{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "An update for Red Hat JBoss Enterprise Application Platform 6.2.0, which\nfixes three security issues, several bugs, and adds various enhancements,\nis now available from the Red Hat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat JBoss Enterprise Application Platform 6 is a platform for Java\napplications based on JBoss Application Server 7.\n\nIt was found that the ParserPool and Decrypter classes in the OpenSAML Java\nimplementation resolved external entities, permitting XML External Entity\n(XXE) attacks. A remote attacker could use this flaw to read files\naccessible to the user running the application server, and potentially\nperform other more advanced XXE attacks. (CVE-2013-6440)\n\nIt was discovered that the Apache Santuario XML Security for Java project\nallowed Document Type Definitions (DTDs) to be processed when applying\nTransforms even when secure validation was enabled. A remote attacker could\nuse this flaw to exhaust all available memory on the system, causing a\ndenial of service. (CVE-2013-4517)\n\nIn Red Hat JBoss Enterprise Application Platform, when running under a\nsecurity manager, it was possible for deployed code to get access to the\nModular Service Container (MSC) service registry without any permission\nchecks. This could allow malicious deployments to modify the internal state\nof the server in various ways. (CVE-2014-0018)\n\nThe CVE-2013-6440 was discovered by David Illsley, Ron Gutierrez of Gotham\nDigital Science, and David Jorm of the Red Hat Security Response Team, and\nthe CVE-2014-0018 issue was discovered by Stuart Douglas of Red Hat.\n\nThis release serves as a replacement for JBoss Enterprise Application\nPlatform 6.2.0, and includes bug fixes and enhancements. Documentation for\nthese changes will be available shortly from the JBoss Enterprise\nApplication Platform 6.2.1 Release Notes, linked to in the References.\n\nAll users of Red Hat JBoss Enterprise Application Platform 6.2.0 as\nprovided from the Red Hat Customer Portal are advised to apply this update.\nThe JBoss server process must be restarted for the update to take effect.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2014:0172",
            url: "https://access.redhat.com/errata/RHSA-2014:0172",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#moderate",
            url: "https://access.redhat.com/security/updates/classification/#moderate",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=6.2.0",
            url: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=6.2.0",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/site/documentation/en-US/JBoss_Enterprise_Application_Platform/6.2/html/6.2.1_Release_Notes/index.html",
            url: "https://access.redhat.com/site/documentation/en-US/JBoss_Enterprise_Application_Platform/6.2/html/6.2.1_Release_Notes/index.html",
         },
         {
            category: "external",
            summary: "1043332",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1043332",
         },
         {
            category: "external",
            summary: "1045257",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1045257",
         },
         {
            category: "external",
            summary: "1052783",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1052783",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0172.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 update",
      tracking: {
         current_release_date: "2024-11-22T08:00:34+00:00",
         generator: {
            date: "2024-11-22T08:00:34+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.1",
            },
         },
         id: "RHSA-2014:0172",
         initial_release_date: "2014-02-13T18:33:26+00:00",
         revision_history: [
            {
               date: "2014-02-13T18:33:26+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2019-02-20T12:32:51+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-11-22T08:00:34+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat JBoss Enterprise Application Platform 6.2",
                        product: {
                           name: "Red Hat JBoss Enterprise Application Platform 6.2",
                           product_id: "Red Hat JBoss Enterprise Application Platform 6.2",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:jboss_enterprise_application_platform:6.2.1",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat JBoss Enterprise Application Platform",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2013-4517",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2013-12-20T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1045257",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was discovered that the Apache Santuario XML Security for Java project allowed Document Type Definitions (DTDs) to be processed when applying Transforms even when secure validation was enabled. A remote attacker could use this flaw to exhaust all available memory on the system, causing a denial of service.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Java: Java XML Signature DoS Attack",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Fuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4, Fuse Mediation Router 2.7, 2.8 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nFuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 4;  Red Hat JBoss Enterprise Data Services Platform 5; Red Hat JBoss Enterprise Portal Platform 4 and 5; and Red Hat JBoss Enterprise SOA Platform 4 and 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss Enterprise Application Platform 6.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2013-4517",
            },
            {
               category: "external",
               summary: "RHBZ#1045257",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1045257",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2013-4517",
               url: "https://www.cve.org/CVERecord?id=CVE-2013-4517",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2013-4517",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2013-4517",
            },
         ],
         release_date: "2013-11-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2014-02-13T18:33:26+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting Red Hat JBoss Enterprise Application Platform installation and\ndeployed applications.\n\nFor more details, refer to the JBoss Enterprise Application Platform 6.2.1\nRelease Notes, linked to in the References.",
               product_ids: [
                  "Red Hat JBoss Enterprise Application Platform 6.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2014:0172",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "PARTIAL",
