{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "JBoss Enterprise SOA Platform 5.3.0, which fixes multiple security issues,\nvarious bugs, and adds enhancements, is now available from the Red Hat\nCustomer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "JBoss Enterprise SOA Platform is the next-generation ESB and business\nprocess automation infrastructure.\n\nThis release of JBoss Enterprise SOA Platform 5.3.0 serves as a replacement\nfor JBoss Enterprise SOA Platform 5.2.0. It includes various bug fixes and\nenhancements which are detailed in the JBoss Enterprise SOA Platform 5.3.0\nRelease Notes. The Release Notes will be available shortly from\nhttps://access.redhat.com/knowledge/docs/\n\nThe following security issues are also fixed with this release:\n\nIt was found that the JBoss JNDI service allowed unauthenticated, remote\nwrite access by default. The JNDI and HA-JNDI services, and the\nHAJNDIFactory invoker servlet were all affected. A remote attacker able to\naccess the JNDI service (port 1099), HA-JNDI service (port 1100), or the\nHAJNDIFactory invoker servlet on a JBoss server could use this flaw to add,\ndelete, and modify items in the JNDI tree. This could have various,\napplication-specific impacts. (CVE-2011-4605)\n\nA denial of service flaw was found in the implementation of associative\narrays (hashes) in JRuby. An attacker able to supply a large number of\ninputs to a JRuby application (such as HTTP POST request parameters sent to\na web application) that are used as keys when inserting data into an array\ncould trigger multiple hash function collisions, making array operations\ntake an excessive amount of CPU time. To mitigate this issue, randomization\nhas been added to the hash function to reduce the chance of an attacker\nsuccessfully causing intentional collisions. (CVE-2011-4838)\n\nNote: JBoss Enterprise SOA Platform only provides JRuby as a dependency of\nthe scripting_chain quickstart example application. The CVE-2011-4838 flaw\nis not exposed unless the version of JRuby shipped with that quickstart is\nused by a deployed, custom application.\n\nIt was found that RESTEasy was vulnerable to XML External Entity (XXE)\nattacks. If a remote attacker submitted a request containing an external\nXML entity to a RESTEasy endpoint, the entity would be resolved, allowing\nthe attacker to read files accessible to the user running the application\nserver. This flaw affected DOM (Document Object Model) Document and JAXB\n(Java Architecture for XML Binding) input. The fix for this issue is not\nenabled by default. Refer to the Solution section for details.\n(CVE-2012-0818)\n\nMultiple flaws were found in the Oracle OpenSSO authentication and\nadministration components. A remote attacker could use these flaws to\naffect the integrity and availability of a service that uses Oracle\nOpenSSO. (CVE-2011-3506, CVE-2011-3517, CVE-2012-0079)\n\nNote: JBoss Enterprise SOA Platform only provides Oracle OpenSSO as part of\nthe opensso quickstart example application. The CVE-2011-3506,\nCVE-2011-3517, and CVE-2012-0079 flaws are not exposed unless the opensso\nquickstart example application is deployed, or you have created and\ndeployed a custom application that is packaged with a copy of Oracle\nOpenSSO as provided by the opensso quickstart.\n\nThe opensso quickstart has been removed in this release to address these\nflaws. Users interested in continuing to receive updates for their custom\napplications using Oracle OpenSSO are advised to contact Oracle as Red Hat\nis no longer supporting OpenSSO.\n\nWhen a JGroups channel is started, the JGroups diagnostics service would be\nenabled by default with no authentication. This service is exposed via IP\nmulticast. An attacker on an adjacent network could exploit this flaw to\nread diagnostics information. (CVE-2012-2377)\n\nRed Hat would like to thank Christian Schlüter (VIADA) for reporting\nCVE-2011-4605, and oCERT for reporting CVE-2011-4838. oCERT\nacknowledges Julian Wälde and Alexander Klink as the original reporters of\nCVE-2011-4838.\n\nWarning: Before installing version 5.3.0, back up your existing JBoss\nEnterprise SOA Platform installation (including its databases,\napplications, configuration files, and so on).",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2012:1125",
            url: "https://access.redhat.com/errata/RHSA-2012:1125",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=soaplatform&downloadType=distributions",
            url: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=soaplatform&downloadType=distributions",
         },
         {
            category: "external",
            summary: "http://www.oracle.com/technetwork/topics/security/cpuoct2011-330135.html",
            url: "http://www.oracle.com/technetwork/topics/security/cpuoct2011-330135.html",
         },
         {
            category: "external",
            summary: "http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html",
            url: "http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html",
         },
         {
            category: "external",
            summary: "785631",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=785631",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/knowledge/docs/",
            url: "https://access.redhat.com/knowledge/docs/",
         },
         {
            category: "external",
            summary: "749078",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=749078",
         },
         {
            category: "external",
            summary: "749079",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=749079",
         },
         {
            category: "external",
            summary: "766469",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=766469",
         },
         {
            category: "external",
            summary: "770820",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=770820",
         },
         {
            category: "external",
            summary: "783898",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=783898",
         },
         {
            category: "external",
            summary: "823392",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=823392",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1125.json",
         },
      ],
      title: "Red Hat Security Advisory: JBoss Enterprise SOA Platform 5.3.0 update",
      tracking: {
         current_release_date: "2025-01-12T19:25:02+00:00",
         generator: {
            date: "2025-01-12T19:25:02+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.6",
            },
         },
         id: "RHSA-2012:1125",
         initial_release_date: "2012-07-31T14:24:00+00:00",
         revision_history: [
            {
               date: "2012-07-31T14:24:00+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2012-07-31T14:32:35+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-01-12T19:25:02+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat JBoss SOA Platform 5.3",
                        product: {
                           name: "Red Hat JBoss SOA Platform 5.3",
                           product_id: "Red Hat JBoss SOA Platform 5.3",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:jboss_soa_platform:5.3",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat JBoss Middleware",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2011-3506",
         discovery_date: "2011-10-18T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "749078",
            },
         ],
         notes: [
            {
               category: "description",
