{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Red Hat JBoss Fuse 6.2.0, which fixes multiple security issues, several\nbugs, and adds various enhancements, is now available from the Red Hat\nCustomer Portal.\n\nRed Hat Product Security has rated this update as having\nImportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nRed Hat JBoss Fuse 6.2.0 is a minor product release that updates Red Hat\nJBoss Fuse 6.1.0, and includes several bug fixes and enhancements. Refer to\nthe Release Notes document, available from the link in the References\nsection, for a list of changes.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint,\nflexible, open source enterprise service bus and integration platform.\n\nThe following security fixes are addressed in this release:\n\nIt was found that async-http-client would disable SSL/TLS certificate verification under certain conditions, for example if HTTPS communication also used client certificates. A man-in-the-middle (MITM) attacker could use this flaw to spoof a valid certificate. (CVE-2013-7397)\n\nIt was found that async-http-client did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name. (CVE-2013-7398)\n\nIt was found that the ServerTrustManager in the Smack XMPP API did not\nverify basicConstraints and nameConstraints in X.509 certificate chains. A\nman-in-the-middle attacker could use this flaw to spoof servers and obtain\nsensitive information. (CVE-2014-0363)\n\nIt was found that the ParseRoster component in the Smack XMPP API did not\nverify the From attribute of a roster-query IQ stanza. A remote attacker\ncould use this flaw to spoof IQ responses. (CVE-2014-0364)\n\nIt was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. (CVE-2014-3577)\n\nIt was found that the JClouds scriptbuilder Statements class writes a temporary file to a predictable location. An attacker could use this flaw to access sensitive data, denial of service, or other attacks. (CVE-2014-4651)\n\nIt was found that SSLSocket in Smack did not perform hostname verification. An attacker could redirect traffic between an application and an XMPP server by providing a valid certificate for a domain under the attacker's control. (CVE-2014-5075)\n\nIt was found that JBoss Fuse would allow any user defined in the users.properties file to access the HawtIO console without having a valid admin role. This could allow a remote attacker to bypass intended authentication HawtIO console access restrictions. (CVE-2014-8175)\n\nIt was found that a prior countermeasure in Apache WSS4J for Bleichenbacher's attack on XML Encryption (CVE-2011-2487) threw an exception that permitted an attacker to determine the failure of the attempted attack, thereby leaving WSS4J vulnerable to the attack. The original flaw allowed a remote attacker to recover the entire plain text form of a symmetric key. (CVE-2015-0226)\n\nIt was found that Apache WSS4J permitted bypass of the requireSignedEncryptedDataElements configuration property via XML Signature wrapping attacks. A remote attacker could use this flaw to modify the contents of a signed request. (CVE-2015-0227)\n\nIt was found that PKIX trust components allowed an X509 credential to be trusted if no trusted names were available for the entityID. An attacker could use a certificate issued by a shibmd:KeyAuthority trust anchor to impersonate an entity within the scope of that keyAuthority. (CVE-2015-1796)\n\nThe CVE-2014-8175 issue was reported by Jay Kumar SenSharma of Red Hat.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2015:1176",
            url: "https://access.redhat.com/errata/RHSA-2015:1176",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse&downloadType=distributions&version=6.2.0",
            url: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse&downloadType=distributions&version=6.2.0",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_Fuse/",
            url: "https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_Fuse/",
         },
         {
            category: "external",
            summary: "1093273",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1093273",
         },
         {
            category: "external",
            summary: "1093276",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1093276",
         },
         {
            category: "external",
            summary: "1112877",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1112877",
         },
         {
            category: "external",
            summary: "1127276",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1127276",
         },
         {
            category: "external",
            summary: "1129074",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1129074",
         },
         {
            category: "external",
            summary: "1133769",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1133769",
         },
         {
            category: "external",
            summary: "1133773",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1133773",
         },
         {
            category: "external",
            summary: "1191446",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1191446",
         },
         {
            category: "external",
            summary: "1191451",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1191451",
         },
         {
            category: "external",
            summary: "1196619",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1196619",
         },
         {
            category: "external",
            summary: "1205112",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1205112",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1176.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat JBoss Fuse 6.2.0 update",
      tracking: {
         current_release_date: "2024-11-22T09:16:04+00:00",
         generator: {
            date: "2024-11-22T09:16:04+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.1",
            },
         },
         id: "RHSA-2015:1176",
         initial_release_date: "2015-06-23T16:52:52+00:00",
         revision_history: [
            {
               date: "2015-06-23T16:52:52+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2019-02-20T12:35:48+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-11-22T09:16:04+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat JBoss Fuse 6.2",
                        product: {
                           name: "Red Hat JBoss Fuse 6.2",
                           product_id: "Red Hat JBoss Fuse 6.2",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:jboss_fuse:6.2.0",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat JBoss Fuse",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2013-7397",
         cwe: {
            id: "CWE-295",
            name: "Improper Certificate Validation",
         },
         discovery_date: "2014-08-26T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1133769",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that async-http-client would disable SSL/TLS certificate verification under certain conditions, for example if HTTPS communication also used client certificates. A man-in-the-middle (MITM) attacker could use this flaw to spoof a valid certificate.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "async-http-client: SSL/TLS certificate verification is disabled under certain conditions",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss Fuse 6.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2013-7397",
            },
            {
               category: "external",
               summary: "RHBZ#1133769",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1133769",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2013-7397",
               url: "https://www.cve.org/CVERecord?id=CVE-2013-7397",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2013-7397",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2013-7397",
            },
         ],
         release_date: "2013-07-30T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-06-23T16:52:52+00:00",
               details: "All users of Red Hat JBoss Fuse 6.1.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
               product_ids: [
                  "Red Hat JBoss Fuse 6.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:1176",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5.8,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss Fuse 6.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "async-http-client: SSL/TLS certificate verification is disabled under certain conditions",
      },
      {
         cve: "CVE-2013-7398",
         cwe: {
            id: "CWE-297",
            name: "Improper Validation of Certificate with Host Mismatch",
         },
         discovery_date: "2014-08-26T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1133773",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that async-http-client did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "async-http-client: missing hostname verification for SSL certificates",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss Fuse 6.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2013-7398",
            },
            {