                  baseScore: 5,
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss Enterprise Application Platform 6.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "Java: Java XML Signature DoS Attack",
      },
      {
         acknowledgments: [
            {
               names: [
                  "David Illsley",
               ],
            },
            {
               names: [
                  "Ron Gutierrez",
               ],
               organization: "Gotham Digital Science",
            },
            {
               names: [
                  "David Jorm",
               ],
               organization: "Red Hat Security Response Team",
               summary: "This issue was discovered by Red Hat.",
            },
         ],
         cve: "CVE-2013-6440",
         cwe: {
            id: "CWE-611",
            name: "Improper Restriction of XML External Entity Reference",
         },
         discovery_date: "2013-12-11T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1043332",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that the ParserPool and Decrypter classes in the OpenSAML Java implementation resolved external entities, permitting XML External Entity (XXE) attacks. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Java: XML eXternal Entity (XXE) flaw in ParserPool and Decrypter",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss Enterprise Application Platform 6.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2013-6440",
            },
            {
               category: "external",
               summary: "RHBZ#1043332",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1043332",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2013-6440",
               url: "https://www.cve.org/CVERecord?id=CVE-2013-6440",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2013-6440",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2013-6440",
            },
            {
               category: "external",
               summary: "http://blog.sendsafely.com/post/69590974866/web-based-single-sign-on-and-the-dangers-of-saml-xml",
               url: "http://blog.sendsafely.com/post/69590974866/web-based-single-sign-on-and-the-dangers-of-saml-xml",
            },
         ],
         release_date: "2013-12-11T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2014-02-13T18:33:26+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting Red Hat JBoss Enterprise Application Platform installation and\ndeployed applications.\n\nFor more details, refer to the JBoss Enterprise Application Platform 6.2.1\nRelease Notes, linked to in the References.",
               product_ids: [
                  "Red Hat JBoss Enterprise Application Platform 6.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2014:0172",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss Enterprise Application Platform 6.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "Java: XML eXternal Entity (XXE) flaw in ParserPool and Decrypter",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Stuart Douglas",
               ],
               organization: "Red Hat",
               summary: "This issue was discovered by Red Hat.",
            },
         ],
         cve: "CVE-2014-0018",
         discovery_date: "2014-01-13T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1052783",
            },
         ],
         notes: [
            {
               category: "description",
               text: "In Red Hat JBoss Enterprise Application Platform, when running under a security manager, it was possible for deployed code to get access to the Modular Service Container (MSC) service registry without any permission checks. This could allow malicious deployments to modify the internal state of the server in various ways.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jboss-as-server: Unchecked access to MSC Service Registry under JSM",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss Enterprise Application Platform 6.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-0018",
            },
            {
               category: "external",
               summary: "RHBZ#1052783",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1052783",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-0018",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-0018",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-0018",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-0018",
            },
         ],
         release_date: "2014-01-11T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2014-02-13T18:33:26+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting Red Hat JBoss Enterprise Application Platform installation and\ndeployed applications.\n\nFor more details, refer to the JBoss Enterprise Application Platform 6.2.1\nRelease Notes, linked to in the References.",
               product_ids: [
                  "Red Hat JBoss Enterprise Application Platform 6.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2014:0172",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "LOCAL",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 1.9,
                  confidentialityImpact: "NONE",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:L/AC:M/Au:N/C:N/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss Enterprise Application Platform 6.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "jboss-as-server: Unchecked access to MSC Service Registry under JSM",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Red Hat JBoss SOA Platform 5.3.1 2014 roll up patch 1, which fixes one\nsecurity issue and various bugs, is now available from the Red Hat Customer\nPortal.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat JBoss SOA Platform is the next-generation ESB and business process\nautomation infrastructure. Red Hat JBoss SOA Platform allows IT to leverage\nexisting (MoM and EAI), modern (SOA and BPM-Rules), and future (EDA and\nCEP) integration methodologies to dramatically improve business process\nexecution speed and quality.\n\nThis roll up patch serves as a cumulative upgrade for Red Hat JBoss SOA\nPlatform 5.3.1. It includes various bug fixes. The following security issue\nis also fixed with this release:\n\nIt was discovered that the Apache Santuario XML Security for Java project\nallowed Document Type Definitions (DTDs) to be processed when applying\nTransforms even when secure validation was enabled. A remote attacker could\nuse this flaw to exhaust all available memory on the system, causing a\ndenial of service. (CVE-2013-4517)\n\nAll users of Red Hat JBoss SOA Platform 5.3.1 as provided from the Red Hat\nCustomer Portal are advised to apply this roll up patch.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2014:0582",