               text: "Unspecified vulnerability in the Oracle OpenSSO component in Oracle Sun Products Suite 7.1 and 8.0 allows remote attackers to affect integrity via unknown vectors related to Authentication.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "OpenSSO: unspecified vulnerability in the authentication component",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Oracle OpenSSO is provided as part of the opensso quickstart example application  shipped with JBoss Enterprise SOA Platform 5. The CVE-2011-3506, CVE-2011-3517, and CVE-2012-0079 flaws are not exposed unless the opensso quickstart example application is deployed, or you have created and deployed a custom application that is packaged with a copy of Oracle OpenSSO as provided by the opensso quickstart.\n\nThe opensso quickstart has been removed in JBoss Enterprise SOA Platform 5.3.0  to address these flaws. Users interested in continuing to receive updates for their custom applications using Oracle OpenSSO are advised to contact Oracle as Red Hat is no longer supporting OpenSSO.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss SOA Platform 5.3",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2011-3506",
            },
            {
               category: "external",
               summary: "RHBZ#749078",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=749078",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2011-3506",
               url: "https://www.cve.org/CVERecord?id=CVE-2011-3506",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2011-3506",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2011-3506",
            },
            {
               category: "external",
               summary: "http://www.oracle.com/technetwork/topics/security/cpuoct2011-330135.html",
               url: "http://www.oracle.com/technetwork/topics/security/cpuoct2011-330135.html",
            },
         ],
         release_date: "2011-10-18T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2012-07-31T14:24:00+00:00",
               details: "All users of JBoss Enterprise SOA Platform 5.2.0 as provided from the Red\nHat Customer Portal are advised to upgrade to JBoss Enterprise SOA Platform\n5.3.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the new version). Before installing version 5.3.0, back\nup your existing JBoss Enterprise SOA Platform installation (including its\ndatabases, applications, configuration files, and so on).\n\nThe fix for CVE-2012-0818 is not enabled by default. This update adds a new\nconfiguration option to disable entity expansion in RESTEasy. If\napplications on your server expose RESTEasy XML endpoints, a\nresteasy.document.expand.entity.references configuration snippet must be\nadded to their web.xml file to disable entity expansion in RESTEasy. Refer\nto Red Hat Bugzilla bug 785631 for details.",
               product_ids: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2012:1125",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "HIGH",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 2.6,
                  confidentialityImpact: "NONE",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:H/Au:N/C:N/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "OpenSSO: unspecified vulnerability in the authentication component",
      },
      {
         cve: "CVE-2011-3517",
         discovery_date: "2011-10-18T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "749079",
            },
         ],
         notes: [
            {
               category: "description",
               text: "Unspecified vulnerability in the Oracle OpenSSO component in Oracle Sun Products Suite 8.0 allows remote attackers to affect availability via unknown vectors related to Authentication.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "OpenSSO: unspecified vulnerability in the authentication component",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Oracle OpenSSO is provided as part of the opensso quickstart example application  shipped with JBoss Enterprise SOA Platform 5. The CVE-2011-3506, CVE-2011-3517, and CVE-2012-0079 flaws are not exposed unless the opensso quickstart example application is deployed, or you have created and deployed a custom application that is packaged with a copy of Oracle OpenSSO as provided by the opensso quickstart.\n\nThe opensso quickstart has been removed in JBoss Enterprise SOA Platform 5.3.0  to address these flaws. Users interested in continuing to receive updates for their custom applications using Oracle OpenSSO are advised to contact Oracle as Red Hat is no longer supporting OpenSSO.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss SOA Platform 5.3",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2011-3517",
            },
            {
               category: "external",
               summary: "RHBZ#749079",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=749079",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2011-3517",
               url: "https://www.cve.org/CVERecord?id=CVE-2011-3517",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2011-3517",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2011-3517",
            },
            {
               category: "external",
               summary: "http://www.oracle.com/technetwork/topics/security/cpuoct2011-330135.html",
               url: "http://www.oracle.com/technetwork/topics/security/cpuoct2011-330135.html",
            },
         ],
         release_date: "2011-10-18T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2012-07-31T14:24:00+00:00",
               details: "All users of JBoss Enterprise SOA Platform 5.2.0 as provided from the Red\nHat Customer Portal are advised to upgrade to JBoss Enterprise SOA Platform\n5.3.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the new version). Before installing version 5.3.0, back\nup your existing JBoss Enterprise SOA Platform installation (including its\ndatabases, applications, configuration files, and so on).\n\nThe fix for CVE-2012-0818 is not enabled by default. This update adds a new\nconfiguration option to disable entity expansion in RESTEasy. If\napplications on your server expose RESTEasy XML endpoints, a\nresteasy.document.expand.entity.references configuration snippet must be\nadded to their web.xml file to disable entity expansion in RESTEasy. Refer\nto Red Hat Bugzilla bug 785631 for details.",
               product_ids: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2012:1125",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "PARTIAL",
                  baseScore: 4.3,
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "OpenSSO: unspecified vulnerability in the authentication component",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Christian Schlüter",
               ],
               organization: "VIADA",
            },
         ],
         cve: "CVE-2011-4605",
         cwe: {
            id: "CWE-306",
            name: "Missing Authentication for Critical Function",
         },
         discovery_date: "2011-12-07T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "766469",
            },
         ],
         notes: [
            {
               category: "description",
               text: "The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly restrict write access, which allows remote attackers to add, delete, or modify items in a JNDI tree via unspecified vectors.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "JNDI: unauthenticated remote write access is permitted by default",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss SOA Platform 5.3",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2011-4605",
            },
            {
               category: "external",
               summary: "RHBZ#766469",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=766469",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2011-4605",
               url: "https://www.cve.org/CVERecord?id=CVE-2011-4605",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2011-4605",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2011-4605",
            },
         ],
         release_date: "2012-06-20T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2012-07-31T14:24:00+00:00",