               category: "external",
               summary: "RHBZ#1133773",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1133773",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2013-7398",
               url: "https://www.cve.org/CVERecord?id=CVE-2013-7398",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2013-7398",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2013-7398",
            },
         ],
         release_date: "2013-01-09T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-06-23T16:52:52+00:00",
               details: "All users of Red Hat JBoss Fuse 6.1.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
               product_ids: [
                  "Red Hat JBoss Fuse 6.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:1176",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5.8,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss Fuse 6.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "async-http-client: missing hostname verification for SSL certificates",
      },
      {
         cve: "CVE-2014-0363",
         discovery_date: "2014-04-30T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1093273",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that the ServerTrustManager in the Smack XMPP API did not verify basicConstraints and nameConstraints in X.509 certificate chains. A man-in-the-middle attacker could use this flaw to spoof servers and obtain sensitive information.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "smack: incorrect X.509 certificate validation",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss Fuse 6.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-0363",
            },
            {
               category: "external",
               summary: "RHBZ#1093273",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1093273",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-0363",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-0363",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-0363",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-0363",
            },
         ],
         release_date: "2013-02-06T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-06-23T16:52:52+00:00",
               details: "All users of Red Hat JBoss Fuse 6.1.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
               product_ids: [
                  "Red Hat JBoss Fuse 6.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:1176",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  confidentialityImpact: "NONE",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss Fuse 6.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "smack: incorrect X.509 certificate validation",
      },
      {
         cve: "CVE-2014-0364",
         discovery_date: "2014-04-30T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1093276",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that the ParseRoster component in the Smack XMPP API did not verify the From attribute of a roster-query IQ stanza. A remote attacker could use this flaw to spoof IQ responses.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "smack: IQ response spoofing",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss Fuse 6.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-0364",
            },
            {
               category: "external",
               summary: "RHBZ#1093276",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1093276",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-0364",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-0364",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-0364",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-0364",
            },
         ],
         release_date: "2014-01-31T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-06-23T16:52:52+00:00",
               details: "All users of Red Hat JBoss Fuse 6.1.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
               product_ids: [
                  "Red Hat JBoss Fuse 6.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:1176",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  confidentialityImpact: "NONE",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss Fuse 6.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "smack: IQ response spoofing",
      },
      {
         cve: "CVE-2014-3577",
         cwe: {
            id: "CWE-297",
            name: "Improper Validation of Certificate with Host Mismatch",
         },
         discovery_date: "2014-08-12T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1129074",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss Fuse 6.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-3577",
            },
            {
               category: "external",
               summary: "RHBZ#1129074",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1129074",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-3577",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-3577",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
            },
         ],
         release_date: "2014-08-18T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-06-23T16:52:52+00:00",
               details: "All users of Red Hat JBoss Fuse 6.1.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
               product_ids: [
                  "Red Hat JBoss Fuse 6.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:1176",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5.8,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:N",
                  version: "2.0",
               },
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.8,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
                  version: "3.0",
               },
               products: [
                  "Red Hat JBoss Fuse 6.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
      },
      {
         cve: "CVE-2014-4651",
         discovery_date: "2014-06-19T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1112877",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that the JClouds scriptbuilder Statements class wrote a temporary file to a predictable location. An attacker could use this flaw to access sensitive data, cause a denial of service, or perform other attacks.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "JClouds: predictable tmp file creation in ScriptBuilder Statements",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss Fuse 6.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-4651",
            },
            {
               category: "external",
               summary: "RHBZ#1112877",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1112877",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-4651",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-4651",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-4651",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-4651",
            },
         ],
         release_date: "2014-06-19T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-06-23T16:52:52+00:00",
               details: "All users of Red Hat JBoss Fuse 6.1.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
               product_ids: [
                  "Red Hat JBoss Fuse 6.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:1176",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "LOCAL",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:L/AC:M/Au:N/C:P/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss Fuse 6.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "JClouds: predictable tmp file creation in ScriptBuilder Statements",
      },
      {
         cve: "CVE-2014-5075",
         discovery_date: "2014-08-06T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1127276",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that SSLSocket in Smack did not perform hostname verification. An attacker could redirect traffic between an application and an XMPP server by providing a valid certificate for a domain under the attacker's control.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "smack: MitM vulnerability",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss Fuse 6.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-5075",
            },
            {
               category: "external",
               summary: "RHBZ#1127276",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1127276",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-5075",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-5075",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-5075",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-5075",
            },
         ],
         release_date: "2014-08-05T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-06-23T16:52:52+00:00",
               details: "All users of Red Hat JBoss Fuse 6.1.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
               product_ids: [
                  "Red Hat JBoss Fuse 6.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:1176",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5.8,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss Fuse 6.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "smack: MitM vulnerability",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Jay Kumar SenSharma",