            url: "https://access.redhat.com/errata/RHSA-2014:0582",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#moderate",
            url: "https://access.redhat.com/security/updates/classification/#moderate",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=soaplatform&downloadType=securityPatches&version=5.3.1+GA",
            url: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=soaplatform&downloadType=securityPatches&version=5.3.1+GA",
         },
         {
            category: "external",
            summary: "1045257",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1045257",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0582.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat JBoss SOA Platform 5.3.1 update",
      tracking: {
         current_release_date: "2024-11-22T08:01:05+00:00",
         generator: {
            date: "2024-11-22T08:01:05+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.1",
            },
         },
         id: "RHSA-2014:0582",
         initial_release_date: "2014-05-29T20:26:23+00:00",
         revision_history: [
            {
               date: "2014-05-29T20:26:23+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2019-02-20T12:33:08+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-11-22T08:01:05+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat JBoss SOA Platform 5.3",
                        product: {
                           name: "Red Hat JBoss SOA Platform 5.3",
                           product_id: "Red Hat JBoss SOA Platform 5.3",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:jboss_enterprise_soa_platform:5.3",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat JBoss SOA Platform",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2013-4517",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2013-12-20T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1045257",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was discovered that the Apache Santuario XML Security for Java project allowed Document Type Definitions (DTDs) to be processed when applying Transforms even when secure validation was enabled. A remote attacker could use this flaw to exhaust all available memory on the system, causing a denial of service.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Java: Java XML Signature DoS Attack",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Fuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4, Fuse Mediation Router 2.7, 2.8 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nFuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 4;  Red Hat JBoss Enterprise Data Services Platform 5; Red Hat JBoss Enterprise Portal Platform 4 and 5; and Red Hat JBoss Enterprise SOA Platform 4 and 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss SOA Platform 5.3",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2013-4517",
            },
            {
               category: "external",
               summary: "RHBZ#1045257",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1045257",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2013-4517",
               url: "https://www.cve.org/CVERecord?id=CVE-2013-4517",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2013-4517",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2013-4517",
            },
         ],
         release_date: "2013-11-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2014-05-29T20:26:23+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss SOA Platform installation (including its databases,\napplications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss SOA Platform server\nby stopping the JBoss Application Server process before installing this\nupdate, and then after installing the update, restart the Red Hat JBoss SOA\nPlatform server by starting the JBoss Application Server process.",
               product_ids: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2014:0582",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "PARTIAL",
                  baseScore: 5,
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "Java: Java XML Signature DoS Attack",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Red Hat JBoss BPM Suite 6.1.0, which fixes multiple security issues,\nseveral bugs, and adds various enhancements, is now available from the Red\nHat Customer Portal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat JBoss BPM Suite is a business rules and processes management system\nfor the management, storage, creation, modification, and deployment of\nJBoss rules and BPMN2-compliant business processes.\n\nThis release of Red Hat JBoss BPM Suite 6.1.0 serves as a replacement for\nRed Hat JBoss BPM Suite 6.0.3, and includes bug fixes and enhancements.\nRefer to the Red Hat JBoss BPM Suite 6.1.0 Release Notes for information on\nthe most significant of these changes. The Release Notes are available at\nhttps://access.redhat.com/documentation/en-US/Red_Hat_JBoss_BPM_Suite/\n\nThe following security issues are also fixed with this release,\ndescriptions of which can be found on the respective CVE pages linked in\nthe References section.\n\nCVE-2012-6153 Jakarta Commons httpclient / Apache CXF: SSL hostname\nverification bypass, incomplete CVE-2012-5783 fix\n\nCVE-2013-2133 JBoss WS: EJB3 role restrictions are not applied to jaxws\nhandlers\n\nCVE-2013-4517 Apache Santuario XML Security for Java: Java XML Signature\nDoS Attack\n\nCVE-2013-7397 async-http-client: SSL/TLS certificate verification is\ndisabled under certain conditions\n\nCVE-2013-7398 async-http-client: missing hostname verification for SSL\ncertificates\n\nCVE-2014-0034 Apache CXF: The SecurityTokenService accepts certain invalid\nSAML Tokens as valid\n\nCVE-2014-0035 Apache CXF: UsernameTokens are sent in plaintext with a\nSymmetric EncryptBeforeSigning policy\n\nCVE-2014-0059 JBossSX/PicketBox: World readable audit.log file\n\nCVE-2014-0109 Apache CXF: HTML content posted to SOAP endpoint could cause\nOOM errors\n\nCVE-2014-0110 Apache CXF: Large invalid content could cause temporary space\nto fill\n\nCVE-2014-3577 Jakarta Commons httpclient / Apache CXF: SSL hostname\nverification bypass, incomplete CVE-2012-6153 fix\n\nCVE-2014-3623 Apache WSS4J / Apache CXF: Improper security semantics\nenforcement of SAML SubjectConfirmation methods\n\nCVE-2014-7827 JBoss Security: Wrong security context loaded when using\nSAML2 STS Login Module\n\nCVE-2014-7839 RESTeasy: External entities expanded by DocumentProvider\n\nCVE-2014-8122 JBoss Weld: Limited information disclosure via stale thread\nstate\n\nCVE-2014-8125 jBPM: BPMN2 file processing XXE in Process Execution\n\nRed Hat would like to thank Rune Steinseth of JProfessionals for reporting\nthe CVE-2014-8122 issue. The CVE-2012-6153 issue was discovered by Florian\nWeimer of Red Hat Product Security; the CVE-2014-8125 was discovered by\nJeremy Lindop of Red Hat; the CVE-2014-7827 issue was discovered by Ondra\nLukas of the Red Hat Quality Engineering Team; the CVE-2013-2133 issue was\ndiscovered by Richard Opalka and Arun Neelicattu of Red Hat.\n\nAll users of Red Hat JBoss BPM Suite 6.0.3 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss BPM Suite 6.1.0.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2015:0851",
