Action not permitted
Modal body text goes here.
cve-2014-0096
Vulnerability from cvelistv5
Published
2014-05-31 10:00
Modified
2024-08-06 09:05
Severity ?
EPSS score ?
Summary
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:05:38.741Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://advisories.mageia.org/MGASA-2014-0268.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.novell.com/support/kb/doc.php?id=7010166"
},
{
"name": "67667",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/67667"
},
{
"name": "59121",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/59121"
},
{
"name": "RHSA-2015:0765",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0765.html"
},
{
"name": "59732",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/59732"
},
{
"name": "59835",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/59835"
},
{
"name": "RHSA-2015:0675",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0675.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681528"
},
{
"name": "MDVSA-2015:052",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:052"
},
{
"name": "RHSA-2015:0720",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0720.html"
},
{
"name": "59849",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/59849"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://linux.oracle.com/errata/ELSA-2014-0865.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578637"
},
{
"name": "MDVSA-2015:084",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:084"
},
{
"name": "1030301",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1030301"
},
{
"name": "DSA-3530",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"name": "59678",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/59678"
},
{
"name": "HPSBUX03102",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=141017844705317\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://tomcat.apache.org/security-7.html"
},
{
"name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"
},
{
"name": "MDVSA-2015:053",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:053"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"name": "FEDORA-2015-2109",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://tomcat.apache.org/security-8.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678231"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1585853"
},
{
"name": "59616",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/59616"
},
{
"name": "20140527 [SECURITY] CVE-2014-0096 Apache Tomcat information disclosure",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2014/May/135"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://tomcat.apache.org/security-6.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578655"
},
{
"name": "59873",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/59873"
},
{
"name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2014/Dec/23"
},
{
"name": "HPSBOV03503",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=144498216801440\u0026w=2"
},
{
"name": "SSRT101681",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=141017844705317\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578610"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578611"
},
{
"name": "DSA-3552",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3552"
},
{
"name": "60729",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/60729"
},
{
"name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-05-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-13T16:09:49",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://advisories.mageia.org/MGASA-2014-0268.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.novell.com/support/kb/doc.php?id=7010166"
},
{
"name": "67667",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/67667"
},
{
"name": "59121",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/59121"
},
{
"name": "RHSA-2015:0765",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0765.html"
},
{
"name": "59732",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/59732"
},
{
"name": "59835",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/59835"
},
{
"name": "RHSA-2015:0675",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0675.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681528"
},
{
"name": "MDVSA-2015:052",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:052"
},
{
"name": "RHSA-2015:0720",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0720.html"
},
{
"name": "59849",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/59849"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://linux.oracle.com/errata/ELSA-2014-0865.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578637"
},
{
"name": "MDVSA-2015:084",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:084"
},
{
"name": "1030301",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1030301"
},
{
"name": "DSA-3530",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"name": "59678",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/59678"
},
{
"name": "HPSBUX03102",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "http://marc.info/?l=bugtraq\u0026m=141017844705317\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://tomcat.apache.org/security-7.html"
},
{
"name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"
},
{
"name": "MDVSA-2015:053",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:053"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"name": "FEDORA-2015-2109",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://tomcat.apache.org/security-8.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678231"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1585853"
},
{
"name": "59616",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/59616"
},
{
"name": "20140527 [SECURITY] CVE-2014-0096 Apache Tomcat information disclosure",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2014/May/135"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://tomcat.apache.org/security-6.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578655"
},
{
"name": "59873",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/59873"
},
{
"name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2014/Dec/23"
},
{
"name": "HPSBOV03503",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "http://marc.info/?l=bugtraq\u0026m=144498216801440\u0026w=2"
},
{
"name": "SSRT101681",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "http://marc.info/?l=bugtraq\u0026m=141017844705317\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578610"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578611"
},
{
"name": "DSA-3552",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3552"
},
{
"name": "60729",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/60729"
},
{
"name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2014-0096",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://advisories.mageia.org/MGASA-2014-0268.html",
"refsource": "CONFIRM",
"url": "http://advisories.mageia.org/MGASA-2014-0268.html"
},
{
"name": "http://www.novell.com/support/kb/doc.php?id=7010166",
"refsource": "CONFIRM",
"url": "http://www.novell.com/support/kb/doc.php?id=7010166"
},
{
"name": "67667",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/67667"
},
{
"name": "59121",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59121"
},
{
"name": "RHSA-2015:0765",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0765.html"
},
{
"name": "59732",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59732"
},
{
"name": "59835",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59835"
},
{
"name": "RHSA-2015:0675",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0675.html"
},
{
"name": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html",
"refsource": "CONFIRM",
"url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"
},
{
"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21681528",
"refsource": "CONFIRM",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681528"
},
{
"name": "MDVSA-2015:052",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:052"
},
{
"name": "RHSA-2015:0720",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0720.html"
},
{
"name": "59849",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59849"
},
{
"name": "http://linux.oracle.com/errata/ELSA-2014-0865.html",
"refsource": "CONFIRM",
"url": "http://linux.oracle.com/errata/ELSA-2014-0865.html"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578637",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578637"
},
{
"name": "MDVSA-2015:084",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:084"