               ],
               organization: "Red Hat",
               summary: "This issue was discovered by Red Hat.",
            },
         ],
         cve: "CVE-2014-8175",
         cwe: {
            id: "CWE-862",
            name: "Missing Authorization",
         },
         discovery_date: "2015-03-23T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1205112",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that JBoss Fuse would allow any user defined in the users.properties file to access the HawtIO console without having a valid admin role. This could allow a remote attacker to bypass intended authentication HawtIO console access restrictions.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Fuse: insufficient access permissions checks when accessing Hawtio console",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss Fuse 6.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-8175",
            },
            {
               category: "external",
               summary: "RHBZ#1205112",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1205112",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-8175",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-8175",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-8175",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-8175",
            },
         ],
         release_date: "2015-06-23T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-06-23T16:52:52+00:00",
               details: "All users of Red Hat JBoss Fuse 6.1.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
               product_ids: [
                  "Red Hat JBoss Fuse 6.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:1176",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "PARTIAL",
                  baseScore: 6.8,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss Fuse 6.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "Fuse: insufficient access permissions checks when accessing Hawtio console",
      },
      {
         cve: "CVE-2015-0226",
         cwe: {
            id: "CWE-327",
            name: "Use of a Broken or Risky Cryptographic Algorithm",
         },
         discovery_date: "2015-02-11T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1191446",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that a prior countermeasure in Apache WSS4J for Bleichenbacher's attack on XML Encryption (CVE-2011-2487) threw an exception that permitted an attacker to determine the failure of the attempted attack, thereby leaving WSS4J vulnerable to the attack. The original flaw allowed a remote attacker to recover the entire plain text form of a symmetric key.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "wss4j: Apache WSS4J is vulnerable to Bleichenbacher's attack (incomplete fix for CVE-2011-2487)",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss Fuse 6.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2015-0226",
            },
            {
               category: "external",
               summary: "RHBZ#1191446",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1191446",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2015-0226",
               url: "https://www.cve.org/CVERecord?id=CVE-2015-0226",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2015-0226",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2015-0226",
            },
         ],
         release_date: "2015-02-10T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-06-23T16:52:52+00:00",
               details: "All users of Red Hat JBoss Fuse 6.1.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
               product_ids: [
                  "Red Hat JBoss Fuse 6.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:1176",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 7.8,
                  confidentialityImpact: "COMPLETE",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:L/Au:N/C:C/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss Fuse 6.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "wss4j: Apache WSS4J is vulnerable to Bleichenbacher's attack (incomplete fix for CVE-2011-2487)",
      },
      {
         cve: "CVE-2015-0227",
         cwe: {
            id: "CWE-358",
            name: "Improperly Implemented Security Check for Standard",
         },
         discovery_date: "2015-02-11T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1191451",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that Apache WSS4J permitted bypass of the requireSignedEncryptedDataElements configuration property via XML Signature wrapping attacks. A remote attacker could use this flaw to modify the contents of a signed request.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "wss4j: Apache WSS4J doesn't correctly enforce the requireSignedEncryptedDataElements property",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss Fuse 6.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2015-0227",
            },
            {
               category: "external",
               summary: "RHBZ#1191451",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1191451",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2015-0227",
               url: "https://www.cve.org/CVERecord?id=CVE-2015-0227",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2015-0227",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2015-0227",
            },
         ],
         release_date: "2015-02-10T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-06-23T16:52:52+00:00",
               details: "All users of Red Hat JBoss Fuse 6.1.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
               product_ids: [
                  "Red Hat JBoss Fuse 6.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:1176",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "HIGH",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 4,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:H/Au:N/C:P/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss Fuse 6.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "wss4j: Apache WSS4J doesn't correctly enforce the requireSignedEncryptedDataElements property",
      },
      {
         cve: "CVE-2015-1796",
         discovery_date: "2015-02-26T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1196619",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that PKIX trust components allowed an X.509 credential to be trusted if no trusted names were available for the entityID. An attacker could use a certificate issued by a shibmd:KeyAuthority trust anchor to impersonate an entity within the scope of that keyAuthority.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Java: PKIX Trust Engines Exhibit Critical Flaw In Trusted Names Evaluation",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss Fuse 6.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2015-1796",
            },
            {
               category: "external",
               summary: "RHBZ#1196619",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1196619",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2015-1796",
               url: "https://www.cve.org/CVERecord?id=CVE-2015-1796",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2015-1796",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2015-1796",
            },
            {
               category: "external",
               summary: "http://shibboleth.net/community/advisories/secadv_20150225.txt",
               url: "http://shibboleth.net/community/advisories/secadv_20150225.txt",
            },
         ],
         release_date: "2015-02-25T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-06-23T16:52:52+00:00",
               details: "All users of Red Hat JBoss Fuse 6.1.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
               product_ids: [
                  "Red Hat JBoss Fuse 6.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:1176",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "SINGLE",
                  availabilityImpact: "NONE",
                  baseScore: 6.3,
                  confidentialityImpact: "COMPLETE",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:M/Au:S/C:C/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss Fuse 6.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "Java: PKIX Trust Engines Exhibit Critical Flaw In Trusted Names Evaluation",
      },
      {
         cve: "CVE-2016-3088",
         cwe: {
            id: "CWE-22",
            name: "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
         },
         discovery_date: "2016-05-24T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1339318",
            },
         ],
         notes: [
            {
               category: "description",