               details: "All users of JBoss Enterprise SOA Platform 5.2.0 as provided from the Red\nHat Customer Portal are advised to upgrade to JBoss Enterprise SOA Platform\n5.3.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the new version). Before installing version 5.3.0, back\nup your existing JBoss Enterprise SOA Platform installation (including its\ndatabases, applications, configuration files, and so on).\n\nThe fix for CVE-2012-0818 is not enabled by default. This update adds a new\nconfiguration option to disable entity expansion in RESTEasy. If\napplications on your server expose RESTEasy XML endpoints, a\nresteasy.document.expand.entity.references configuration snippet must be\nadded to their web.xml file to disable entity expansion in RESTEasy. Refer\nto Red Hat Bugzilla bug 785631 for details.",
               product_ids: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2012:1125",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "PARTIAL",
                  baseScore: 7.5,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "JNDI: unauthenticated remote write access is permitted by default",
      },
      {
         acknowledgments: [
            {
               names: [
                  "oCERT",
               ],
            },
         ],
         cve: "CVE-2011-4838",
         discovery_date: "2011-11-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "770820",
            },
         ],
         notes: [
            {
               category: "description",
               text: "JRuby before 1.6.5.1 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jruby: hash table collisions DoS (oCERT-2011-003)",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss SOA Platform 5.3",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2011-4838",
            },
            {
               category: "external",
               summary: "RHBZ#770820",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=770820",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2011-4838",
               url: "https://www.cve.org/CVERecord?id=CVE-2011-4838",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2011-4838",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2011-4838",
            },
         ],
         release_date: "2011-12-28T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2012-07-31T14:24:00+00:00",
               details: "All users of JBoss Enterprise SOA Platform 5.2.0 as provided from the Red\nHat Customer Portal are advised to upgrade to JBoss Enterprise SOA Platform\n5.3.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the new version). Before installing version 5.3.0, back\nup your existing JBoss Enterprise SOA Platform installation (including its\ndatabases, applications, configuration files, and so on).\n\nThe fix for CVE-2012-0818 is not enabled by default. This update adds a new\nconfiguration option to disable entity expansion in RESTEasy. If\napplications on your server expose RESTEasy XML endpoints, a\nresteasy.document.expand.entity.references configuration snippet must be\nadded to their web.xml file to disable entity expansion in RESTEasy. Refer\nto Red Hat Bugzilla bug 785631 for details.",
               product_ids: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2012:1125",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "PARTIAL",
                  baseScore: 5,
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jruby: hash table collisions DoS (oCERT-2011-003)",
      },
      {
         cve: "CVE-2011-5245",
         cwe: {
            id: "CWE-611",
            name: "Improper Restriction of XML External Entity Reference",
         },
         discovery_date: "2012-01-24T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "785631",
            },
         ],
         notes: [
            {
               category: "description",
               text: "The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "RESTEasy: XML eXternal Entity (XXE) flaw",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss SOA Platform 5.3",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2011-5245",
            },
            {
               category: "external",
               summary: "RHBZ#785631",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=785631",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2011-5245",
               url: "https://www.cve.org/CVERecord?id=CVE-2011-5245",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2011-5245",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2011-5245",
            },
         ],
         release_date: "2011-12-30T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2012-07-31T14:24:00+00:00",
               details: "All users of JBoss Enterprise SOA Platform 5.2.0 as provided from the Red\nHat Customer Portal are advised to upgrade to JBoss Enterprise SOA Platform\n5.3.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the new version). Before installing version 5.3.0, back\nup your existing JBoss Enterprise SOA Platform installation (including its\ndatabases, applications, configuration files, and so on).\n\nThe fix for CVE-2012-0818 is not enabled by default. This update adds a new\nconfiguration option to disable entity expansion in RESTEasy. If\napplications on your server expose RESTEasy XML endpoints, a\nresteasy.document.expand.entity.references configuration snippet must be\nadded to their web.xml file to disable entity expansion in RESTEasy. Refer\nto Red Hat Bugzilla bug 785631 for details.",
               product_ids: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2012:1125",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "RESTEasy: XML eXternal Entity (XXE) flaw",
      },
      {
         cve: "CVE-2012-0079",
         discovery_date: "2012-01-18T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "783898",
            },
         ],
         notes: [
            {
               category: "description",
               text: "Unspecified vulnerability in Oracle OpenSSO 7.1 and 8.0 allows remote attackers to affect integrity via unknown vectors related to Administration.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "OpenSSO: Unspecified vulnerability allows remote attackers to affect integrity via unknown vectors",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Oracle OpenSSO is provided as part of the opensso quickstart example application shipped with JBoss Enterprise SOA Platform 5. The CVE-2011-3506, CVE-2011-3517, and CVE-2012-0079 flaws are not exposed unless the opensso quickstart example application is deployed, or you have created and deployed a custom application that is packaged with a copy of Oracle OpenSSO as provided by the opensso quickstart.\n\nThe opensso quickstart has been removed in JBoss Enterprise SOA Platform 5.3.0  to address these flaws. Users interested in continuing to receive updates for their custom applications using Oracle OpenSSO are advised to contact Oracle as Red Hat is no longer supporting OpenSSO.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss SOA Platform 5.3",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2012-0079",
            },
            {
               category: "external",
               summary: "RHBZ#783898",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=783898",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2012-0079",
               url: "https://www.cve.org/CVERecord?id=CVE-2012-0079",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2012-0079",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2012-0079",
            },
         ],
         release_date: "2012-01-18T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2012-07-31T14:24:00+00:00",
