      {
        "model": "clearpass",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "arubanetworks",
        "version": "6.3.0"
      },
      {
        "model": "clearpass",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "arubanetworks",
        "version": "6.2.0"
      },
      {
        "model": "clearpass",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "arubanetworks",
        "version": "6.1.3"
      },
      {
        "model": "clearpass",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "arubanetworks",
        "version": "6.1.0"
      },
      {
        "model": "clearpass",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "arubanetworks",
        "version": "5.0"
      },
      {
        "model": "tomcat beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "7.0"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "7.0"
      },
      {
        "model": "tomcat 8.0.0-rc1",
        "scope": null,
        "trust": 0.3,
        "vendor": "apache",
        "version": null
      },
      {
        "model": "tomcat beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "7.0.4"
      },
      {
        "model": "tomcat beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "7.0.2"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "20"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.3.41"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.3.4"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.2.3"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.2.11"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.2"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.1.8.1"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.1.8"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.1.6"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.1.5"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.1.2"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.1.1"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.1"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.14"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.12"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.11.2"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.11.1"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.11"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.10"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.9"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.8"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.7"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.6"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.5"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.4"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.3"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.2"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.1"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.3.8"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.3.7"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.3.3"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.3.16"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.3.15.3"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.3.15.2"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.3.15.1"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.3.15"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.3.14.3"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.3.14.2"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.3.14.1"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.3.14"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.3.12"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.3.1.2"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.3.1.1"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.3.1"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.2.3.1"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.1.4"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.1.3"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.13"
      },
      {
        "model": "commons fileupload",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "1.3"
      },
      {
        "model": "vcenter server update",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "vmware",
        "version": "5.52"
      },
      {
        "model": "vcenter operations management suite",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "vmware",
        "version": "5.8.2"
      },
      {
        "model": "vcenter operations management suite",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "vmware",
        "version": "5.7.3"
      },
      {
        "model": "jboss fuse",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6.1.0"
      },
      {
        "model": "jboss a-mq",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6.1.0"
      },
      {
        "model": "urbancode release",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.1.4"
      },
      {
        "model": "urbancode deploy",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.14"
      },
      {
        "model": "tivoli storage manager operations center",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1200"
      },
      {
        "model": "tivoli storage manager operations center",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.4.2000"
      },
      {
        "model": "sterling secure proxy",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.4.1.8"
      },
      {
        "model": "infosphere guardium data redaction",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "2.5.1"
      },
      {
        "model": "filenet business process framework",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.1.0.10"
      },
      {
        "model": "db2 query management facility for websphere fix pack",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "9.123"
      },
      {
        "model": "db2 query management facility for websphere fix pack",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "11.12"
      },
      {
        "model": "db2 query management facility for websphere fix pack",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "10.110"
      },
      {
        "model": "dataquant",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "2.1.2"
      },
      {
        "model": "dataquant",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "1.2.20"
      },
      {
        "model": "connections cr1",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0"
      },
      {
        "model": "espace meeting portal v100r001c00spc303",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "huawei",
        "version": null
      },
      {
        "model": "anyoffice v200r002c10l00422",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "huawei",
        "version": null
      },
      {
        "model": "antiddos v100r001c00sph503",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "huawei",
        "version": "8000"
      },
      {
        "model": "cosminexus component container hp-ux",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50-04"
      },
      {
        "model": "clearpass",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "arubanetworks",
        "version": "6.3.2"
      },
      {
        "model": "clearpass",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "arubanetworks",
        "version": "6.2.6"
      },
      {
        "model": "clearpass",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "arubanetworks",
        "version": "6.1.4"
      },
      {
        "model": "struts",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.3.16.1"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "65400"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0050"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_applications:12.0in:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_applications:13.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_applications:13.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_applications:13.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_applications:12.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_applications:14.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_applications:13.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_applications:13.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:commons_fileupload:1.2.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:commons_fileupload:1.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:commons_fileupload:1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:commons_fileupload:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.3",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:commons_fileupload:1.1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:commons_fileupload:1.2.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:commons_fileupload:1.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-0050"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Hitachi Incident Response Team (HIRT) via JPCERT",
    "sources": [
      {
        "db": "BID",
        "id": "65400"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2014-0050",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULMON",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2014-0050",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "HIGH",
            "trust": 0.1,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2014-0050",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2014-0050",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2014-0050"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0050"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop\u0027s intended exit conditions. Apache Commons FileUpload is prone to a remote denial-of-service vulnerability. \nAttackers can exploit this issue to cause the application to enter an infinite loop which may cause denial-of-service conditions. \nThe following products are vulnerable:\nApache Commons FileUpload 1.0 through versions 1.3\nApache Tomcat 8.0.0-RC1 through versions 8.0.1\nApache Tomcat 7.0.0 through versions 7.0.50. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n _______________________________________________________________________\n\n Mandriva Linux Security Advisory                         MDVSA-2015:084\n http://www.mandriva.com/en/support/security/\n _______________________________________________________________________\n\n Package : tomcat\n Date    : March 28, 2015\n Affected: Business Server 2.0\n _______________________________________________________________________\n\n Problem Description:\n\n Updated tomcat package fixes security vulnerabilities:\n \n It was discovered that the Apache Commons FileUpload package for Java\n could enter an infinite loop while processing a multipart request with\n a crafted Content-Type, resulting in a denial-of-service condition\n (CVE-2014-0050). \n \n Apache Tomcat 7.x before 7.0.50 allows attackers to obtain Tomcat\n internals information by leveraging the presence of an untrusted web\n application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML\n document containing an external entity declaration in conjunction\n with an entity reference, related to an XML External Entity (XXE)\n issue (CVE-2013-4590). \n \n java/org/apache/catalina/servlets/DefaultServlet.java in the default\n servlet in Apache Tomcat before 6.0.40 and 7.x before 7.0.53 does not\n properly restrict XSLT stylesheets, which allows remote attackers\n to bypass security-manager restrictions and read arbitrary files\n via a crafted web application that provides an XML external entity\n declaration in conjunction with an entity reference, related to an\n XML External Entity (XXE) issue (CVE-2014-0096). \n \n Apache Tomcat before 6.0.40 and 7.x before 7.0.54 does not properly\n constrain the class loader that accesses the XML parser used with\n an XSLT stylesheet, which allows remote attackers to read arbitrary\n files via a crafted web application that provides an XML external\n entity declaration in conjunction with an entity reference, related\n to an XML External Entity (XXE) issue, or read files associated with\n different web applications on a single Tomcat instance via a crafted\n web application (CVE-2014-0119). \n _______________________________________________________________________\n\n References:\n\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4322\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4590\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0050\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0075\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0096\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0099\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0119\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0227\n http://advisories.mageia.org/MGASA-2014-0110.html\n http://advisories.mageia.org/MGASA-2014-0149.html\n http://advisories.mageia.org/MGASA-2014-0268.html\n _______________________________________________________________________\n\n Updated Packages:\n\n Mandriva Business Server 2/X86_64:\n 58f55f0050c7ac4eb3c31308cc62d244  mbs2/x86_64/tomcat-7.0.59-1.mbs2.noarch.rpm\n 9c28750a8ec902d5bde42748a14d99ab  mbs2/x86_64/tomcat-admin-webapps-7.0.59-1.mbs2.noarch.rpm\n b62639d405462dc9f28fd4afe11ddd57  mbs2/x86_64/tomcat-docs-webapp-7.0.59-1.mbs2.noarch.rpm\n 57b85f852426d5c7e282542165d2ea6f  mbs2/x86_64/tomcat-el-2.2-api-7.0.59-1.mbs2.noarch.rpm\n 8410dbab11abe4f307576ecd657e427c  mbs2/x86_64/tomcat-javadoc-7.0.59-1.mbs2.noarch.rpm\n aaffb8c0cd7d82c6dcb1b0ecc00dc7c8  mbs2/x86_64/tomcat-jsp-2.2-api-7.0.59-1.mbs2.noarch.rpm\n 538438ca90caa2eb6f49bca3bb6e0e2e  mbs2/x86_64/tomcat-jsvc-7.0.59-1.mbs2.noarch.rpm\n 9a2d902c3a3e24af3f2da240c42c787f  mbs2/x86_64/tomcat-lib-7.0.59-1.mbs2.noarch.rpm\n af5562b305ae7fd1406a9c94c9316cb5  mbs2/x86_64/tomcat-log4j-7.0.59-1.mbs2.noarch.rpm\n 3349a91a1667f299641e16aed4c3aadc  mbs2/x86_64/tomcat-servlet-3.0-api-7.0.59-1.mbs2.noarch.rpm\n 4777adcbc177da7e1b8b158d6186141c  mbs2/x86_64/tomcat-webapps-7.0.59-1.mbs2.noarch.rpm \n b832a8fcd47ae9fb696ca9424bd2a934  mbs2/SRPMS/tomcat-7.0.59-1.mbs2.src.rpm\n _______________________________________________________________________\n\n To upgrade automatically use MandrivaUpdate or urpmi.  