               text: "The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "activemq: Fileserver web application vulnerability allowing RCE",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat JBoss A-MQ 6.3 , Red Hat JBoss Fuse 6.3, and Red Hat JBoss Fuse Service Works 6.0.0 do not provide the vulnerable component and are not affected by this flaw. Red Hat JBoss A-MQ 6.2.1 and Red Hat JBoss Fuse 6.2.1 disable the vulnerable component and as such are not vulnerable to this flaw. The fileserver component was first disabled in A-MQ 6.2.0 and Fuse 6.2.0. Users of older, unsupported versions of these products are strongly advised to observe the mitigation provided on this page.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss Fuse 6.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2016-3088",
            },
            {
               category: "external",
               summary: "RHBZ#1339318",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1339318",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2016-3088",
               url: "https://www.cve.org/CVERecord?id=CVE-2016-3088",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2016-3088",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2016-3088",
            },
            {
               category: "external",
               summary: "http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt",
               url: "http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt",
            },
            {
               category: "external",
               summary: "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
               url: "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
            },
         ],
         release_date: "2016-05-24T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-06-23T16:52:52+00:00",
               details: "All users of Red Hat JBoss Fuse 6.1.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update).",
               product_ids: [
                  "Red Hat JBoss Fuse 6.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:1176",
            },
            {
               category: "workaround",
               details: "Users are advised to use other FTP and HTTP based file servers for transferring blob messages. Fileserver web application SHOULD NOT be used in older version of the broker and it should be disabled (it has been disabled by default since 5.12.0). This can be done by removing (commenting out) the following lines from conf\\jetty.xml file\n\n<bean class=\"org.eclipse.jetty.webapp.WebAppContext\">\n    <property name=\"contextPath\" value=\"/fileserver\" />\n    <property name=\"resourceBase\" value=\"${activemq.home}/webapps/fileserver\" />\n    <property name=\"logUrlOnStart\" value=\"true\" />\n    <property name=\"parentLoaderPriority\" value=\"true\" />\n</bean>",
               product_ids: [
                  "Red Hat JBoss Fuse 6.2",
               ],
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "PARTIAL",
                  baseScore: 6.8,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss Fuse 6.2",
               ],
            },
         ],
         threats: [
            {
               category: "exploit_status",
               date: "2022-02-10T00:00:00+00:00",
               details: "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
            },
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "activemq: Fileserver web application vulnerability allowing RCE",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Red Hat JBoss Fuse Service Works 6.0.0 roll up patch 5, which fixes\ntwo security issues and various bugs, is now available from the Red Hat\nCustomer Portal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat JBoss Fuse Service Works is the next-generation ESB and business\nprocess automation infrastructure.\n\nThis roll up patch serves as a cumulative upgrade for Red Hat JBoss Fuse\nService Works 6.0.0. It includes various bug fixes, which are listed in the\nREADME file included with the patch files.\n\nThe following security issues are also fixed with this release:\n\nIt was found that async-http-client would disable SSL/TLS certificate\nverification under certain conditions, for example if HTTPS communication\nalso used client certificates. A man-in-the-middle (MITM) attacker could\nuse this flaw to spoof a valid certificate. (CVE-2013-7397)\n\nIt was found that async-http-client did not verify that the server hostname\nmatched the domain name in the subject's Common Name (CN) or subjectAltName\nfield in X.509 certificates. This could allow a man-in-the-middle attacker\nto spoof an SSL server if they had a certificate that was valid for any\ndomain name. (CVE-2013-7398)\n\nAll users of Red Hat JBoss Fuse Service Works 6.0.0 as provided from the\nRed Hat Customer Portal are advised to apply this roll up patch.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2015:1551",
            url: "https://access.redhat.com/errata/RHSA-2015:1551",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse.serviceworks&downloadType=securityPatches&version=6.0.0",
            url: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse.serviceworks&downloadType=securityPatches&version=6.0.0",
         },
         {
            category: "external",
            summary: "1133769",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1133769",
         },
         {
            category: "external",
            summary: "1133773",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1133773",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1551.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat JBoss Fuse Service Works 6.0.0 security update",
      tracking: {
         current_release_date: "2024-11-22T09:03:38+00:00",
         generator: {
            date: "2024-11-22T09:03:38+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.1",
            },
         },
         id: "RHSA-2015:1551",
         initial_release_date: "2015-08-05T16:20:27+00:00",
         revision_history: [
            {
               date: "2015-08-05T16:20:27+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2019-02-20T12:35:42+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-11-22T09:03:38+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat JBoss Fuse Service Works 6.0",
                        product: {
                           name: "Red Hat JBoss Fuse Service Works 6.0",
                           product_id: "Red Hat JBoss Fuse Service Works 6.0",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:jboss_fuse_service_works:6.0",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat JBoss Fuse Service Works",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2013-7397",
         cwe: {
            id: "CWE-295",
            name: "Improper Certificate Validation",
         },
         discovery_date: "2014-08-26T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1133769",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that async-http-client would disable SSL/TLS certificate verification under certain conditions, for example if HTTPS communication also used client certificates. A man-in-the-middle (MITM) attacker could use this flaw to spoof a valid certificate.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "async-http-client: SSL/TLS certificate verification is disabled under certain conditions",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss Fuse Service Works 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2013-7397",
            },
            {
               category: "external",
               summary: "RHBZ#1133769",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1133769",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2013-7397",
               url: "https://www.cve.org/CVERecord?id=CVE-2013-7397",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2013-7397",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2013-7397",
            },
         ],
         release_date: "2013-07-30T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-08-05T16:20:27+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
               product_ids: [
                  "Red Hat JBoss Fuse Service Works 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:1551",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5.8,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss Fuse Service Works 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "async-http-client: SSL/TLS certificate verification is disabled under certain conditions",
      },
      {
         cve: "CVE-2013-7398",
         cwe: {
            id: "CWE-297",
            name: "Improper Validation of Certificate with Host Mismatch",
         },
         discovery_date: "2014-08-26T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1133773",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that async-http-client did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "async-http-client: missing hostname verification for SSL certificates",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss Fuse Service Works 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2013-7398",
            },
            {
               category: "external",
               summary: "RHBZ#1133773",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1133773",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2013-7398",
               url: "https://www.cve.org/CVERecord?id=CVE-2013-7398",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2013-7398",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2013-7398",
            },
         ],