            url: "https://access.redhat.com/errata/RHSA-2015:0851",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite&downloadType=distributions&version=6.1.0",
            url: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite&downloadType=distributions&version=6.1.0",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_BPM_Suite/",
            url: "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_BPM_Suite/",
         },
         {
            category: "external",
            summary: "969924",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=969924",
         },
         {
            category: "external",
            summary: "1045257",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1045257",
         },
         {
            category: "external",
            summary: "1063642",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1063642",
         },
         {
            category: "external",
            summary: "1093526",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1093526",
         },
         {
            category: "external",
            summary: "1093527",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1093527",
         },
         {
            category: "external",
            summary: "1093529",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1093529",
         },
         {
            category: "external",
            summary: "1093530",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1093530",
         },
         {
            category: "external",
            summary: "1129074",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1129074",
         },
         {
            category: "external",
            summary: "1129916",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1129916",
         },
         {
            category: "external",
            summary: "1133769",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1133769",
         },
         {
            category: "external",
            summary: "1133773",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1133773",
         },
         {
            category: "external",
            summary: "1157304",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1157304",
         },
         {
            category: "external",
            summary: "1160574",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1160574",
         },
         {
            category: "external",
            summary: "1165328",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1165328",
         },
         {
            category: "external",
            summary: "1169237",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1169237",
         },
         {
            category: "external",
            summary: "1169553",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1169553",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0851.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.1.0 update",
      tracking: {
         current_release_date: "2025-01-26T19:53:30+00:00",
         generator: {
            date: "2025-01-26T19:53:30+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.6",
            },
         },
         id: "RHSA-2015:0851",
         initial_release_date: "2015-04-16T16:02:37+00:00",
         revision_history: [
            {
               date: "2015-04-16T16:02:37+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2019-02-20T12:35:25+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-01-26T19:53:30+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat JBoss BPMS 6.0",
                        product: {
                           name: "Red Hat JBoss BPMS 6.0",
                           product_id: "Red Hat JBoss BPMS 6.0",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:jboss_bpms:6.0",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Process Automation Manager",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         acknowledgments: [
            {
               names: [
                  "Florian Weimer",
               ],
               organization: "Red Hat Product Security",
               summary: "This issue was discovered by Red Hat.",
            },
         ],
         cve: "CVE-2012-6153",
         cwe: {
            id: "CWE-297",
            name: "Improper Validation of Certificate with Host Mismatch",
         },
         discovery_date: "2012-11-15T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1129916",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BPMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2012-6153",
            },
            {
               category: "external",
               summary: "RHBZ#1129916",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1129916",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2012-6153",
               url: "https://www.cve.org/CVERecord?id=CVE-2012-6153",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
            },
         ],
         release_date: "2014-08-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:37+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BPMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0851",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5.8,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BPMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Richard Opalka",
               ],
            },
            {
               names: [
                  "Arun Neelicattu",
               ],
               organization: "Red Hat",
               summary: "This issue was discovered by Red Hat.",
            },
         ],
         cve: "CVE-2013-2133",
         cwe: {
            id: "CWE-862",
            name: "Missing Authorization",
         },
         discovery_date: "2013-06-03T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "969924",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the way method-level authorization for JAX-WS Service endpoints was performed by the EJB invocation handler implementation. Any restrictions declared on EJB methods were ignored when executing the JAX-WS handlers, and only class-level restrictions were applied. A remote attacker who is authorized to access the EJB class, could invoke a JAX-WS handler which they were not authorized to invoke.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "WS: EJB3 role restrictions are not applied to jaxws handlers",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 4 and 5; Red Hat JBoss Enterprise Portal Platform 5; and Red Hat JBoss Enterprise SOA Platform 4 and 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BPMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2013-2133",