The verification\n of md5 checksums and GPG signatures is performed automatically for you. \n\n All packages are signed by Mandriva for security.  You can obtain the\n GPG public key of the Mandriva Security Team by executing:\n\n  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98\n\n You can view other update advisories for Mandriva Linux at:\n\n  http://www.mandriva.com/en/support/security/advisories/\n\n If you want to report vulnerabilities, please contact\n\n  security_(at)_mandriva.com\n _______________________________________________________________________\n\n Type Bits/KeyID     Date       User ID\n pub  1024D/22458A98 2000-07-10 Mandriva Security Team\n  \u003csecurity*mandriva.com\u003e\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.12 (GNU/Linux)\n\niD8DBQFVFl05mqjQ0CJFipgRAniKAKC/MpUAj48M/7CzWXB4hv87uo99lwCg4Em4\n9yRzhuJFw0DWd+dOc4antEU=\n=SHMh\n-----END PGP SIGNATURE-----\n. \n\nReferences:\n\n  - CVE-2009-5028 - Namazu Remote Denial of Service\n  - CVE-2011-4345 - Namazu Cross-site Scripting\n  - CVE-2014-0050 - Apache Commons Collection Unauthorized Disclosure of\nInformation\n  - CVE-2014-4877 - GNU Wget, Unauthorized Disclosure of Information\n  - CVE-2015-5125 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5127 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5129 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5130 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5131 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5132 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5133 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5134 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5539 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5540 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5541 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5544 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5545 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5546 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5547 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5548 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5549 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5550 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5551 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5552 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5553 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5554 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5555 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5556 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5557 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5558 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5559 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5560 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5561 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5562 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5563 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5564 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5565 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5566 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5567 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5568 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5570 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5571 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5572 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5573 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5574 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5575 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5576 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5577 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5578 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5579 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5580 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5581 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5582 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5584 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5587 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-5588 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-6420 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-6676 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-6677 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-6678 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-6679 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-6682 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-7547 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8044 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8415 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8416 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8417 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8418 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8419 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8420 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8421 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8422 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8423 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8424 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8425 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8426 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8427 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8428 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8429 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8430 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8431 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8432 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8433 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8434 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8435 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8436 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8437 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8438 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8439 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8440 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8441 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8442 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8443 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8444 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8445 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8446 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8447 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8448 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8449 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8450 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8451 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8452 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8453 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8454 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8455 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8456 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8457 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8459 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8460 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8634 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8635 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8636 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8638 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8639 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8640 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8641 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8642 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8643 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8644 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8645 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8646 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8647 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8648 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8649 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8650 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2015-8651 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-0702 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-0705 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-0777 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-0778 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-0797 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-0799 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-1521 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-1907 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-2105 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-2106 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-2107 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-2109 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-2183 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-2842 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-3739 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-4070 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-4071 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-4072 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-4342 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-4343 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-4393 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-4394 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-4395 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-4396 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-4537 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-4538 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-4539 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-4540 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-4541 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-4542 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-4543 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-5385 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-5387 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2016-5388 - Adobe Flash, Unauthorized Disclosure of Information\n  - CVE-2017-5787 - DoS - LINUX VCRM\n  - CVE-2016-8517 - SIM\n  - CVE-2016-8516 - SIM\n  - CVE-2016-8518 - SIM\n  - CVE-2016-8513 - Cross-Site Request Forgery (CSRF) Linux VCRM\n  - CVE-2016-8515 - Malicious File Upload - Linux VCRM\n  - CVE-2016-8514 - Information Disclosure - Linux VCRM\n\nSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. ============================================================================\nUbuntu Security Notice USN-2130-1\nMarch 06, 2014\n\ntomcat6, tomcat7 vulnerabilities\n============================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 13.10\n- Ubuntu 12.10\n- Ubuntu 12.04 LTS\n- Ubuntu 10.