         release_date: "2013-01-09T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-08-05T16:20:27+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
               product_ids: [
                  "Red Hat JBoss Fuse Service Works 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:1551",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5.8,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss Fuse Service Works 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "async-http-client: missing hostname verification for SSL certificates",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Red Hat JBoss BRMS 6.1.0, which fixes multiple security issues, several\nbugs, and adds various enhancements, is now available from the Red Hat\nCustomer Portal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat JBoss BRMS is a business rules management system for the\nmanagement, storage, creation, modification, and deployment of JBoss Rules.\n\nThis release of Red Hat JBoss BRMS 6.1.0 serves as a replacement for Red\nHat JBoss BRMS 6.0.3, and includes bug fixes and enhancements. Refer to the\nRed Hat JBoss BRMS 6.1.0 Release Notes for information on the most\nsignificant of these changes. The Release Notes are available at\nhttps://access.redhat.com/documentation/en-US/Red_Hat_JBoss_BRMS/\n\nThe following security issues are also fixed with this release,\ndescriptions of which can be found on the respective CVE pages linked in\nthe References section.\n\nCVE-2012-6153 Jakarta Commons httpclient / Apache CXF: SSL hostname\nverification bypass, incomplete CVE-2012-5783 fix\n\nCVE-2013-2133 JBoss WS: EJB3 role restrictions are not applied to jaxws\nhandlers\n\nCVE-2013-4517 Apache Santuario XML Security for Java: Java XML Signature\nDoS Attack\n\nCVE-2013-7397 async-http-client: SSL/TLS certificate verification is\ndisabled under certain conditions\n\nCVE-2013-7398 async-http-client: missing hostname verification for SSL\ncertificates\n\nCVE-2014-0034 Apache CXF: The SecurityTokenService accepts certain invalid\nSAML Tokens as valid\n\nCVE-2014-0035 Apache CXF: UsernameTokens are sent in plaintext with a\nSymmetric EncryptBeforeSigning policy\n\nCVE-2014-0059 JBossSX/PicketBox: World readable audit.log file\n\nCVE-2014-0109 Apache CXF: HTML content posted to SOAP endpoint could cause\nOOM errors\n\nCVE-2014-0110 Apache CXF: Large invalid content could cause temporary space\nto fill\n\nCVE-2014-3577 Jakarta Commons httpclient / Apache CXF: SSL hostname\nverification bypass, incomplete CVE-2012-6153 fix\n\nCVE-2014-3623 Apache WSS4J / Apache CXF: Improper security semantics\nenforcement of SAML SubjectConfirmation methods\n\nCVE-2014-7827 JBoss Security: Wrong security context loaded when using\nSAML2 STS Login Module\n\nCVE-2014-7839 RESTeasy: External entities expanded by DocumentProvider\n\nCVE-2014-8122 JBoss Weld: Limited information disclosure via stale thread\nstate\n\nCVE-2014-8125 jBPM: BPMN2 file processing XXE in Process Execution\n\nRed Hat would like to thank Rune Steinseth of JProfessionals for reporting\nthe CVE-2014-8122 issue. The CVE-2012-6153 issue was discovered by Florian\nWeimer of Red Hat Product Security; the CVE-2014-8125 was discovered by\nJeremy Lindop of Red Hat; the CVE-2014-7827 issue was discovered by Ondra\nLukas of the Red Hat Quality Engineering Team; the CVE-2013-2133 issue was\ndiscovered by Richard Opalka and Arun Neelicattu of Red Hat.\n\nAll users of Red Hat JBoss BRMS 6.0.3 as provided from the Red Hat Customer\nPortal are advised to upgrade to Red Hat JBoss BRMS 6.1.0.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2015:0850",
            url: "https://access.redhat.com/errata/RHSA-2015:0850",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms&downloadType=distributions&version=6.1.0",
            url: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms&downloadType=distributions&version=6.1.0",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_BRMS/",
            url: "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_BRMS/",
         },
         {
            category: "external",
            summary: "969924",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=969924",
         },
         {
            category: "external",
            summary: "1045257",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1045257",
         },
         {
            category: "external",
            summary: "1063642",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1063642",
         },
         {
            category: "external",
            summary: "1093526",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1093526",
         },
         {
            category: "external",
            summary: "1093527",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1093527",
         },
         {
            category: "external",
            summary: "1093529",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1093529",
         },
         {
            category: "external",
            summary: "1093530",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1093530",
         },
         {
            category: "external",
            summary: "1129074",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1129074",
         },
         {
            category: "external",
            summary: "1129916",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1129916",
         },
         {
            category: "external",
            summary: "1133769",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1133769",
         },
         {
            category: "external",
            summary: "1133773",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1133773",
         },
         {
            category: "external",
            summary: "1157304",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1157304",
         },
         {
            category: "external",
            summary: "1160574",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1160574",
         },
         {
            category: "external",
            summary: "1165328",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1165328",
         },
         {
            category: "external",
            summary: "1169237",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1169237",
         },
         {
            category: "external",
            summary: "1169553",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1169553",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0850.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat JBoss BRMS 6.1.0 update",
      tracking: {
         current_release_date: "2025-01-26T19:53:24+00:00",
         generator: {
            date: "2025-01-26T19:53:24+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.6",
            },
         },
         id: "RHSA-2015:0850",
         initial_release_date: "2015-04-16T16:02:45+00:00",
         revision_history: [
            {
               date: "2015-04-16T16:02:45+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2019-02-20T12:35:45+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-01-26T19:53:24+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat JBoss BRMS 6.0",
                        product: {
                           name: "Red Hat JBoss BRMS 6.0",
                           product_id: "Red Hat JBoss BRMS 6.0",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:jboss_brms:6.0",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Decision Manager",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         acknowledgments: [
            {
               names: [
                  "Florian Weimer",
               ],
               organization: "Red Hat Product Security",
               summary: "This issue was discovered by Red Hat.",
            },
         ],
         cve: "CVE-2012-6153",
         cwe: {
            id: "CWE-297",
            name: "Improper Validation of Certificate with Host Mismatch",
         },
         discovery_date: "2012-11-15T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1129916",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BRMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2012-6153",
            },
            {
               category: "external",
               summary: "RHBZ#1129916",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1129916",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2012-6153",
               url: "https://www.cve.org/CVERecord?id=CVE-2012-6153",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
            },
         ],
         release_date: "2014-08-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:45+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BRMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0850",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5.8,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BRMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Richard Opalka",
               ],
            },
            {
               names: [
                  "Arun Neelicattu",
               ],
               organization: "Red Hat",
               summary: "This issue was discovered by Red Hat.",
            },
         ],
         cve: "CVE-2013-2133",