            },
            {
               category: "external",
               summary: "RHBZ#969924",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=969924",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2013-2133",
               url: "https://www.cve.org/CVERecord?id=CVE-2013-2133",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2013-2133",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2013-2133",
            },
         ],
         release_date: "2013-12-04T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:37+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BPMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0851",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "SINGLE",
                  availabilityImpact: "NONE",
                  baseScore: 4,
                  confidentialityImpact: "NONE",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:L/Au:S/C:N/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BPMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "WS: EJB3 role restrictions are not applied to jaxws handlers",
      },
      {
         cve: "CVE-2013-4517",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2013-12-20T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1045257",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was discovered that the Apache Santuario XML Security for Java project allowed Document Type Definitions (DTDs) to be processed when applying Transforms even when secure validation was enabled. A remote attacker could use this flaw to exhaust all available memory on the system, causing a denial of service.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Java: Java XML Signature DoS Attack",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Fuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4, Fuse Mediation Router 2.7, 2.8 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nFuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 4;  Red Hat JBoss Enterprise Data Services Platform 5; Red Hat JBoss Enterprise Portal Platform 4 and 5; and Red Hat JBoss Enterprise SOA Platform 4 and 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BPMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2013-4517",
            },
            {
               category: "external",
               summary: "RHBZ#1045257",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1045257",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2013-4517",
               url: "https://www.cve.org/CVERecord?id=CVE-2013-4517",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2013-4517",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2013-4517",
            },
         ],
         release_date: "2013-11-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:37+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BPMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0851",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "PARTIAL",
                  baseScore: 5,
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BPMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "Java: Java XML Signature DoS Attack",
      },
      {
         cve: "CVE-2013-7397",
         cwe: {
            id: "CWE-295",
            name: "Improper Certificate Validation",
         },
         discovery_date: "2014-08-26T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1133769",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that async-http-client would disable SSL/TLS certificate verification under certain conditions, for example if HTTPS communication also used client certificates. A man-in-the-middle (MITM) attacker could use this flaw to spoof a valid certificate.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "async-http-client: SSL/TLS certificate verification is disabled under certain conditions",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BPMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2013-7397",
            },
            {
               category: "external",
               summary: "RHBZ#1133769",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1133769",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2013-7397",
               url: "https://www.cve.org/CVERecord?id=CVE-2013-7397",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2013-7397",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2013-7397",
            },
         ],
         release_date: "2013-07-30T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:37+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BPMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0851",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5.8,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BPMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "async-http-client: SSL/TLS certificate verification is disabled under certain conditions",
      },
      {
         cve: "CVE-2013-7398",
         cwe: {
            id: "CWE-297",
            name: "Improper Validation of Certificate with Host Mismatch",
         },
         discovery_date: "2014-08-26T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1133773",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that async-http-client did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "async-http-client: missing hostname verification for SSL certificates",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BPMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2013-7398",
            },
            {
               category: "external",
               summary: "RHBZ#1133773",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1133773",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2013-7398",
               url: "https://www.cve.org/CVERecord?id=CVE-2013-7398",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2013-7398",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2013-7398",
            },
         ],
         release_date: "2013-01-09T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:37+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BPMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0851",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5.8,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BPMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "async-http-client: missing hostname verification for SSL certificates",