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in Tomcat. \n\nSoftware Description:\n- tomcat7: Servlet and JSP engine\n- tomcat6: Servlet and JSP engine\n\nDetails:\n\nIt was discovered that Tomcat incorrectly handled certain inconsistent\nHTTP headers. This issue\nonly applied to Ubuntu 12.04 LTS. This issue only applied to Ubuntu 12.10 and Ubuntu 13.10. \n(CVE-2014-0050)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 13.10:\n  libtomcat7-java                 7.0.42-1ubuntu0.1\n\nUbuntu 12.10:\n  libtomcat7-java                 7.0.30-0ubuntu1.3\n\nUbuntu 12.04 LTS:\n  libtomcat6-java                 6.0.35-1ubuntu3.4\n\nUbuntu 10.04 LTS:\n  libtomcat6-java                 6.0.24-2ubuntu1.15\n\nIn general, a standard system update will make all the necessary changes. (CVE-2014-0050)\n\nWarning: Before applying this update, back up your existing Red Hat JBoss\nEnterprise Application Platform installation and deployed applications. \nThe JBoss server process must be restarted for the update to take effect. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. Also, back up any customized Red\nHat JBoss Enterprise Application Platform 6 configuration files. On update,\nthe configuration files that have been locally modified will not be\nupdated. The updated version of such files will be stored as the rpmnew\nfiles. Make sure to locate any such files after the update and merge any\nchanges manually. Bugs fixed (https://bugzilla.redhat.com/):\n\n1062337 - CVE-2014-0050 apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream\n\n6. Package List:\n\nRed Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server:\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossweb-7.3.0-2.Final_redhat_2.1.ep6.el5.src.rpm\n\nnoarch:\njbossweb-7.3.0-2.Final_redhat_2.1.ep6.el5.noarch.rpm\n\nRed Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server:\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jbossweb-7.3.0-2.Final_redhat_2.1.ep6.el6.src.rpm\n\nnoarch:\njbossweb-7.3.0-2.Final_redhat_2.1.ep6.el6.noarch.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/#package\n\n7. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Important: Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update\nAdvisory ID:       RHSA-2014:0452-01\nProduct:           Fuse Enterprise Middleware\nAdvisory URL:      https://rhn.redhat.com/errata/RHSA-2014-0452.html\nIssue date:        2014-04-30\nCVE Names:         CVE-2013-6440 CVE-2013-7285 CVE-2014-0002 \n                   CVE-2014-0003 CVE-2014-0050 \n=====================================================================\n\n1. Summary:\n\nFuse ESB Enterprise/MQ Enterprise 7.1.0 R1 P3 (Patch 3 on Rollup Patch 1),\nwhich addresses several security issues and contains multiple bug fixes, is\nnow available from the Red Hat Customer Portal. \n\nThe Red Hat Security Response Team has rated this update as having\nImportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section. \n\n2. Description:\n\nFuse ESB Enterprise is an integration platform based on Apache ServiceMix. \nFuse MQ Enterprise, based on Apache ActiveMQ, is a standards-compliant\nmessaging system that is tailored for use in mission critical applications. \n\nThis release of Fuse ESB Enterprise/MQ Enterprise 7.1.0 R1 P3 is an update\nto Fuse ESB Enterprise 7.1.0 and Fuse MQ Enterprise 7.1.0. It includes\nvarious bug fixes, which are listed in the README file included with the\npatch files. \n\nThe following security issues are also addressed with this release:\n\nIt was found that XStream could deserialize arbitrary user-supplied XML\ncontent, representing objects of any type. A remote attacker able to pass\nXML to XStream could use this flaw to perform a variety of attacks,\nincluding remote code execution in the context of the server running the\nXStream application. (CVE-2013-7285)\n\nIt was found that the Apache Camel XSLT component allowed XSL stylesheets\nto call external Java methods. A remote attacker able to submit messages to\na Camel route could use this flaw to perform arbitrary remote code\nexecution in the context of the Camel server process. (CVE-2014-0003)\n\nIt was found that the ParserPool and Decrypter classes in the OpenSAML Java\nimplementation resolved external entities, permitting XML External Entity\n(XXE) attacks. A remote attacker could use this flaw to read files\naccessible to the user running the application server and, potentially,\nperform other more advanced XXE attacks. (CVE-2013-6440)\n\nIt was found that the Apache Camel XSLT component would resolve entities in\nXML messages when transforming them using an XSLT route. A remote attacker\nable to submit messages to an XSLT Camel route could use this flaw to read\nfiles accessible to the user running the application server and,\npotentially, perform other more advanced XXE attacks. (CVE-2014-0002)\n\nA denial of service flaw was found in the way Apache Commons FileUpload\nhandled small-sized buffers used by MultipartStream. (CVE-2014-0050)\n\nThe CVE-2014-0002 and CVE-2014-0003 issues were discovered by David Jorm of\nthe Red Hat Security Response Team, and the CVE-2013-6440 issue was\ndiscovered by David Illsley, Ron Gutierrez of Gotham Digital Science, and\nDavid Jorm of the Red Hat Security Response Team. \n\nAll users of Fuse ESB Enterprise/MQ Enterprise 7.1.0 as provided from the\nRed Hat Customer Portal are advised to upgrade to Fuse ESB Enterprise/MQ\nEnterprise 7.1.0 R1 P3. \n\n3. Solution:\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). \n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1043332 - CVE-2013-6440 XMLTooling-J/OpenSAML Java: XML eXternal Entity (XXE) flaw in ParserPool and Decrypter\n1049675 - CVE-2014-0002 Camel: XML eXternal Entity (XXE) flaw in XSLT component\n1049692 - CVE-2014-0003 Camel: remote code execution via XSL\n1051277 - CVE-2013-7285 XStream: remote code execution due to insecure XML deserialization\n1062337 - CVE-2014-0050 apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream\n\n5. References:\n\nhttps://www.redhat.com/security/data/cve/CVE-2013-6440.html\nhttps://www.redhat.com/security/data/cve/CVE-2013-7285.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-0002.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-0003.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-0050.html\nhttps://access.redhat.com/security/updates/classification/#important\nhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.esb.enterprise\u0026downloadType=securityPatches\u0026version=7.1.0\nhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.mq.enterprise\u0026downloadType=securityPatches\u0026version=7.1.0\n\n6. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e.  More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2014 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.4 (GNU/Linux)\n\niD8DBQFTYUouXlSAg2UNWIIRAtXhAJ4wWYfapk4Iw08GBZF04ZzzquwtUACeJyUX\nUK7VBUwV1N8jMgwNq3JF0xk=\n=M7ru\n-----END PGP SIGNATURE-----\n\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. It is comprised of the Apache\nHTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector\n(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat\nNative library. \n\nIt was found that when Tomcat processed a series of HTTP requests in which\nat least one request contained either multiple content-length headers, or\none content-length header with a chunked transfer-encoding header, Tomcat\nwould incorrectly handle the request. (CVE-2013-4286)\n\nIt was discovered that the fix for CVE-2012-3544 did not properly resolve a\ndenial of service flaw in the way Tomcat processed chunk extensions and\ntrailing headers in chunked requests. A remote attacker could use this flaw\nto send an excessively long request that, when processed by Tomcat, could\nconsume network bandwidth, CPU, and memory on the Tomcat server. Note that\nchunked transfer encoding is enabled by default. (CVE-2013-4322)\n\nIt was found that previous fixes in Tomcat 6 to path parameter handling\nintroduced a regression that caused Tomcat to not properly disable URL\nrewriting to track session IDs when the disableURLRewriting option was\nenabled. A man-in-the-middle attacker could potentially use this flaw to\nhijack a user\u0027s session. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nNote: the current version of the following document is available here:\nhttps://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05324755\n\nSUPPORT COMMUNICATION - SECURITY BULLETIN\n\nDocument ID: c05324755\nVersion: 1\n\nHPSBGN03669 rev.1 - HPE SiteScope, Local Elevation of Privilege, Remote\nDenial of Service, Arbitrary Code Execution and Cross-Site Request Forgery\n\nNOTICE: The information in this Security Bulletin should be acted upon as\nsoon as possible. \n\nRelease Date: 2016-11-04\nLast Updated: 2016-11-04\n\nPotential Security Impact: Local: Elevation of Privilege; Remote: Arbitrary\nCode Execution, Cross-Site Request Forgery (CSRF), Denial of Service (DoS)\n\nSource: Hewlett Packard Enterprise, Product Security Response Team\n\nVULNERABILITY SUMMARY\nPotential vulnerabilities have been identified in HPE SiteScope. The\nvulnerabilities could be exploited to allow local elevation of privilege and\nexploited remotely to allow denial of service, arbitrary code execution,\ncross-site request forgery. \n\nReferences:\n\n  - CVE-2014-0114 - Apache Struts, execution of arbitrary code\n  - CVE-2016-0763 - Apache Tomcat, denial of service (DoS)\n  - CVE-2014-0107 - Apache XML Xalan, bypass expected restrictions \n  - CVE-2015-3253 - Apache Groovy, execution of arbitrary code \n  - CVE-2015-5652 - Python, elevation of privilege\n  - CVE-2013-6429 - Spring Framework, cross-site request forgery\n  - CVE-2014-0050 - Apache Commons FileUpload, denial of service (DoS)\n  - PSRT110264\n\nSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. \n\n  - HP SiteScope Monitors Software Series 11.2xa11.32IP1\n\nBACKGROUND\n\n  CVSS Base Metrics\n  =================\n  Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector\n\n    CVE-2013-6429\n      6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L\n      6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)\n\n    CVE-2014-0050\n      8.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2014-0107\n      8.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2014-0114\n      6.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2015-3253\n      7.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2015-5652\n      8.