         cwe: {
            id: "CWE-862",
            name: "Missing Authorization",
         },
         discovery_date: "2013-06-03T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "969924",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the way method-level authorization for JAX-WS Service endpoints was performed by the EJB invocation handler implementation. Any restrictions declared on EJB methods were ignored when executing the JAX-WS handlers, and only class-level restrictions were applied. A remote attacker who is authorized to access the EJB class, could invoke a JAX-WS handler which they were not authorized to invoke.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "WS: EJB3 role restrictions are not applied to jaxws handlers",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 4 and 5; Red Hat JBoss Enterprise Portal Platform 5; and Red Hat JBoss Enterprise SOA Platform 4 and 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BRMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2013-2133",
            },
            {
               category: "external",
               summary: "RHBZ#969924",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=969924",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2013-2133",
               url: "https://www.cve.org/CVERecord?id=CVE-2013-2133",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2013-2133",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2013-2133",
            },
         ],
         release_date: "2013-12-04T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:45+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BRMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0850",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "SINGLE",
                  availabilityImpact: "NONE",
                  baseScore: 4,
                  confidentialityImpact: "NONE",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:L/Au:S/C:N/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BRMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "WS: EJB3 role restrictions are not applied to jaxws handlers",
      },
      {
         cve: "CVE-2013-4517",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2013-12-20T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1045257",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was discovered that the Apache Santuario XML Security for Java project allowed Document Type Definitions (DTDs) to be processed when applying Transforms even when secure validation was enabled. A remote attacker could use this flaw to exhaust all available memory on the system, causing a denial of service.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Java: Java XML Signature DoS Attack",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Fuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4, Fuse Mediation Router 2.7, 2.8 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nFuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 4;  Red Hat JBoss Enterprise Data Services Platform 5; Red Hat JBoss Enterprise Portal Platform 4 and 5; and Red Hat JBoss Enterprise SOA Platform 4 and 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BRMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2013-4517",
            },
            {
               category: "external",
               summary: "RHBZ#1045257",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1045257",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2013-4517",
               url: "https://www.cve.org/CVERecord?id=CVE-2013-4517",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2013-4517",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2013-4517",
            },
         ],
         release_date: "2013-11-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:45+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BRMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0850",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "PARTIAL",
                  baseScore: 5,
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BRMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "Java: Java XML Signature DoS Attack",
      },
      {
         cve: "CVE-2013-7397",
         cwe: {
            id: "CWE-295",
            name: "Improper Certificate Validation",
         },
         discovery_date: "2014-08-26T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1133769",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that async-http-client would disable SSL/TLS certificate verification under certain conditions, for example if HTTPS communication also used client certificates. A man-in-the-middle (MITM) attacker could use this flaw to spoof a valid certificate.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "async-http-client: SSL/TLS certificate verification is disabled under certain conditions",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BRMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2013-7397",
            },
            {
               category: "external",
               summary: "RHBZ#1133769",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1133769",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2013-7397",
               url: "https://www.cve.org/CVERecord?id=CVE-2013-7397",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2013-7397",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2013-7397",
            },
         ],
         release_date: "2013-07-30T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:45+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BRMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0850",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5.8,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BRMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "async-http-client: SSL/TLS certificate verification is disabled under certain conditions",
      },
      {
         cve: "CVE-2013-7398",
         cwe: {
            id: "CWE-297",
            name: "Improper Validation of Certificate with Host Mismatch",
         },
         discovery_date: "2014-08-26T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1133773",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that async-http-client did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "async-http-client: missing hostname verification for SSL certificates",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BRMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2013-7398",
            },
            {
               category: "external",
               summary: "RHBZ#1133773",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1133773",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2013-7398",
               url: "https://www.cve.org/CVERecord?id=CVE-2013-7398",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2013-7398",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2013-7398",
            },
         ],
         release_date: "2013-01-09T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:45+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BRMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0850",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5.8,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BRMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "async-http-client: missing hostname verification for SSL certificates",
      },
      {
         cve: "CVE-2014-0034",
         cwe: {
            id: "CWE-345",
            name: "Insufficient Verification of Data Authenticity",
         },
         discovery_date: "2014-05-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1093529",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that the SecurityTokenService (STS), provided as a part of Apache CXF, could under certain circumstances accept invalid SAML tokens as valid. A remote attacker could use a specially crafted SAML token to gain access to an application that uses STS for validation of SAML tokens.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BRMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-0034",
            },
            {
               category: "external",
               summary: "RHBZ#1093529",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1093529",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-0034",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-0034",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-0034",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-0034",
            },
         ],
         release_date: "2014-05-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:45+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BRMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0850",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BRMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid",
      },
      {
         cve: "CVE-2014-0035",
         cwe: {
            id: "CWE-522",
            name: "Insufficiently Protected Credentials",
         },