      },
      {
         cve: "CVE-2014-0034",
         cwe: {
            id: "CWE-345",
            name: "Insufficient Verification of Data Authenticity",
         },
         discovery_date: "2014-05-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1093529",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that the SecurityTokenService (STS), provided as a part of Apache CXF, could under certain circumstances accept invalid SAML tokens as valid. A remote attacker could use a specially crafted SAML token to gain access to an application that uses STS for validation of SAML tokens.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BPMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-0034",
            },
            {
               category: "external",
               summary: "RHBZ#1093529",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1093529",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-0034",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-0034",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-0034",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-0034",
            },
         ],
         release_date: "2014-05-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:37+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BPMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0851",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BPMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid",
      },
      {
         cve: "CVE-2014-0035",
         cwe: {
            id: "CWE-522",
            name: "Insufficiently Protected Credentials",
         },
         discovery_date: "2014-05-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1093530",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was discovered that UsernameTokens were sent in plain text by an Apache CXF client that used a Symmetric EncryptBeforeSigning password policy. A man-in-the-middle attacker could use this flaw to obtain the user name and password used by the client application using Apache CXF.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BPMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-0035",
            },
            {
               category: "external",
               summary: "RHBZ#1093530",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1093530",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-0035",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-0035",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-0035",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-0035",
            },
         ],
         release_date: "2014-05-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:37+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BPMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0851",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BPMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy",
      },
      {
         cve: "CVE-2014-0059",
         cwe: {
            id: "CWE-532",
            name: "Insertion of Sensitive Information into Log File",
         },
         discovery_date: "2014-02-11T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1063642",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that the security auditing functionality provided by PicketBox and JBossSX, both security frameworks for Java applications, used a world-readable audit.log file to record sensitive information. A local user could possibly use this flaw to gain access to the sensitive information in the audit.log file.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "JBossSX/PicketBox: World readable audit.log file",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BPMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-0059",
            },
            {
               category: "external",
               summary: "RHBZ#1063642",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1063642",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-0059",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-0059",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-0059",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-0059",
            },
         ],
         release_date: "2014-05-27T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:37+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BPMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0851",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "LOCAL",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 2.1,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:L/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BPMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "JBossSX/PicketBox: World readable audit.log file",
      },
      {
         cve: "CVE-2014-0109",
         cwe: {
            id: "CWE-770",
            name: "Allocation of Resources Without Limits or Throttling",
         },
         discovery_date: "2014-05-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1093526",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A denial of service flaw was found in the way Apache CXF created error messages for certain POST requests. A remote attacker could send a specially crafted request which, when processed by an application using Apache CXF, could consume an excessive amount of memory on the system, possibly triggering an Out Of Memory (OOM) error.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "CXF: HTML content posted to SOAP endpoint could cause OOM errors",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BPMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-0109",
            },
            {
               category: "external",
               summary: "RHBZ#1093526",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1093526",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-0109",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-0109",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-0109",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-0109",
            },
         ],
         release_date: "2014-05-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:37+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BPMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0851",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "SINGLE",
                  availabilityImpact: "PARTIAL",
                  baseScore: 3.5,
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:M/Au:S/C:N/I:N/A:P",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BPMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "CXF: HTML content posted to SOAP endpoint could cause OOM errors",
      },
      {