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\n      7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)\n\n    CVE-2016-0763\n      6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L\n      6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)\n\n    Information on CVSS is documented in\n    HPE Customer Notice HPSN-2008-002 here:\n\nhttps://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499\n\nRESOLUTION\n\nHPE has provided a resolution via an update to HPE SiteScope. Details on the\nupdate and each vulnerability are in the KM articles below. \n\n  **Note:** The resolution for each vulnerability listed is to upgrade to\nSiteScope 11.32IP2 or an even more recent version of SiteScope if available. \nThe SiteScope update can be can found in the personal zone in \"my updates\" in\nHPE Software Support Online: \u003chttps://softwaresupport.hpe.com\u003e. \n\n\n  * Apache Commons FileUpload: KM02550251 (CVE-2014-0050): \n\n    +\n\u003chttps://softwaresupport.hpe.com/group/softwaresupport/search-result/-/facets\narch/document/KM02550251\u003e\n\n\n  * Apache Struts: KM02553983 (CVE-2014-0114):\n\n    +\n\u003chttps://softwaresupport.hpe.com/group/softwaresupport/search-result/-/facets\narch/document/KM02553983\u003e\n\n\n  * Apache Tomcat: KM02553990 (CVE-2016-0763):\n\n    +\n\u003chttps://softwaresupport.hpe.com/group/softwaresupport/search-result/-/facets\narch/document/KM02553990\u003e\n\n  * Apache XML Xalan: KM02553991 (CVE-2014-0107):\n\n    +\n\u003chttps://softwaresupport.hpe.com/group/softwaresupport/search-result/-/facets\narch/document/KM02553991\u003e\n\n  * Apache Groovy: KM02553992 (CVE-2015-3253):\n\n    +\n\u003chttps://softwaresupport.hpe.com/group/softwaresupport/search-result/-/facets\narch/document/KM02553992\u003e\n\n  * Python: KM02553997 (CVE-2015-5652):\n\n    *\n\u003chttps://softwaresupport.hpe.com/group/softwaresupport/search-result/-/facets\narch/document/KM02553997\u003e\n\n  * Spring Framework: KM02553998 (CVE-2013-6429):\n\n    +\n\u003chttps://softwaresupport.hpe.com/group/softwaresupport/search-result/-/facets\narch/document/KM02553998\u003e\n\nHISTORY\nVersion:1 (rev.1) - 4 November 2016 Initial release\n\nThird Party Security Patches: Third party security patches that are to be\ninstalled on systems running Hewlett Packard Enterprise (HPE) software\nproducts should be applied in accordance with the customer\u0027s patch management\npolicy. \n\nSupport: For issues about implementing the recommendations of this Security\nBulletin, contact normal HPE Services support channel. For other issues about\nthe content of this Security Bulletin, send e-mail to security-alert@hpe.com. \n\nReport: To report a potential security vulnerability for any HPE supported\nproduct:\n  Web form: https://www.hpe.com/info/report-security-vulnerability\n  Email: security-alert@hpe.com\n\nSubscribe: To initiate a subscription to receive future HPE Security Bulletin\nalerts via Email: http://www.hpe.com/support/Subscriber_Choice\n\nSecurity Bulletin Archive: A list of recently released Security Bulletins is\navailable here: http://www.hpe.com/support/Security_Bulletin_Archive\n\nSoftware Product Category: The Software Product Category is represented in\nthe title by the two characters following HPSB. \n\n3C = 3COM\n3P = 3rd Party Software\nGN = HPE General Software\nHF = HPE Hardware and Firmware\nMU = Multi-Platform Software\nNS = NonStop Servers\nOV = OpenVMS\nPV = ProCurve\nST = Storage Software\nUX = HP-UX\n\nCopyright 2016 Hewlett Packard Enterprise\n\nHewlett Packard Enterprise shall not be liable for technical or editorial\nerrors or omissions contained herein. The information provided is provided\n\"as is\" without warranty of any kind. To the extent permitted by law, neither\nHP or its affiliates, subcontractors or suppliers will be liable for\nincidental,special or consequential damages including downtime cost; lost\nprofits; damages relating to the procurement of substitute products or\nservices; or damages for loss of data, or software restoration. The\ninformation in this document is subject to change without notice. Hewlett\nPackard Enterprise and the names of Hewlett Packard Enterprise products\nreferenced herein are trademarks of Hewlett Packard Enterprise in the United\nStates and other countries. Other product and company names mentioned herein\nmay be trademarks of their respective owners",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-0050"
      },
      {
        "db": "BID",
        "id": "65400"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0050"
      },
      {
        "db": "PACKETSTORM",
        "id": "131089"
      },
      {
        "db": "PACKETSTORM",
        "id": "141092"
      },
      {
        "db": "PACKETSTORM",
        "id": "125580"
      },
      {
        "db": "PACKETSTORM",
        "id": "125562"
      },
      {
        "db": "PACKETSTORM",
        "id": "140605"
      },
      {
        "db": "PACKETSTORM",
        "id": "126404"
      },
      {
        "db": "PACKETSTORM",
        "id": "126745"
      },
      {
        "db": "PACKETSTORM",
        "id": "139721"
      }
    ],
    "trust": 1.98
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=31615",
        "trust": 0.1,
        "type": "exploit"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2014-0050"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2014-0050",
        "trust": 2.2
      },
      {
        "db": "JVN",
        "id": "JVN14876762",
        "trust": 1.4
      },
      {
        "db": "HITACHI",
        "id": "HS14-015",
        "trust": 1.4
      },
      {
        "db": "HITACHI",
        "id": "HS14-017",
        "trust": 1.4
      },
      {
        "db": "HITACHI",
        "id": "HS14-016",
        "trust": 1.4
      },
      {
        "db": "BID",
        "id": "65400",
        "trust": 1.4
      },
      {
        "db": "SECUNIA",
        "id": "59232",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "59399",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "59185",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "59187",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "59039",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "59500",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "59184",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "60475",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "59041",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "59183",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "58075",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "58976",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "59492",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "59725",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "60753",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "57915",
        "trust": 1.1
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-000017",
        "trust": 1.1
      },
      {
        "db": "PACKETSTORM",
        "id": "127215",
        "trust": 1.1
      },
      {
        "db": "HITACHI",
        "id": "HS14-008",
        "trust": 0.3
      },
      {
        "db": "EXPLOIT-DB",
        "id": "31615",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0050",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "131089",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "141092",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "125580",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "125562",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "140605",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "126404",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "126745",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "139721",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2014-0050"
      },
      {
        "db": "BID",
        "id": "65400"
      },
      {
        "db": "PACKETSTORM",
        "id": "131089"
      },
      {
        "db": "PACKETSTORM",
        "id": "141092"
      },
      {
        "db": "PACKETSTORM",
        "id": "125580"
      },
      {
        "db": "PACKETSTORM",
        "id": "125562"
      },
      {
        "db": "PACKETSTORM",
        "id": "140605"
      },
      {
        "db": "PACKETSTORM",
        "id": "126404"
      },
      {
        "db": "PACKETSTORM",
        "id": "126745"
      },
      {
        "db": "PACKETSTORM",
        "id": "139721"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0050"
      }
    ]
  },
  "id": "VAR-201404-0585",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.4072467342857143
  },
  "last_update_date": "2024-06-17T10:12:21.043000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Debian Security Advisories: DSA-2856-1 libcommons-fileupload-java -- denial of service",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=642945afda91c20bf7efbc771575262b"
      },
      {
        "title": "Amazon Linux AMI: ALAS-2014-312",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=alas-2014-312"
      },
      {
        "title": "Ubuntu Security Notice: tomcat6, tomcat7 vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-2130-1"
      },
      {
        "title": "IBM: Security Bulletin: A vulnerability in Apache Commons Fileupload affects IBM Tivoli Business Service Manager (CVE-2013-2186,  CVE-2013-0248, CVE-2016-3092, CVE-2014-0050, 220723)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=8bc75a85691b82e540dfdc9fe13fab57"
      },
      {
        "title": "Debian Security Advisories: DSA-2897-1 tomcat7 -- security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=2d279d06ad61c5b596d45790e28df427"
      },
      {
        "title": "Debian CVElist Bug Report Logs: tomcat7: CVE-2013-2071",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=94f2b1959436d579ea8b492b708008b8"
      },
      {
        "title": "Amazon Linux AMI: ALAS-2014-344",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=alas-2014-344"
      },
      {
        "title": "Symantec Security Advisories: SA100 : Apache Tomcat Vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=symantec_security_advisories\u0026qid=94a4a81a426ea8a524a402abe366c375"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - April 2015",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=4b527561ba1a5de7a529c8a93679f585"
      },
      {
        "title": "IBM: IBM Security Bulletin: IBM Security Privileged Identity Manager is affected by multiple security vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=8580d3cd770371e2ef0f68ca624b80b0"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - January 2016",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=63802a6c83b107c4e6e0c7f9241a66a8"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - October 2015",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=744c19dc9f4f70ad58059bf8733ec9c1"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - October 2017",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=523d3f220a64ff01dd95e064bd37566a"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - January 2015",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=4a692d6d60aa31507cb101702b494c51"
      },
      {
        "title": "IBM: IBM Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to multiple security vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=55ea315dfb69fce8383762ac64250315"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - October 2016",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=05aabe19d38058b7814ef5514aab4c0c"
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/shiverino/npe2223 "
      },
      {
        "title": "cve-2014-0050",
        "trust": 0.1,
        "url": "https://github.com/jrrdev/cve-2014-0050 "
      },
      {
        "title": "victims-version-search",
        "trust": 0.1,
        "url": "https://github.com/adedov/victims-version-search "
      },
      {
        "title": "-maven-security-versions",
        "trust": 0.1,
        "url": "https://github.com/nagauker/-maven-security-versions "
      },
      {
        "title": "maven-security-versions-Travis",
        "trust": 0.1,
        "url": "https://github.com/klee94/maven-security-versions-travis "
      },
      {
        "title": "victims",
        "trust": 0.1,
        "url": "https://github.com/alexsh88/victims "
      },
      {
        "title": "victims",
        "trust": 0.1,
        "url": "https://github.com/tmpgit3000/victims "
      },
      {
        "title": "maven-security-versions",
        "trust": 0.1,
        "url": "https://github.com/victims/maven-security-versions "
      },
      {
        "title": "CDL",
        "trust": 0.1,
        "url": "https://github.com/ncsu-dance-research-group/cdl "
      },
      {
        "title": "Classified-Distributed-Learning-for-Detecting-Security-Attacks-in-Containerized-Applications",
        "trust": 0.1,
        "url": "https://github.com/yuhang-lin/classified-distributed-learning-for-detecting-security-attacks-in-containerized-applications "
      },
      {
        "title": "Threatpost",
        "trust": 0.1,
        "url": "https://threatpost.com/vmware-patches-apache-struts-flaws-in-vcops/106858/"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2014-0050"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-264",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-0050"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.5,
        "url": "http://rhn.redhat.com/errata/rhsa-2014-0253.html"
      },
      {
        "trust": 1.4,
        "url": "http://jvn.jp/en/jp/jvn14876762/index.html"
      },
      {
        "trust": 1.4,
        "url": "http://rhn.redhat.com/errata/rhsa-2014-0400.html"
      },
      {
        "trust": 1.4,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676410"
      },
      {
        "trust": 1.4,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676401"
      },
      {
        "trust": 1.4,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677724"
      },
      {
        "trust": 1.4,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21675432"
      },
      {
        "trust": 1.4,
        "url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs14-016/index.html"
      },
      {
        "trust": 1.4,
        "url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs14-017/index.html"
      },
      {