               details: "All users of JBoss Enterprise SOA Platform 5.2.0 as provided from the Red\nHat Customer Portal are advised to upgrade to JBoss Enterprise SOA Platform\n5.3.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the new version). Before installing version 5.3.0, back\nup your existing JBoss Enterprise SOA Platform installation (including its\ndatabases, applications, configuration files, and so on).\n\nThe fix for CVE-2012-0818 is not enabled by default. This update adds a new\nconfiguration option to disable entity expansion in RESTEasy. If\napplications on your server expose RESTEasy XML endpoints, a\nresteasy.document.expand.entity.references configuration snippet must be\nadded to their web.xml file to disable entity expansion in RESTEasy. Refer\nto Red Hat Bugzilla bug 785631 for details.",
               product_ids: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2012:1125",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "HIGH",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 2.6,
                  confidentialityImpact: "NONE",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:H/Au:N/C:N/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "OpenSSO: Unspecified vulnerability allows remote attackers to affect integrity via unknown vectors",
      },
      {
         cve: "CVE-2012-0818",
         cwe: {
            id: "CWE-611",
            name: "Improper Restriction of XML External Entity Reference",
         },
         discovery_date: "2012-01-24T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "785631",
            },
         ],
         notes: [
            {
               category: "description",
               text: "RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "RESTEasy: XML eXternal Entity (XXE) flaw",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss SOA Platform 5.3",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2012-0818",
            },
            {
               category: "external",
               summary: "RHBZ#785631",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=785631",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2012-0818",
               url: "https://www.cve.org/CVERecord?id=CVE-2012-0818",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2012-0818",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2012-0818",
            },
         ],
         release_date: "2011-12-30T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2012-07-31T14:24:00+00:00",
               details: "All users of JBoss Enterprise SOA Platform 5.2.0 as provided from the Red\nHat Customer Portal are advised to upgrade to JBoss Enterprise SOA Platform\n5.3.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the new version). Before installing version 5.3.0, back\nup your existing JBoss Enterprise SOA Platform installation (including its\ndatabases, applications, configuration files, and so on).\n\nThe fix for CVE-2012-0818 is not enabled by default. This update adds a new\nconfiguration option to disable entity expansion in RESTEasy. If\napplications on your server expose RESTEasy XML endpoints, a\nresteasy.document.expand.entity.references configuration snippet must be\nadded to their web.xml file to disable entity expansion in RESTEasy. Refer\nto Red Hat Bugzilla bug 785631 for details.",
               product_ids: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2012:1125",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "RESTEasy: XML eXternal Entity (XXE) flaw",
      },
      {
         cve: "CVE-2012-1167",
         discovery_date: "2012-03-13T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "802622",
            },
         ],
         notes: [
            {
               category: "description",
               text: "The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm, does not properly check the permissions created by the WebPermissionMapping class, which allows remote authenticated users to access arbitrary applications.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "JBoss: authentication bypass when running under JACC with ignoreBaseDecision on JBossWebRealm",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss SOA Platform 5.3",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2012-1167",
            },
            {
               category: "external",
               summary: "RHBZ#802622",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=802622",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2012-1167",
               url: "https://www.cve.org/CVERecord?id=CVE-2012-1167",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2012-1167",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2012-1167",
            },
         ],
         release_date: "2012-06-12T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2012-07-31T14:24:00+00:00",
               details: "All users of JBoss Enterprise SOA Platform 5.2.0 as provided from the Red\nHat Customer Portal are advised to upgrade to JBoss Enterprise SOA Platform\n5.3.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the new version). Before installing version 5.3.0, back\nup your existing JBoss Enterprise SOA Platform installation (including its\ndatabases, applications, configuration files, and so on).\n\nThe fix for CVE-2012-0818 is not enabled by default. This update adds a new\nconfiguration option to disable entity expansion in RESTEasy. If\napplications on your server expose RESTEasy XML endpoints, a\nresteasy.document.expand.entity.references configuration snippet must be\nadded to their web.xml file to disable entity expansion in RESTEasy. Refer\nto Red Hat Bugzilla bug 785631 for details.",
               product_ids: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2012:1125",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "HIGH",
                  accessVector: "NETWORK",
                  authentication: "SINGLE",
                  availabilityImpact: "PARTIAL",
                  baseScore: 4.6,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:H/Au:S/C:P/I:P/A:P",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "JBoss: authentication bypass when running under JACC with ignoreBaseDecision on JBossWebRealm",
      },
      {
         acknowledgments: [
            {
               summary: "This issue was discovered by Red Hat.",
            },
         ],
         cve: "CVE-2012-2377",
         discovery_date: "2012-05-17T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "823392",
            },
         ],
         notes: [
            {
               category: "description",
               text: "JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups channel, which allows remote attackers in adjacent networks to read diagnostics information via a crafted IP multicast.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "JGroups diagnostics service enabled by default with no authentication when a JGroups channel is started",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss SOA Platform 5.3",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2012-2377",
            },
            {
               category: "external",
               summary: "RHBZ#823392",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=823392",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2012-2377",
               url: "https://www.cve.org/CVERecord?id=CVE-2012-2377",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2012-2377",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2012-2377",
            },
         ],
         release_date: "2012-06-12T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2012-07-31T14:24:00+00:00",
               details: "All users of JBoss Enterprise SOA Platform 5.2.0 as provided from the Red\nHat Customer Portal are advised to upgrade to JBoss Enterprise SOA Platform\n5.3.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the new version). Before installing version 5.3.0, back\nup your existing JBoss Enterprise SOA Platform installation (including its\ndatabases, applications, configuration files, and so on).\n\nThe fix for CVE-2012-0818 is not enabled by default. This update adds a new\nconfiguration option to disable entity expansion in RESTEasy. If\napplications on your server expose RESTEasy XML endpoints, a\nresteasy.document.expand.entity.references configuration snippet must be\nadded to their web.xml file to disable entity expansion in RESTEasy. Refer\nto Red Hat Bugzilla bug 785631 for details.",