         discovery_date: "2014-05-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1093530",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was discovered that UsernameTokens were sent in plain text by an Apache CXF client that used a Symmetric EncryptBeforeSigning password policy. A man-in-the-middle attacker could use this flaw to obtain the user name and password used by the client application using Apache CXF.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BRMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-0035",
            },
            {
               category: "external",
               summary: "RHBZ#1093530",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1093530",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-0035",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-0035",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-0035",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-0035",
            },
         ],
         release_date: "2014-05-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:45+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BRMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0850",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BRMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy",
      },
      {
         cve: "CVE-2014-0059",
         cwe: {
            id: "CWE-532",
            name: "Insertion of Sensitive Information into Log File",
         },
         discovery_date: "2014-02-11T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1063642",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that the security auditing functionality provided by PicketBox and JBossSX, both security frameworks for Java applications, used a world-readable audit.log file to record sensitive information. A local user could possibly use this flaw to gain access to the sensitive information in the audit.log file.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "JBossSX/PicketBox: World readable audit.log file",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BRMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-0059",
            },
            {
               category: "external",
               summary: "RHBZ#1063642",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1063642",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-0059",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-0059",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-0059",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-0059",
            },
         ],
         release_date: "2014-05-27T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:45+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BRMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0850",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "LOCAL",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 2.1,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:L/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BRMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "JBossSX/PicketBox: World readable audit.log file",
      },
      {
         cve: "CVE-2014-0109",
         cwe: {
            id: "CWE-770",
            name: "Allocation of Resources Without Limits or Throttling",
         },
         discovery_date: "2014-05-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1093526",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A denial of service flaw was found in the way Apache CXF created error messages for certain POST requests. A remote attacker could send a specially crafted request which, when processed by an application using Apache CXF, could consume an excessive amount of memory on the system, possibly triggering an Out Of Memory (OOM) error.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "CXF: HTML content posted to SOAP endpoint could cause OOM errors",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BRMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-0109",
            },
            {
               category: "external",
               summary: "RHBZ#1093526",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1093526",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-0109",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-0109",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-0109",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-0109",
            },
         ],
         release_date: "2014-05-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:45+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BRMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0850",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "SINGLE",
                  availabilityImpact: "PARTIAL",
                  baseScore: 3.5,
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:M/Au:S/C:N/I:N/A:P",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BRMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "CXF: HTML content posted to SOAP endpoint could cause OOM errors",
      },
      {
         cve: "CVE-2014-0110",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2014-05-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1093527",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that when a large invalid SOAP message was processed by Apache CXF, it could be saved to a temporary file in the /tmp directory. A remote attacker could send a specially crafted SOAP message that, when processed by an application using Apache CXF, would use an excessive amount of disk space, possibly causing a denial of service.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "CXF: Large invalid content could cause temporary space to fill",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BRMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-0110",
            },
            {
               category: "external",
               summary: "RHBZ#1093527",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1093527",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-0110",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-0110",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-0110",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-0110",
            },
         ],
         release_date: "2014-05-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:45+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BRMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0850",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "SINGLE",
                  availabilityImpact: "PARTIAL",
                  baseScore: 3.5,
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:M/Au:S/C:N/I:N/A:P",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BRMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "CXF: Large invalid content could cause temporary space to fill",
      },
      {
         cve: "CVE-2014-3577",
         cwe: {
            id: "CWE-297",
            name: "Improper Validation of Certificate with Host Mismatch",
         },
         discovery_date: "2014-08-12T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1129074",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4,  Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BRMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-3577",
            },
            {
               category: "external",
               summary: "RHBZ#1129074",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1129074",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-3577",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-3577",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
            },
         ],
         release_date: "2014-08-18T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:45+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BRMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0850",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5.8,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:N",
                  version: "2.0",
               },
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.8,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
                  version: "3.0",
               },
               products: [
                  "Red Hat JBoss BRMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
      },
      {
         cve: "CVE-2014-3623",
         cwe: {
            id: "CWE-347",
            name: "Improper Verification of Cryptographic Signature",
         },
         discovery_date: "2014-10-27T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1157304",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that Apache WSS4J (Web Services Security for Java), as used by Apache CXF with the TransportBinding, did not, by default, properly enforce all security requirements associated with SAML SubjectConfirmation methods. A remote attacker could use this flaw to perform various types of spoofing attacks on web service endpoints secured by WSS4J that rely on SAML for authentication.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Fuse ESB Enterprise 7 is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss SOA Platform 5 and Red Hat JBoss BRMS 5 are now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware Product Life Cycle: https://access.redhat.com/support/policy/updates/jboss_notes/",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BRMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-3623",