        "trust": 1.4,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676403"
      },
      {
        "trust": 1.4,
        "url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs14-015/index.html"
      },
      {
        "trust": 1.4,
        "url": "http://www.vmware.com/security/advisories/vmsa-2014-0007.html"
      },
      {
        "trust": 1.4,
        "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"
      },
      {
        "trust": 1.4,
        "url": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html"
      },
      {
        "trust": 1.4,
        "url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"
      },
      {
        "trust": 1.4,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
      },
      {
        "trust": 1.4,
        "url": "http://www.vmware.com/security/advisories/vmsa-2014-0008.html"
      },
      {
        "trust": 1.4,
        "url": "http://rhn.redhat.com/errata/rhsa-2014-0252.html"
      },
      {
        "trust": 1.2,
        "url": "http://advisories.mageia.org/mgasa-2014-0110.html"
      },
      {
        "trust": 1.2,
        "url": "http://www.ubuntu.com/usn/usn-2130-1"
      },
      {
        "trust": 1.1,
        "url": "http://tomcat.apache.org/security-8.html"
      },
      {
        "trust": 1.1,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
      },
      {
        "trust": 1.1,
        "url": "http://jvndb.jvn.jp/jvndb/jvndb-2014-000017"
      },
      {
        "trust": 1.1,
        "url": "http://svn.apache.org/r1565143"
      },
      {
        "trust": 1.1,
        "url": "http://tomcat.apache.org/security-7.html"
      },
      {
        "trust": 1.1,
        "url": "http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/57915"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/58976"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/59232"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/59183"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/59500"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/58075"
      },
      {
        "trust": 1.1,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676853"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/59187"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/59041"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/59185"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/59492"
      },
      {
        "trust": 1.1,
        "url": "http://www.securityfocus.com/bid/65400"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/59039"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/59725"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/59399"
      },
      {
        "trust": 1.1,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676656"
      },
      {
        "trust": 1.1,
        "url": "http://packetstormsecurity.com/files/127215/vmware-security-advisory-2014-0007.html"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/59184"
      },
      {
        "trust": 1.1,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676405"
      },
      {
        "trust": 1.1,
        "url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"
      },
      {
        "trust": 1.1,
        "url": "http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/60475"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/60753"
      },
      {
        "trust": 1.1,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677691"
      },
      {
        "trust": 1.1,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681214"
      },
      {
        "trust": 1.1,
        "url": "http://www.vmware.com/security/advisories/vmsa-2014-0012.html"
      },
      {
        "trust": 1.1,
        "url": "http://seclists.org/fulldisclosure/2014/dec/23"
      },
      {
        "trust": 1.1,
        "url": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html"
      },
      {
        "trust": 1.1,
        "url": "http://www.mandriva.com/security/advisories?name=mdvsa-2015:084"
      },
      {
        "trust": 1.1,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676091"
      },
      {
        "trust": 1.1,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676092"
      },
      {
        "trust": 1.1,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21669554"
      },
      {
        "trust": 1.1,
        "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=143136844732487\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05324755"
      },
      {
        "trust": 1.1,
        "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05376917"
      },
      {
        "trust": 1.1,
        "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05390722"
      },
      {
        "trust": 1.1,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
      },
      {
        "trust": 1.1,
        "url": "http://www.debian.org/security/2014/dsa-2856"
      },
      {
        "trust": 1.1,
        "url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"
      },
      {
        "trust": 1.1,
        "url": "http://www.securityfocus.com/archive/1/532549/100/0/threaded"
      },
      {
        "trust": 1.1,
        "url": "https://security.gentoo.org/glsa/202107-39"
      },
      {
        "trust": 1.1,
        "url": "http://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3c52f373fc.9030907%40apache.org%3e"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0050"
      },
      {
        "trust": 0.4,
        "url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05324755"
      },
      {
        "trust": 0.4,
        "url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05376917"
      },
      {
        "trust": 0.4,
        "url": "https://rhn.redhat.com/errata/rhsa-2014-0528.html"
      },
      {
        "trust": 0.3,
        "url": "https://downloads.avaya.com/css/p8/documents/100179973"
      },
      {
        "trust": 0.3,
        "url": "http://seclists.org/fulldisclosure/2014/feb/41"
      },
      {
        "trust": 0.3,
        "url": "http://www.apache.org/"
      },
      {
        "trust": 0.3,
        "url": "http://struts.apache.org/release/2.3.x/docs/s2-020.html"
      },
      {
        "trust": 0.3,
        "url": "http://www.arubanetworks.com/support/alerts/aid-051414.asc"
      },
      {
        "trust": 0.3,
        "url": "http://tomcat.apache.org/"
      },
      {
        "trust": 0.3,
        "url": "http://commons.apache.org/proper/commons-fileupload//"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21668731"
      },
      {
        "trust": 0.3,
        "url": "http://support.f5.com/kb/en-us/solutions/public/15000/100/sol15189.html"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=ssg1s1004740"
      },
      {
        "trust": 0.3,
        "url": "http://seclists.org/bugtraq/2014/jun/151"
      },
      {
        "trust": 0.3,
        "url": "https://rhn.redhat.com/errata/rhsa-2014-0401.html"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21680564"
      },
      {
        "trust": 0.3,
        "url": "https://downloads.avaya.com/css/p8/documents/100178813"
      },
      {
        "trust": 0.3,
        "url": "https://rhn.redhat.com/errata/rhsa-2014-0373.html"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21682645"
      },
      {
        "trust": 0.3,
        "url": "http://www.ibm.com/support/docview.wss?uid=swg21669383"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21675470"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21671261"
      },
      {
        "trust": 0.3,
        "url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs14-008/index.html"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hp.com/hpsc/doc/public/display?docid=emr_na-c04657823"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21680714"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21669021"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24037189"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21671330"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21673004"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678830"
      },
      {
        "trust": 0.3,
        "url": "https://rhn.redhat.com/errata/rhsa-2014-0459.html"
      },
      {
        "trust": 0.3,
        "url": "https://rhn.redhat.com/errata/rhsa-2014-0525.html"
      },
      {
        "trust": 0.3,
        "url": "https://rhn.redhat.com/errata/rhsa-2014-0526.html"
      },
      {
        "trust": 0.3,
        "url": "https://rhn.redhat.com/errata/rhsa-2014-0527.html"
      },
      {
        "trust": 0.3,
        "url": "https://launchpad.support.sap.com/#/notes/2629535"
      },
      {
        "trust": 0.3,
        "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageid=497256000"
      },
      {
        "trust": 0.3,
        "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageid=495289255"
      },
      {
        "trust": 0.3,
        "url": "https://rhn.redhat.com/errata/rhsa-2014-0429.html"
      },
      {
        "trust": 0.3,
        "url": "http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/archive/hw-350733.htm"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21676853"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678364"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21678373"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21684861"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21684286"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21672321"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678359"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21681214,swg21680564"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21670373"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21670400"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21682055"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=ssg1s1004813"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21688411"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21670769"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21680366"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21671527"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21666799"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21674439"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21673701"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21672717"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21667254"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21676092"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21676091"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21673260"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21673682"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21673581"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=ssg1s1004858"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=ssg1s1004859"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21672032"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21669020"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21671201"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21671653"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=ssg1s1004819"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21668978"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21671684"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-4322"
      },
      {
        "trust": 0.3,
        "url": "http://www.hpe.com/support/security_bulletin_archive"
      },
      {
        "trust": 0.3,
        "url": "http://www.hpe.com/support/subscriber_choice"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c01345499"
      },
      {
        "trust": 0.3,
        "url": "https://www.hpe.com/info/report-security-vulnerability"
      },
      {
        "trust": 0.3,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.3,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.3,
        "url": "https://www.redhat.com/security/data/cve/cve-2014-0050.html"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-4877"
      },
      {
        "trust": 0.2,
        "url": "https://h20392.www2.hpe.com/portal/swdepot/displayproductinfo.do?productnumb"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0033"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-4286"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/264.html"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/shiverino/npe2223"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/jrrdev/cve-2014-0050"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://www.exploit-db.com/exploits/31615/"