               product_ids: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2012:1125",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "ADJACENT_NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:A/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "JGroups diagnostics service enabled by default with no authentication when a JGroups channel is started",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Updated rhevm packages that fix one security issue and various bugs are now\navailable.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat Enterprise Virtualization Manager is a visual tool for centrally\nmanaging collections of virtual machines running Red Hat Enterprise Linux\nand Microsoft Windows. These packages also include the Red Hat Enterprise\nVirtualization Manager REST (Representational State Transfer) API, a set of\nscriptable commands that give administrators the ability to perform queries\nand operations on Red Hat Enterprise Virtualization Manager.\n\nIt was found that RESTEasy was vulnerable to XML External Entity (XXE)\nattacks. If a remote attacker who is able to access the Red Hat Enterprise\nVirtualization Manager REST API submitted a request containing an external\nXML entity to a RESTEasy endpoint, the entity would be resolved, allowing\nthe attacker to read files accessible to the user running the application\nserver. This flaw affected DOM (Document Object Model) Document and JAXB\n(Java Architecture for XML Binding) input. (CVE-2012-0818)\n\nThis update also fixes the following bugs:\n\n* Previously the REST API was ignoring the \"Accept\" header. This made it\nimpossible to retrieve detailed information about specific sub-collections,\nincluding hosts and disks. The REST API has been updated and now processes\nthe \"Accept\" header as originally intended. (BZ#771369)\n\n* The \"start_time\" Virtual Machine property was previously always set. This\nmeant that even Virtual Machines that were stopped, had a value for\n\"start_time\". An update has been made to ensure that the \"start_time\"\nproperty is only set when the Virtual Machine has been started, and is\nrunning. (BZ#772975)\n\n* The 'rhevm-setup' script previously only ran successfully on systems with\ntheir locale set to 'en_US.UTF-8', 'en_US.utf-8', or 'en_US.utf8'. The\nscript has since been updated to also run successfully in additional\nlocales, including 'ja_JP.UTF-8'. (BZ#784860)\n\n* The REST API did not previously validate that all required parameters\nwere provided when enabling power management. The response code returned\nwould also incorrectly indicate the operation had succeeded where\nmandatory parameters were not supplied. An update has been made to ensure\nthat the power management parameters are validated correctly. (BZ#785744)\n\n* Previously no warning or error was issued when the amount of free disk\nspace on a host was low. When no free disk space remained on the host it\nwould become non-responsive with no prior warning. An update has been made\nto report a warning in the audit log when a host's free disk space is less\nthan 1000 MB, and an error when a host's free disk space is less than 500\nMB. (BZ#786132)\n\n* When importing Virtual Machines no notification was provided if the MAC\naddress of the network interface card clashed with that of an existing\nVirtual Machine. Now when this occurs a message is printed to the audit\nlog, highlighting the need for manual intervention. (BZ#795416)\n\n* Previously it was not possible to set more, or less, than one value for\nSpiceSecureChannels using the rhevm-config tool. This meant it was not\npossible to encrypt all SPICE channels. The rhevm-config tool has been\nupdated and it is now possible to encrypt all SPICE channels, by adding\nthem to the SpiceSecureChannels configuration key. (BZ#784012)\n\nAll Red Hat Enterprise Virtualization users are advised to upgrade to these\nupdated packages, which address this vulnerability and fix these bugs.\nRefer to the Solution section for information about installing this update.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2012:0421",
            url: "https://access.redhat.com/errata/RHSA-2012:0421",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#moderate",
            url: "https://access.redhat.com/security/updates/classification/#moderate",
         },
         {
            category: "external",
            summary: "http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Virtualization/3.0/html/Installation_Guide/chap-Installation_Guide-Installing_the_RHEV_Manager-Upgrades.html",
            url: "http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Virtualization/3.0/html/Installation_Guide/chap-Installation_Guide-Installing_the_RHEV_Manager-Upgrades.html",
         },
         {
            category: "external",
            summary: "785631",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=785631",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0421.json",
         },
      ],
      title: "Red Hat Security Advisory: rhevm security and bug fix update",
      tracking: {
         current_release_date: "2025-01-12T19:24:30+00:00",
         generator: {
            date: "2025-01-12T19:24:30+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.6",
            },
         },
         id: "RHSA-2012:0421",
         initial_release_date: "2012-03-26T15:16:00+00:00",
         revision_history: [
            {
               date: "2012-03-26T15:16:00+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2012-03-26T15:17:18+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-01-12T19:24:30+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "RHEV-M for Servers",
                        product: {
                           name: "RHEV-M for Servers",
                           product_id: "6Server-RHEV-S",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:rhev_manager:3",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Virtualization",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64",
                        product: {
                           name: "rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64",
                           product_id: "rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rhevm-notification-service@3.0.3_0001-3.el6?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64",
                        product: {
                           name: "rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64",
                           product_id: "rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rhevm-log-collector@3.0.3_0001-3.el6?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64",
                        product: {
                           name: "rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64",
                           product_id: "rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rhevm-iso-uploader@3.0.3_0001-3.el6?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64",
                        product: {
                           name: "rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64",
                           product_id: "rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rhevm-genericapi@3.0.3_0001-3.el6?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rhevm-restapi-0:3.0.3_0001-3.el6.x86_64",
                        product: {
                           name: "rhevm-restapi-0:3.0.3_0001-3.el6.x86_64",
                           product_id: "rhevm-restapi-0:3.0.3_0001-3.el6.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rhevm-restapi@3.0.3_0001-3.el6?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64",
                        product: {
                           name: "rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64",