            },
            {
               category: "external",
               summary: "RHBZ#1157304",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1157304",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-3623",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-3623",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-3623",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-3623",
            },
         ],
         release_date: "2014-10-25T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:45+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BRMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0850",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BRMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Ondra Lukas",
               ],
               organization: "Red Hat Quality Engineering Team",
               summary: "This issue was discovered by Red Hat.",
            },
         ],
         cve: "CVE-2014-7827",
         cwe: {
            id: "CWE-863",
            name: "Incorrect Authorization",
         },
         discovery_date: "2014-11-04T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1160574",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that when processing undefined security domains, the org.jboss.security.plugins.mapping.JBossMappingManager implementation would fall back to the default security domain if it was available. A user with valid credentials in the defined default domain, with a role that is valid in the expected application domain, could perform actions that were otherwise not available to them. When using the SAML2 STS Login Module, JBossMappingManager exposed this issue due to the PicketLink Trust SecurityActions implementation using a hardcoded default value when defining the context.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Security: Wrong security context loaded when using SAML2 STS Login Module",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 4 and 5; Red Hat JBoss Enterprise Portal Platform 5; Red Hat JBoss Enterprise SOA Platform 4 and 5; and Red Hat JBoss Enterprise Web Platform 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BRMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-7827",
            },
            {
               category: "external",
               summary: "RHBZ#1160574",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1160574",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-7827",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-7827",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-7827",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-7827",
            },
         ],
         release_date: "2015-02-11T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:45+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BRMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0850",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "SINGLE",
                  availabilityImpact: "NONE",
                  baseScore: 3.5,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:M/Au:S/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BRMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "Security: Wrong security context loaded when using SAML2 STS Login Module",
      },
      {
         cve: "CVE-2014-7839",
         cwe: {
            id: "CWE-611",
            name: "Improper Restriction of XML External Entity Reference",
         },
         discovery_date: "2014-11-11T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1165328",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that the RESTEasy DocumentProvider did not set the external-parameter-entities and external-general-entities features appropriately, thus allowing external entity expansion. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XML eXternal Entity (XXE) attacks.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "RESTeasy: External entities expanded by DocumentProvider",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Web Framework Kit has moved out of maintenance phase and is no longer supported by Red Hat Product Security. This issue is not currently planned to be addressed in any future updates. For additional information, refer to the Red Hat JBoss Middleware Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BRMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-7839",
            },
            {
               category: "external",
               summary: "RHBZ#1165328",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1165328",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-7839",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-7839",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-7839",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-7839",
            },
         ],
         release_date: "2014-11-18T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:45+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BRMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0850",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BRMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "RESTeasy: External entities expanded by DocumentProvider",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Rune Steinseth",
               ],
               organization: "JProfessionals",
            },
         ],
         cve: "CVE-2014-8122",
         cwe: {
            id: "CWE-200",
            name: "Exposure of Sensitive Information to an Unauthorized Actor",
         },
         discovery_date: "2014-11-28T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1169237",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was discovered that under specific conditions the conversation state information stored in a thread-local variable in JBoss Weld was not sanitized correctly when the conversation ended. This could lead to a race condition that could potentially expose sensitive information from a previous conversation to the current conversation.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Weld: Limited information disclosure via stale thread state",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BRMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-8122",
            },
            {
               category: "external",
               summary: "RHBZ#1169237",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1169237",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-8122",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-8122",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-8122",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-8122",
            },
         ],
         release_date: "2014-12-04T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:45+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BRMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0850",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "HIGH",
                  accessVector: "NETWORK",
                  authentication: "SINGLE",
                  availabilityImpact: "NONE",
                  baseScore: 2.1,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:H/Au:S/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BRMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "Weld: Limited information disclosure via stale thread state",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Jeremy Lindop",
               ],
               organization: "Red Hat",
               summary: "This issue was discovered by Red Hat.",
            },
         ],
         cve: "CVE-2014-8125",
         cwe: {
            id: "CWE-611",
            name: "Improper Restriction of XML External Entity Reference",
         },
         discovery_date: "2014-12-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1169553",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was discovered that the jBPM runtime performed expansion of external parameter entities while executing BPMN2 files. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XML eXternal Entity (XXE) attacks.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jBPM: BPMN2 file processing XXE in Process Execution",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; and Red Hat JBoss Enterprise SOA Platform 4 and 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BRMS 6.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2014-8125",
            },
            {
               category: "external",
               summary: "RHBZ#1169553",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1169553",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2014-8125",
               url: "https://www.cve.org/CVERecord?id=CVE-2014-8125",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2014-8125",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2014-8125",
            },
         ],
         release_date: "2014-12-22T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-04-16T16:02:45+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BRMS 6.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:0850",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BRMS 6.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jBPM: BPMN2 file processing XXE in Process Execution",
      },
   ],
}