      },
      {
        "trust": 0.1,
        "url": "http://tools.cisco.com/security/center/viewalert.x?alertid=32760"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/2130-1/"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-4322"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0075"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0099"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0227"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0050"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0119"
      },
      {
        "trust": 0.1,
        "url": "http://www.mandriva.com/en/support/security/"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0119"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0096"
      },
      {
        "trust": 0.1,
        "url": "http://advisories.mageia.org/mgasa-2014-0149.html"
      },
      {
        "trust": 0.1,
        "url": "http://advisories.mageia.org/mgasa-2014-0268.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0075"
      },
      {
        "trust": 0.1,
        "url": "http://www.mandriva.com/en/support/security/advisories/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-4590"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-4590"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0099"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0096"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0227"
      },
      {
        "trust": 0.1,
        "url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05356363\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5540"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5134"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5550"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-4345"
      },
      {
        "trust": 0.1,
        "url": "http://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05320149\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5553"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5132"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5556"
      },
      {
        "trust": 0.1,
        "url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05356388\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5545"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5554"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5131"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5129"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5539"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5555"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5133"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5546"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5551"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5544"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5127"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5552"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5547"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5548"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5549"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2009-5028"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5130"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5541"
      },
      {
        "trust": 0.1,
        "url": "http://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05376917\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05390722"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5125"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/tomcat7/7.0.30-0ubuntu1.3"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/tomcat7/7.0.42-1ubuntu0.1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/tomcat6/6.0.24-2ubuntu1.15"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/tomcat6/6.0.35-1ubuntu3.4"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/key/#package"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/site/articles/11258"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-0797"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-7547"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-0702"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-2842"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-6420"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-0705"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-0799"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0002"
      },
      {
        "trust": 0.1,
        "url": "https://www.redhat.com/security/data/cve/cve-2013-7285.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0003"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=fuse.mq.enterprise\u0026downloadtype=securitypatches\u0026version=7.1.0"
      },
      {
        "trust": 0.1,
        "url": "https://www.redhat.com/security/data/cve/cve-2014-0002.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-7285"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=fuse.esb.enterprise\u0026downloadtype=securitypatches\u0026version=7.1.0"
      },
      {
        "trust": 0.1,
        "url": "https://rhn.redhat.com/errata/rhsa-2014-0452.html"
      },
      {
        "trust": 0.1,
        "url": "https://www.redhat.com/security/data/cve/cve-2013-6440.html"
      },
      {
        "trust": 0.1,
        "url": "https://www.redhat.com/security/data/cve/cve-2014-0003.html"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-6440"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=webserver\u0026downloadtype=securitypatches\u0026version=2.0.1"
      },
      {
        "trust": 0.1,
        "url": "https://www.redhat.com/security/data/cve/cve-2013-4286.html"
      },
      {
        "trust": 0.1,
        "url": "https://www.redhat.com/security/data/cve/cve-2013-4322.html"
      },
      {
        "trust": 0.1,
        "url": "https://www.redhat.com/security/data/cve/cve-2014-0033.html"
      },
      {
        "trust": 0.1,
        "url": "https://softwaresupport.hpe.com\u003e."
      },
      {
        "trust": 0.1,
        "url": "https://softwaresupport.hpe.com/group/softwaresupport/search-result/-/facets"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0114"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-0763"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-3253"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0107"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-6429"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5652"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2014-0050"
      },
      {
        "db": "BID",
        "id": "65400"
      },
      {
        "db": "PACKETSTORM",
        "id": "131089"
      },
      {
        "db": "PACKETSTORM",
        "id": "141092"
      },
      {
        "db": "PACKETSTORM",
        "id": "125580"
      },
      {
        "db": "PACKETSTORM",
        "id": "125562"
      },
      {
        "db": "PACKETSTORM",
        "id": "140605"
      },
      {
        "db": "PACKETSTORM",
        "id": "126404"
      },
      {
        "db": "PACKETSTORM",
        "id": "126745"
      },
      {
        "db": "PACKETSTORM",
        "id": "139721"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0050"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2014-0050"
      },
      {
        "db": "BID",
        "id": "65400"
      },
      {
        "db": "PACKETSTORM",
        "id": "131089"
      },
      {
        "db": "PACKETSTORM",
        "id": "141092"
      },
      {
        "db": "PACKETSTORM",
        "id": "125580"
      },
      {
        "db": "PACKETSTORM",
        "id": "125562"
      },
      {
        "db": "PACKETSTORM",
        "id": "140605"
      },
      {
        "db": "PACKETSTORM",
        "id": "126404"
      },
      {
        "db": "PACKETSTORM",
        "id": "126745"
      },
      {
        "db": "PACKETSTORM",
        "id": "139721"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0050"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-04-01T00:00:00",
        "db": "VULMON",
        "id": "CVE-2014-0050"
      },
      {
        "date": "2014-02-06T00:00:00",
        "db": "BID",
        "id": "65400"
      },
      {
        "date": "2015-03-30T21:20:12",
        "db": "PACKETSTORM",
        "id": "131089"
      },
      {
        "date": "2017-02-15T00:39:05",
        "db": "PACKETSTORM",
        "id": "141092"
      },
      {
        "date": "2014-03-06T21:44:49",
        "db": "PACKETSTORM",
        "id": "125580"
      },
      {
        "date": "2014-03-06T02:48:19",
        "db": "PACKETSTORM",
        "id": "125562"
      },
      {
        "date": "2017-01-19T13:56:50",
        "db": "PACKETSTORM",
        "id": "140605"
      },
      {
        "date": "2014-05-01T02:11:10",
        "db": "PACKETSTORM",
        "id": "126404"
      },
      {
        "date": "2014-05-22T01:42:58",
        "db": "PACKETSTORM",
        "id": "126745"
      },
      {
        "date": "2016-11-15T00:42:48",
        "db": "PACKETSTORM",
        "id": "139721"
      },
      {
        "date": "2014-04-01T06:27:51.373000",
        "db": "NVD",
        "id": "CVE-2014-0050"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-11-07T00:00:00",
        "db": "VULMON",
        "id": "CVE-2014-0050"
      },
      {
        "date": "2018-07-12T06:00:00",
        "db": "BID",
        "id": "65400"
      },
      {
        "date": "2023-11-07T02:18:06.260000",
        "db": "NVD",
        "id": "CVE-2014-0050"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "141092"
      },
      {
        "db": "PACKETSTORM",
        "id": "125580"
      },
      {
        "db": "PACKETSTORM",
        "id": "125562"
      },
      {
        "db": "PACKETSTORM",
        "id": "126745"
      }
    ],
    "trust": 0.4
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Apache Commons FileUpload CVE-2014-0050 Denial Of Service Vulnerability",
    "sources": [
      {
        "db": "BID",
        "id": "65400"
      }
    ],
    "trust": 0.3
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Failure to Handle Exceptional Conditions",
    "sources": [
      {
        "db": "BID",
        "id": "65400"
      }
    ],
    "trust": 0.3
  }
}

{
  "GSD": {
    "alias": "CVE-2014-0050",
    "description": "MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop\u0027s intended exit conditions.",
    "id": "GSD-2014-0050",
    "references": [
      "https://www.suse.com/security/cve/CVE-2014-0050.html",
      "https://www.debian.org/security/2014/dsa-2897",
      "https://www.debian.org/security/2014/dsa-2856",
      "https://access.redhat.com/errata/RHSA-2015:1009",
      "https://access.redhat.com/errata/RHSA-2014:0528",
      "https://access.redhat.com/errata/RHSA-2014:0527",
      "https://access.redhat.com/errata/RHSA-2014:0526",
      "https://access.redhat.com/errata/RHSA-2014:0525",
      "https://access.redhat.com/errata/RHSA-2014:0473",
      "https://access.redhat.com/errata/RHSA-2014:0459",
      "https://access.redhat.com/errata/RHSA-2014:0452",
      "https://access.redhat.com/errata/RHSA-2014:0429",
      "https://access.redhat.com/errata/RHSA-2014:0401",
      "https://access.redhat.com/errata/RHSA-2014:0400",
      "https://access.redhat.com/errata/RHSA-2014:0373",
      "https://access.redhat.com/errata/RHSA-2014:0253",
      "https://access.redhat.com/errata/RHSA-2014:0252",
      "https://advisories.mageia.org/CVE-2014-0050.html",
      "https://alas.aws.amazon.com/cve/html/CVE-2014-0050.html",
      "https://linux.oracle.com/cve/CVE-2014-0050.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2014-0050"
      ],
      "details": "MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop\u0027s intended exit conditions.",
      "id": "GSD-2014-0050",
      "modified": "2023-12-13T01:22:43.848433Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2014-0050",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop\u0027s intended exit conditions."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html",
            "refsource": "MISC",
            "url": "http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html"
          },
          {
            "name": "http://www.vmware.com/security/advisories/VMSA-2014-0008.html",
            "refsource": "CONFIRM",
            "url": "http://www.vmware.com/security/advisories/VMSA-2014-0008.html"
          },
          {
            "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21676656",
            "refsource": "CONFIRM",
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676656"
          },