                           product_id: "rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rhevm-debuginfo@3.0.3_0001-3.el6?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64",
                        product: {
                           name: "rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64",
                           product_id: "rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rhevm-jboss-deps@3.0.3_0001-3.el6?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64",
                        product: {
                           name: "rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64",
                           product_id: "rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rhevm-webadmin-portal@3.0.3_0001-3.el6?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rhevm-backend-0:3.0.3_0001-3.el6.x86_64",
                        product: {
                           name: "rhevm-backend-0:3.0.3_0001-3.el6.x86_64",
                           product_id: "rhevm-backend-0:3.0.3_0001-3.el6.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rhevm-backend@3.0.3_0001-3.el6?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64",
                        product: {
                           name: "rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64",
                           product_id: "rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rhevm-dbscripts@3.0.3_0001-3.el6?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rhevm-setup-0:3.0.3_0001-3.el6.x86_64",
                        product: {
                           name: "rhevm-setup-0:3.0.3_0001-3.el6.x86_64",
                           product_id: "rhevm-setup-0:3.0.3_0001-3.el6.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rhevm-setup@3.0.3_0001-3.el6?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rhevm-0:3.0.3_0001-3.el6.x86_64",
                        product: {
                           name: "rhevm-0:3.0.3_0001-3.el6.x86_64",
                           product_id: "rhevm-0:3.0.3_0001-3.el6.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rhevm@3.0.3_0001-3.el6?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rhevm-config-0:3.0.3_0001-3.el6.x86_64",
                        product: {
                           name: "rhevm-config-0:3.0.3_0001-3.el6.x86_64",
                           product_id: "rhevm-config-0:3.0.3_0001-3.el6.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rhevm-config@3.0.3_0001-3.el6?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rhevm-userportal-0:3.0.3_0001-3.el6.x86_64",
                        product: {
                           name: "rhevm-userportal-0:3.0.3_0001-3.el6.x86_64",
                           product_id: "rhevm-userportal-0:3.0.3_0001-3.el6.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rhevm-userportal@3.0.3_0001-3.el6?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64",
                        product: {
                           name: "rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64",
                           product_id: "rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rhevm-tools-common@3.0.3_0001-3.el6?arch=x86_64",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "rhevm-0:3.0.3_0001-3.el6.src",
                        product: {
                           name: "rhevm-0:3.0.3_0001-3.el6.src",
                           product_id: "rhevm-0:3.0.3_0001-3.el6.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rhevm@3.0.3_0001-3.el6?arch=src",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "src",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhevm-0:3.0.3_0001-3.el6.src as a component of RHEV-M for Servers",
               product_id: "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.src",
            },
            product_reference: "rhevm-0:3.0.3_0001-3.el6.src",
            relates_to_product_reference: "6Server-RHEV-S",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhevm-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
               product_id: "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.x86_64",
            },
            product_reference: "rhevm-0:3.0.3_0001-3.el6.x86_64",
            relates_to_product_reference: "6Server-RHEV-S",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhevm-backend-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
               product_id: "6Server-RHEV-S:rhevm-backend-0:3.0.3_0001-3.el6.x86_64",
            },
            product_reference: "rhevm-backend-0:3.0.3_0001-3.el6.x86_64",
            relates_to_product_reference: "6Server-RHEV-S",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhevm-config-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
               product_id: "6Server-RHEV-S:rhevm-config-0:3.0.3_0001-3.el6.x86_64",
            },
            product_reference: "rhevm-config-0:3.0.3_0001-3.el6.x86_64",
            relates_to_product_reference: "6Server-RHEV-S",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
               product_id: "6Server-RHEV-S:rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64",
            },
            product_reference: "rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64",
            relates_to_product_reference: "6Server-RHEV-S",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
               product_id: "6Server-RHEV-S:rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64",
            },
            product_reference: "rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64",
            relates_to_product_reference: "6Server-RHEV-S",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
               product_id: "6Server-RHEV-S:rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64",
            },
            product_reference: "rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64",
            relates_to_product_reference: "6Server-RHEV-S",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
               product_id: "6Server-RHEV-S:rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64",
            },
            product_reference: "rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64",
            relates_to_product_reference: "6Server-RHEV-S",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
               product_id: "6Server-RHEV-S:rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64",
            },
            product_reference: "rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64",
            relates_to_product_reference: "6Server-RHEV-S",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
               product_id: "6Server-RHEV-S:rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64",
            },
            product_reference: "rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64",
            relates_to_product_reference: "6Server-RHEV-S",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
               product_id: "6Server-RHEV-S:rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64",
            },
            product_reference: "rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64",
            relates_to_product_reference: "6Server-RHEV-S",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhevm-restapi-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
               product_id: "6Server-RHEV-S:rhevm-restapi-0:3.0.3_0001-3.el6.x86_64",
            },
            product_reference: "rhevm-restapi-0:3.0.3_0001-3.el6.x86_64",
            relates_to_product_reference: "6Server-RHEV-S",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhevm-setup-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
               product_id: "6Server-RHEV-S:rhevm-setup-0:3.0.3_0001-3.el6.x86_64",
            },
            product_reference: "rhevm-setup-0:3.0.3_0001-3.el6.x86_64",
            relates_to_product_reference: "6Server-RHEV-S",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