         cve: "CVE-2014-0110",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2014-05-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1093527",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that when a large invalid SOAP message was processed by Apache CXF, it could be saved to a temporary file in the /tmp directory. A remote attacker could send a specially crafted SOAP message that, when processed by an application using Apache CXF, would use an excessive amount of disk space, possibly causing a denial of service.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "CXF: Large invalid content could cause temporary space to fill",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BPMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-0110",
            },
            {
               category: "external",
               summary: "RHBZ#1093527",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1093527",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-0110",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-0110",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-0110",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-0110",
            },
         ],
         release_date: "2014-05-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:37+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BPMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0851",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "SINGLE",
                  availabilityImpact: "PARTIAL",
                  baseScore: 3.5,
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:M/Au:S/C:N/I:N/A:P",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BPMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "CXF: Large invalid content could cause temporary space to fill",
      },
      {
         cve: "CVE-2014-3577",
         cwe: {
            id: "CWE-297",
            name: "Improper Validation of Certificate with Host Mismatch",
         },
         discovery_date: "2014-08-12T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1129074",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BPMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-3577",
            },
            {
               category: "external",
               summary: "RHBZ#1129074",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1129074",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-3577",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-3577",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
            },
         ],
         release_date: "2014-08-18T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:37+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BPMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0851",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5.8,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:N",
                  version: "2.0",
               },
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.8,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
                  version: "3.0",
               },
               products: [
                  "Red Hat JBoss BPMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
      },
      {
         cve: "CVE-2014-3623",
         cwe: {
            id: "CWE-347",
            name: "Improper Verification of Cryptographic Signature",
         },
         discovery_date: "2014-10-27T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1157304",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that Apache WSS4J (Web Services Security for Java), as used by Apache CXF with the TransportBinding, did not, by default, properly enforce all security requirements associated with SAML SubjectConfirmation methods. A remote attacker could use this flaw to perform various types of spoofing attacks on web service endpoints secured by WSS4J that rely on SAML for authentication.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Fuse ESB Enterprise 7 is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss SOA Platform 5 and Red Hat JBoss BRMS 5 are now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware Product Life Cycle: https://access.redhat.com/support/policy/updates/jboss_notes/",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BPMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-3623",
            },
            {
               category: "external",
               summary: "RHBZ#1157304",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1157304",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-3623",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-3623",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-3623",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-3623",
            },
         ],
         release_date: "2014-10-25T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:37+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BPMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0851",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BPMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Ondra Lukas",
               ],
               organization: "Red Hat Quality Engineering Team",
               summary: "This issue was discovered by Red Hat.",
            },
         ],
         cve: "CVE-2014-7827",
         cwe: {
            id: "CWE-863",
            name: "Incorrect Authorization",
         },
         discovery_date: "2014-11-04T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1160574",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that when processing undefined security domains, the org.jboss.security.plugins.mapping.JBossMappingManager implementation would fall back to the default security domain if it was available. A user with valid credentials in the defined default domain, with a role that is valid in the expected application domain, could perform actions that were otherwise not available to them. When using the SAML2 STS Login Module, JBossMappingManager exposed this issue due to the PicketLink Trust SecurityActions implementation using a hardcoded default value when defining the context.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Security: Wrong security context loaded when using SAML2 STS Login Module",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 4 and 5; Red Hat JBoss Enterprise Portal Platform 5; Red Hat JBoss Enterprise SOA Platform 4 and 5; and Red Hat JBoss Enterprise Web Platform 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BPMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-7827",
            },
            {
               category: "external",