          {
            "name": "JVN#14876762",
            "refsource": "JVN",
            "url": "http://jvn.jp/en/jp/JVN14876762/index.html"
          },
          {
            "name": "HPSBGN03329",
            "refsource": "HP",
            "url": "http://marc.info/?l=bugtraq\u0026m=143136844732487\u0026w=2"
          },
          {
            "name": "60753",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/60753"
          },
          {
            "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337",
            "refsource": "CONFIRM",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
          },
          {
            "name": "59184",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/59184"
          },
          {
            "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21677691",
            "refsource": "CONFIRM",
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677691"
          },
          {
            "name": "DSA-2856",
            "refsource": "DEBIAN",
            "url": "http://www.debian.org/security/2014/dsa-2856"
          },
          {
            "name": "59039",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/59039"
          },
          {
            "name": "59185",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/59185"
          },
          {
            "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21676401",
            "refsource": "CONFIRM",
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676401"
          },
          {
            "name": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html",
            "refsource": "CONFIRM",
            "url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"
          },
          {
            "name": "58075",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/58075"
          },
          {
            "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21676853",
            "refsource": "CONFIRM",
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676853"
          },
          {
            "name": "59187",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/59187"
          },
          {
            "name": "59041",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/59041"
          },
          {
            "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21676092",
            "refsource": "CONFIRM",
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676092"
          },
          {
            "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21681214",
            "refsource": "CONFIRM",
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681214"
          },
          {
            "name": "http://www.vmware.com/security/advisories/VMSA-2014-0007.html",
            "refsource": "CONFIRM",
            "url": "http://www.vmware.com/security/advisories/VMSA-2014-0007.html"
          },
          {
            "name": "60475",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/60475"
          },
          {
            "name": "http://svn.apache.org/r1565143",
            "refsource": "CONFIRM",
            "url": "http://svn.apache.org/r1565143"
          },
          {
            "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html",
            "refsource": "CONFIRM",
            "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html"
          },
          {
            "name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917",
            "refsource": "CONFIRM",
            "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917"
          },
          {
            "name": "http://advisories.mageia.org/MGASA-2014-0110.html",
            "refsource": "CONFIRM",
            "url": "http://advisories.mageia.org/MGASA-2014-0110.html"
          },
          {
            "name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755",
            "refsource": "CONFIRM",
            "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755"
          },
          {
            "name": "http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html",
            "refsource": "MISC",
            "url": "http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html"
          },
          {
            "name": "MDVSA-2015:084",
            "refsource": "MANDRIVA",
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:084"
          },
          {
            "name": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html",
            "refsource": "CONFIRM",
            "url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html"
          },
          {
            "name": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html",
            "refsource": "CONFIRM",
            "url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"
          },
          {
            "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21676410",
            "refsource": "CONFIRM",
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676410"
          },
          {
            "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21676405",
            "refsource": "CONFIRM",
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676405"
          },
          {
            "name": "http://tomcat.apache.org/security-7.html",
            "refsource": "CONFIRM",
            "url": "http://tomcat.apache.org/security-7.html"
          },
          {
            "name": "59492",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/59492"
          },
          {
            "name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"
          },
          {
            "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
            "refsource": "CONFIRM",
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
          },
          {
            "name": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
            "refsource": "CONFIRM",
            "url": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html"
          },
          {
            "name": "59500",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/59500"
          },
          {
            "name": "59183",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/59183"
          },
          {
            "name": "http://tomcat.apache.org/security-8.html",
            "refsource": "CONFIRM",
            "url": "http://tomcat.apache.org/security-8.html"
          },
          {
            "name": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html",
            "refsource": "CONFIRM",
            "url": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html"
          },
          {
            "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21676403",
            "refsource": "CONFIRM",
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676403"
          },
          {
            "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
            "refsource": "CONFIRM",
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
          },
          {
            "name": "RHSA-2014:0252",
            "refsource": "REDHAT",
            "url": "http://rhn.redhat.com/errata/RHSA-2014-0252.html"
          },
          {
            "name": "http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm",
            "refsource": "CONFIRM",
            "url": "http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm"
          },
          {
            "name": "JVNDB-2014-000017",
            "refsource": "JVNDB",
            "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000017"
          },
          {
            "name": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html",
            "refsource": "CONFIRM",
            "url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"
          },
          {
            "name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
            "refsource": "CONFIRM",
            "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722"
          },
          {
            "name": "USN-2130-1",
            "refsource": "UBUNTU",
            "url": "http://www.ubuntu.com/usn/USN-2130-1"
          },
          {
            "name": "65400",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/65400"
          },
          {
            "name": "RHSA-2014:0400",
            "refsource": "REDHAT",
            "url": "http://rhn.redhat.com/errata/RHSA-2014-0400.html"
          },
          {
            "name": "59725",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/59725"
          },
          {
            "name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
            "refsource": "FULLDISC",
            "url": "http://seclists.org/fulldisclosure/2014/Dec/23"
          },
          {
            "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21675432",
            "refsource": "CONFIRM",
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21675432"
          },
          {
            "name": "57915",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/57915"
          },
          {
            "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html",
            "refsource": "CONFIRM",
            "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"
          },
          {
            "name": "59399",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/59399"
          },
          {
            "name": "[commons-dev] 20140206 [SECURITY] CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat DoS",
            "refsource": "MLIST",
            "url": "http://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907@apache.org%3E"
          },
          {
            "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21676091",
            "refsource": "CONFIRM",
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676091"
          },
          {
            "name": "58976",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/58976"
          },
          {
            "name": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html",
            "refsource": "CONFIRM",
            "url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html"
          },
          {
            "name": "RHSA-2014:0253",
            "refsource": "REDHAT",
            "url": "http://rhn.redhat.com/errata/RHSA-2014-0253.html"
          },
          {
            "name": "59232",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/59232"
          },
          {
            "name": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html",
            "refsource": "CONFIRM",
            "url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html"
          },
          {
            "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21677724",
            "refsource": "CONFIRM",
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677724"
          },
          {
            "name": "20140625 NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/532549/100/0/threaded"
          },
          {
            "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21669554",
            "refsource": "CONFIRM",
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21669554"
          },
          {
            "name": "GLSA-202107-39",
            "refsource": "GENTOO",
            "url": "https://security.gentoo.org/glsa/202107-39"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "(,1.3]",
          "affected_versions": "All versions up to 1.3",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "cwe_ids": [
            "CWE-1035",
            "CWE-264",
            "CWE-937"
          ],
          "date": "2018-10-09",
          "description": "`MultipartStream.java` in this package allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted `Content-Type` header that bypasses a loop\u0027s intended exit conditions.",
          "fixed_versions": [
            "1.3.1"
          ],
          "identifier": "CVE-2014-0050",
          "identifiers": [
            "CVE-2014-0050"
          ],
          "not_impacted": "All versions after 1.3",
          "package_slug": "maven/commons-fileupload/commons-fileupload",
          "pubdate": "2014-04-01",
          "solution": "Upgrade to version 1.3.1 or above.",
          "title": "Denial of service",
          "urls": [
            "http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html",
            "http://mail-archives.apache.org/mod_mbox/www-announce/201402.mbox/%3C52F373FC.9030907@apache.org%3E",
            "http://struts.apache.org/docs/s2-020.html",