               product_id: "6Server-RHEV-S:rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64",
            },
            product_reference: "rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64",
            relates_to_product_reference: "6Server-RHEV-S",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhevm-userportal-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
               product_id: "6Server-RHEV-S:rhevm-userportal-0:3.0.3_0001-3.el6.x86_64",
            },
            product_reference: "rhevm-userportal-0:3.0.3_0001-3.el6.x86_64",
            relates_to_product_reference: "6Server-RHEV-S",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
               product_id: "6Server-RHEV-S:rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64",
            },
            product_reference: "rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64",
            relates_to_product_reference: "6Server-RHEV-S",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2011-5245",
         cwe: {
            id: "CWE-611",
            name: "Improper Restriction of XML External Entity Reference",
         },
         discovery_date: "2012-01-24T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "785631",
            },
         ],
         notes: [
            {
               category: "description",
               text: "The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "RESTEasy: XML eXternal Entity (XXE) flaw",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.src",
               "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-backend-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-config-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-restapi-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-setup-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-userportal-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2011-5245",
            },
            {
               category: "external",
               summary: "RHBZ#785631",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=785631",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2011-5245",
               url: "https://www.cve.org/CVERecord?id=CVE-2011-5245",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2011-5245",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2011-5245",
            },
         ],
         release_date: "2011-12-30T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2012-03-26T15:16:00+00:00",
               details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Follow the upgrade\nprocedure in the Red Hat Enterprise Virtualization\nInstallation Guide to install these updated packages:\n\nhttp://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Virtualization/3.0/html/Installation_Guide/chap-Installation_Guide-Installing_the_RHEV_Manager-Upgrades.html",
               product_ids: [
                  "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.src",
                  "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-backend-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-config-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-restapi-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-setup-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-userportal-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2012:0421",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.src",
                  "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-backend-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-config-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-restapi-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-setup-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-userportal-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "RESTEasy: XML eXternal Entity (XXE) flaw",
      },
      {
         cve: "CVE-2012-0818",
         cwe: {
            id: "CWE-611",
            name: "Improper Restriction of XML External Entity Reference",
         },
         discovery_date: "2012-01-24T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "785631",
            },
         ],
         notes: [
            {
               category: "description",
               text: "RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "RESTEasy: XML eXternal Entity (XXE) flaw",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.src",
               "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-backend-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-config-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-restapi-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-setup-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-userportal-0:3.0.3_0001-3.el6.x86_64",
               "6Server-RHEV-S:rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2012-0818",
            },
            {
               category: "external",
               summary: "RHBZ#785631",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=785631",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2012-0818",
               url: "https://www.cve.org/CVERecord?id=CVE-2012-0818",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2012-0818",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2012-0818",
            },
         ],
         release_date: "2011-12-30T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2012-03-26T15:16:00+00:00",
               details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Follow the upgrade\nprocedure in the Red Hat Enterprise Virtualization\nInstallation Guide to install these updated packages:\n\nhttp://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Virtualization/3.0/html/Installation_Guide/chap-Installation_Guide-Installing_the_RHEV_Manager-Upgrades.html",
               product_ids: [
                  "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.src",
                  "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-backend-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-config-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-restapi-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-setup-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-userportal-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2012:0421",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.src",
                  "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-backend-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-config-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-restapi-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-setup-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-userportal-0:3.0.3_0001-3.el6.x86_64",
                  "6Server-RHEV-S:rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "RESTEasy: XML eXternal Entity (XXE) flaw",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "JBoss Enterprise Portal Platform 5.2.1, which fixes two security issues\nand various bugs, is now available from the Red Hat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "JBoss Enterprise Portal Platform is the open source implementation of the\nJava EE suite of services and Portal services running atop JBoss Enterprise\nApplication Platform. It comprises a set of offerings for enterprise\ncustomers who are looking for pre-configured profiles of JBoss Enterprise\nMiddleware components that have been tested and certified together to\nprovide an integrated experience.