               summary: "RHBZ#1160574",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1160574",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-7827",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-7827",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-7827",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-7827",
            },
         ],
         release_date: "2015-02-11T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:37+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BPMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0851",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "SINGLE",
                  availabilityImpact: "NONE",
                  baseScore: 3.5,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:M/Au:S/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BPMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "Security: Wrong security context loaded when using SAML2 STS Login Module",
      },
      {
         cve: "CVE-2014-7839",
         cwe: {
            id: "CWE-611",
            name: "Improper Restriction of XML External Entity Reference",
         },
         discovery_date: "2014-11-11T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1165328",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that the RESTEasy DocumentProvider did not set the external-parameter-entities and external-general-entities features appropriately, thus allowing external entity expansion. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XML eXternal Entity (XXE) attacks.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "RESTeasy: External entities expanded by DocumentProvider",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Web Framework Kit has moved out of maintenance phase and is no longer supported by Red Hat Product Security. This issue is not currently planned to be addressed in any future updates. For additional information, refer to the Red Hat JBoss Middleware Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BPMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-7839",
            },
            {
               category: "external",
               summary: "RHBZ#1165328",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1165328",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-7839",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-7839",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-7839",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-7839",
            },
         ],
         release_date: "2014-11-18T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:37+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BPMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0851",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BPMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "RESTeasy: External entities expanded by DocumentProvider",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Rune Steinseth",
               ],
               organization: "JProfessionals",
            },
         ],
         cve: "CVE-2014-8122",
         cwe: {
            id: "CWE-200",
            name: "Exposure of Sensitive Information to an Unauthorized Actor",
         },
         discovery_date: "2014-11-28T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1169237",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was discovered that under specific conditions the conversation state information stored in a thread-local variable in JBoss Weld was not sanitized correctly when the conversation ended. This could lead to a race condition that could potentially expose sensitive information from a previous conversation to the current conversation.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Weld: Limited information disclosure via stale thread state",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BPMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-8122",
            },
            {
               category: "external",
               summary: "RHBZ#1169237",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1169237",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-8122",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-8122",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-8122",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-8122",
            },
         ],
         release_date: "2014-12-04T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:37+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BPMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0851",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "HIGH",
                  accessVector: "NETWORK",
                  authentication: "SINGLE",
                  availabilityImpact: "NONE",
                  baseScore: 2.1,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:H/Au:S/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BPMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "Weld: Limited information disclosure via stale thread state",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Jeremy Lindop",
               ],
               organization: "Red Hat",
               summary: "This issue was discovered by Red Hat.",
            },
         ],
         cve: "CVE-2014-8125",
         cwe: {
            id: "CWE-611",
            name: "Improper Restriction of XML External Entity Reference",
         },
         discovery_date: "2014-12-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1169553",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was discovered that the jBPM runtime performed expansion of external parameter entities while executing BPMN2 files. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XML eXternal Entity (XXE) attacks.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jBPM: BPMN2 file processing XXE in Process Execution",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; and Red Hat JBoss Enterprise SOA Platform 4 and 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BPMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-8125",
            },
            {
               category: "external",
               summary: "RHBZ#1169553",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1169553",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-8125",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-8125",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-8125",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-8125",
            },
         ],
         release_date: "2014-12-22T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:37+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BPMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0851",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BPMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jBPM: BPMN2 file processing XXE in Process Execution",
      },
   ],
}