            "http://svn.apache.org/viewvc?view=revision\u0026revision=1565143",
            "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0050"
          ],
          "uuid": "02c8e4a6-5011-4155-81b0-5d6cb384d2cb"
        },
        {
          "affected_range": "[7-alpha0,7.0.51],[8-alpha0,8.0.1]",
          "affected_versions": "All versions starting from 7-alpha0 up to 7.0.51, all versions starting from 8-alpha0 up to 8.0.1",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "cwe_ids": [
            "CWE-1035",
            "CWE-264",
            "CWE-937"
          ],
          "date": "2018-10-09",
          "description": "`MultipartStream.java` in this package allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted `Content-Type` header that bypasses a loop\u0027s intended exit conditions.",
          "fixed_versions": [
            "7.0.52",
            "8.0.3"
          ],
          "identifier": "CVE-2014-0050",
          "identifiers": [
            "CVE-2014-0050"
          ],
          "not_impacted": "All versions before 7-alpha0, all versions after 7.0.51 before 8-alpha0, all versions after 8.0.1",
          "package_slug": "maven/org.apache.tomcat/tomcat-coyote",
          "pubdate": "2014-04-01",
          "solution": "Upgrade to versions 7.0.52, 8.0.3 or above.",
          "title": "Denial of service",
          "urls": [
            "http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html",
            "http://mail-archives.apache.org/mod_mbox/www-announce/201402.mbox/%3C52F373FC.9030907@apache.org%3E",
            "http://struts.apache.org/docs/s2-020.html",
            "http://svn.apache.org/viewvc?view=revision\u0026revision=1565143",
            "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0050"
          ],
          "uuid": "8b5fe350-b441-4fa0-90e2-bec15daf05f1"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_applications:12.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_applications:12.0in:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_applications:13.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_applications:13.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_applications:13.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_applications:14.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_applications:13.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:retail_applications:13.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:commons_fileupload:1.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:commons_fileupload:1.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:commons_fileupload:1.2.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:commons_fileupload:1.2.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:commons_fileupload:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.3",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:commons_fileupload:1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:commons_fileupload:1.1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2014-0050"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop\u0027s intended exit conditions."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-264"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "JVN#14876762",
              "refsource": "JVN",
              "tags": [],
              "url": "http://jvn.jp/en/jp/JVN14876762/index.html"
            },
            {
              "name": "http://tomcat.apache.org/security-8.html",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://tomcat.apache.org/security-8.html"
            },
            {
              "name": "[commons-dev] 20140206 [SECURITY] CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat DoS",
              "refsource": "MLIST",
              "tags": [],
              "url": "http://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907@apache.org%3E"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
            },
            {
              "name": "JVNDB-2014-000017",
              "refsource": "JVNDB",
              "tags": [],
              "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000017"
            },
            {
              "name": "http://svn.apache.org/r1565143",
              "refsource": "CONFIRM",
              "tags": [
                "Patch"
              ],
              "url": "http://svn.apache.org/r1565143"
            },
            {
              "name": "http://tomcat.apache.org/security-7.html",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://tomcat.apache.org/security-7.html"
            },
            {
              "name": "http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html",
              "refsource": "MISC",
              "tags": [
                "Exploit"
              ],
              "url": "http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html"
            },
            {
              "name": "RHSA-2014:0400",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://rhn.redhat.com/errata/RHSA-2014-0400.html"
            },
            {
              "name": "57915",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/57915"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21676410",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676410"
            },
            {
              "name": "58976",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/58976"
            },
            {
              "name": "59232",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/59232"
            },
            {
              "name": "59183",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/59183"
            },
            {
              "name": "59500",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/59500"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21676401",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676401"
            },
            {
              "name": "58075",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/58075"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21677724",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677724"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21676853",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676853"
            },
            {
              "name": "59187",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/59187"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21675432",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21675432"
            },
            {
              "name": "59041",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/59041"
            },
            {
              "name": "59185",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/59185"
            },
            {
              "name": "59492",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/59492"
            },
            {
              "name": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html"
            },
            {
              "name": "65400",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/65400"
            },
            {
              "name": "59039",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/59039"
            },
            {
              "name": "59725",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/59725"
            },
            {
              "name": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html"
            },
            {
              "name": "59399",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/59399"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21676656",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676656"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21676403",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676403"
            },
            {
              "name": "http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html",
              "refsource": "MISC",
              "tags": [],
              "url": "http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html"
            },
            {
              "name": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html"
            },
            {
              "name": "59184",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/59184"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21676405",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676405"
            },
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2014-0007.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.vmware.com/security/advisories/VMSA-2014-0007.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"
            },
            {
              "name": "http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm"
            },
            {
              "name": "60475",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/60475"
            },
            {
              "name": "60753",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/60753"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21677691",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677691"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21681214",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681214"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"
            },
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"
            },
            {
              "name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
              "refsource": "FULLDISC",
              "tags": [],
              "url": "http://seclists.org/fulldisclosure/2014/Dec/23"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html"
            },
            {
              "name": "MDVSA-2015:084",
              "refsource": "MANDRIVA",
              "tags": [],
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:084"
            },
            {
              "name": "http://advisories.mageia.org/MGASA-2014-0110.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://advisories.mageia.org/MGASA-2014-0110.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21676091",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676091"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21676092",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676092"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21669554",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21669554"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html"
            },
            {
              "name": "HPSBGN03329",
              "refsource": "HP",
              "tags": [],
              "url": "http://marc.info/?l=bugtraq\u0026m=143136844732487\u0026w=2"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
            },
            {
              "name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755"
            },
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2014-0008.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.vmware.com/security/advisories/VMSA-2014-0008.html"
            },
            {
              "name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917"
            },
            {
              "name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
            },
            {
              "name": "USN-2130-1",
              "refsource": "UBUNTU",
              "tags": [],
              "url": "http://www.ubuntu.com/usn/USN-2130-1"
            },
            {
              "name": "DSA-2856",
              "refsource": "DEBIAN",
              "tags": [],
              "url": "http://www.debian.org/security/2014/dsa-2856"
            },
            {
              "name": "RHSA-2014:0253",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://rhn.redhat.com/errata/RHSA-2014-0253.html"
            },
            {
              "name": "RHSA-2014:0252",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://rhn.redhat.com/errata/RHSA-2014-0252.html"
            },
            {
              "name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"
            },
            {
              "name": "20140625 NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/532549/100/0/threaded"
            },
            {
              "name": "GLSA-202107-39",
              "refsource": "GENTOO",
              "tags": [],
              "url": "https://security.gentoo.org/glsa/202107-39"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2021-07-17T08:15Z",
      "publishedDate": "2014-04-01T06:27Z"
    }
  }
}