\n\nThis release of JBoss Enterprise Portal Platform 5.2.1 serves as a\nreplacement for JBoss Enterprise Portal Platform 5.2.0, and includes bug\nfixes. Refer to the JBoss Enterprise Portal Platform 5.2.1 Release Notes\nfor information on the most significant of these changes. The Release Notes\nwill be available shortly from\nhttps://docs.redhat.com/docs/en-US/index.html\n\nThe following security issues are also fixed with this release:\n\nIt was found that RESTEasy was vulnerable to XML External Entity (XXE)\nattacks. If a remote attacker submitted a request containing an external\nXML entity to a RESTEasy endpoint, the entity would be resolved, allowing\nthe attacker to read files accessible to the user running the application\nserver. This flaw affected DOM (Document Object Model) Document and JAXB\n(Java Architecture for XML Binding) input. (CVE-2012-0818)\n\nIt was found that the Attribute Exchange (AX) extension of OpenID4Java was\nnot checking to ensure attributes were signed. If AX was being used to\nreceive information that an application only trusts the identity provider\nto assert, a remote attacker could use this flaw to conduct\nman-in-the-middle attacks and compromise the integrity of the information\nvia a specially-crafted request. By default, only the JBoss Seam openid\nexample application uses OpenID4Java. (CVE-2011-4314)\n\nWarning: Before applying this update, back up all applications deployed on\nJBoss Enterprise Portal Platform, along with all customized configuration\nfiles.\n\nAll users of JBoss Enterprise Portal Platform 5.2.0 as provided from the\nRed Hat Customer Portal are advised to upgrade to JBoss Enterprise Portal\nPlatform 5.2.1.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2012:0519",
            url: "https://access.redhat.com/errata/RHSA-2012:0519",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#moderate",
            url: "https://access.redhat.com/security/updates/classification/#moderate",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal&downloadType=distributions",
            url: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal&downloadType=distributions",
         },
         {
            category: "external",
            summary: "https://docs.redhat.com/docs/en-US/index.html",
            url: "https://docs.redhat.com/docs/en-US/index.html",
         },
         {
            category: "external",
            summary: "754386",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=754386",
         },
         {
            category: "external",
            summary: "785631",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=785631",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0519.json",
         },
      ],
      title: "Red Hat Security Advisory: JBoss Enterprise Portal Platform 5.2.1 update",
      tracking: {
         current_release_date: "2025-02-02T19:31:19+00:00",
         generator: {
            date: "2025-02-02T19:31:19+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.6",
            },
         },
         id: "RHSA-2012:0519",
         initial_release_date: "2012-04-25T02:03:00+00:00",
         revision_history: [
            {
               date: "2012-04-25T02:03:00+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2012-04-25T02:10:00+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-02-02T19:31:19+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat JBoss Portal 5.2",
                        product: {
                           name: "Red Hat JBoss Portal 5.2",
                           product_id: "Red Hat JBoss Portal 5.2",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:jboss_enterprise_portal_platform:5.2",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat JBoss Middleware",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2011-4314",
         discovery_date: "2011-11-16T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "754386",
            },
         ],
         notes: [
            {
               category: "description",
               text: "message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "extension): MITM due to improper validation of AX attribute signatures",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss Portal 5.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2011-4314",
            },
            {
               category: "external",
               summary: "RHBZ#754386",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=754386",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2011-4314",
               url: "https://www.cve.org/CVERecord?id=CVE-2011-4314",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2011-4314",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2011-4314",
            },
         ],
         release_date: "2011-05-05T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2012-04-25T02:03:00+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files.",
               product_ids: [
                  "Red Hat JBoss Portal 5.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2012:0519",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  confidentialityImpact: "NONE",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss Portal 5.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "extension): MITM due to improper validation of AX attribute signatures",
      },
      {
         cve: "CVE-2011-5245",
         cwe: {
            id: "CWE-611",
            name: "Improper Restriction of XML External Entity Reference",
         },
         discovery_date: "2012-01-24T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "785631",
            },
         ],
         notes: [
            {
               category: "description",
               text: "The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "RESTEasy: XML eXternal Entity (XXE) flaw",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss Portal 5.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2011-5245",
            },
            {
               category: "external",
               summary: "RHBZ#785631",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=785631",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2011-5245",
               url: "https://www.cve.org/CVERecord?id=CVE-2011-5245",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2011-5245",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2011-5245",
            },
         ],
         release_date: "2011-12-30T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2012-04-25T02:03:00+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files.",
               product_ids: [
                  "Red Hat JBoss Portal 5.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2012:0519",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss Portal 5.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "RESTEasy: XML eXternal Entity (XXE) flaw",
      },
      {
         cve: "CVE-2012-0818",
         cwe: {
            id: "CWE-611",
            name: "Improper Restriction of XML External Entity Reference",
         },
         discovery_date: "2012-01-24T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "785631",
            },
         ],
         notes: [
            {
               category: "description",
               text: "RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "RESTEasy: XML eXternal Entity (XXE) flaw",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss Portal 5.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2012-0818",
            },
            {
               category: "external",
               summary: "RHBZ#785631",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=785631",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2012-0818",
               url: "https://www.cve.org/CVERecord?id=CVE-2012-0818",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2012-0818",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2012-0818",
            },
         ],
         release_date: "2011-12-30T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2012-04-25T02:03:00+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files.",
               product_ids: [
                  "Red Hat JBoss Portal 5.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2012:0519",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss Portal 5.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "RESTEasy: XML eXternal Entity (XXE) flaw",
      },
   ],
}