},
{
"name": "1030301",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1030301"
},
{
"name": "DSA-3530",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"name": "59678",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59678"
},
{
"name": "HPSBUX03102",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=141017844705317\u0026w=2"
},
{
"name": "http://tomcat.apache.org/security-7.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-7.html"
},
{
"name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"
},
{
"name": "MDVSA-2015:053",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:053"
},
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"name": "FEDORA-2015-2109",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html"
},
{
"name": "http://tomcat.apache.org/security-8.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-8.html"
},
{
"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21678231",
"refsource": "CONFIRM",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678231"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1585853",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1585853"
},
{
"name": "59616",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59616"
},
{
"name": "20140527 [SECURITY] CVE-2014-0096 Apache Tomcat information disclosure",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2014/May/135"
},
{
"name": "http://tomcat.apache.org/security-6.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-6.html"
},
{
"name": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013",
"refsource": "CONFIRM",
"url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578655",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578655"
},
{
"name": "59873",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59873"
},
{
"name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2014/Dec/23"
},
{
"name": "HPSBOV03503",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=144498216801440\u0026w=2"
},
{
"name": "SSRT101681",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=141017844705317\u0026w=2"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578610",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578610"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578611",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578611"
},
{
"name": "DSA-3552",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3552"
},
{
"name": "60729",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/60729"
},
{
"name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2014-0096",
"datePublished": "2014-05-31T10:00:00",
"dateReserved": "2013-12-03T00:00:00",
"dateUpdated": "2024-08-06T09:05:38.741Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2014-0096\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2014-05-31T11:17:13.233\",\"lastModified\":\"2023-11-07T02:18:07.997\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.\"},{\"lang\":\"es\",\"value\":\"java/org/apache/catalina/servlets/DefaultServlet.java en el servlet por defecto en Apache Tomcat anterior a 6.0.40, 7.x anterior a 7.0.53 y 8.x anterior a 8.0.4 no restringe debidamente hojas de estilo XSLT, lo que permite a atacantes remotos evadir restricciones de jefe de seguridad y leer archivos arbitrarios a trav\u00e9s de una aplicaci\u00f3n web manipulada que proporciona una declaraci\u00f3n de entidad externa XML en conjunto con un referencia de entidad, relacionado con un problema de entidad externa XML (XXE).\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:N/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.3},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0F8C62EF-1B67-456A-9C66-755439CF8556\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"33E9607B-4D28-460D-896B-E4B7FA22441E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A819E245-D641-4F19-9139-6C940504F6E7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C381275-10C5-4939-BCE3-0D1F3B3CB2EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"81A31CA0-A209-4C49-AA06-C38E165E5B68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7205475A-6D04-4042-B24E-1DA5A57029B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"08022987-B36B-4F63-88A5-A8F59195DF4A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"0AA563BF-A67A-477D-956A-167ABEF885C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF4B7557-EF35-451E-B55D-3296966695AC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8980E61E-27BE-4858-82B3-C0E8128AF521\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8756BF9B-3E24-4677-87AE-31CE776541F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"88CE057E-2092-4C98-8D0C-75CF439D0A9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F194580-EE6D-4E38-87F3-F0661262256B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A9731BAA-4C6C-4259-B786-F577D8A90FA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F74A421-D019-4248-84B8-C70D4D9A8A95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BA27FF9-4C66-4E17-95C0-1CB2DAA6AFC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"05346F5A-FB52-4376-AAC7-9A5308216545\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"305688F2-50A6-41FB-8614-BC589DB9A789\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D24AA431-C436-4AA5-85DF-B9AAFF2548FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25966344-15D5-4101-9346-B06BFD2DFFF5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"11F4CBAC-27B1-4EFF-955A-A63B457D0578\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD55B338-9DBE-4643-ABED-A08964D3AF7C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D4F710E-06EA-48F4-AC6A-6F143950F015\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C4936C2-0B2D-4C44-98C3-443090965F5E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"48453405-2319-4327-9F4C-6F70B49452C6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49DD9544-6424-41A6-AEC0-EC19B8A10E71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E4670E65-2E11-49A4-B661-57C2F60D411F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5E8FF71D-4710-4FBB-9925-A6A26C450F7D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31002A23-4788-4BC7-AE11-A3C2AA31716D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7144EDDF-8265-4642-8EEB-ED52527E0A26\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF06B5C1-B9DD-4673-A101-56E1E593ACDD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7D731065-626B-4425-8E49-F708DD457824\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3D850EA-E537-42C8-93B9-96E15CB26747\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E037DA05-2BEF-4F64-B8BB-307247B6A05C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BCAF1EB5-FB34-40FC-96ED-9D073890D8BF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D395D95B-1F4A-420E-A0F6-609360AF7B69\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BD221BA-0AB6-4972-8AD9-5D37AC07762F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E55B6565-96CB-4F6A-9A80-C3FB82F30546\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3300AFE-49A4-4904-B9A0-5679F09FA01E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ED5125CC-05F9-4678-90DB-A5C7CD24AE6F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7BD93669-1B30-4BF8-AD7D-F60DD8D63CC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1B904C74-B92E-4EAE-AE6C-78E2B844C3DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8C8C97F-6C9D-4647-AB8A-ADAA5536DDE2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C6109D1-BC36-40C5-A02A-7AEBC949BAC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA8A7333-B4C3-4876-AE01-62F2FD315504\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"92993E23-D805-407B-8B87-11CEEE8B212F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7A11BD74-305C-41E2-95B1-5008EEF5FA5F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"595442D0-9DB7-475A-AE30-8535B70E122E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4B0BA92A-0BD3-4CE4-9465-95E949104BAC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F944B72-B9EB-4EB8-AEA3-E0D7ADBE1305\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AA28D3A-3EE5-4F90-B8F5-4943F7607DA6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BFD3EB84-2ED2-49D4-8BC9-6398C2E46F0A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEDF6E1A-0DD6-42AB-9510-F6F4B6002C91\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C947E549-2459-4AFB-84A7-36BDA30B5F29\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D55DF79-F9BE-4907-A4D8-96C4B11189ED\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"4752862B-7D26-4285-B8A0-CF082C758353\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*\",\"matchCriteriaId\":\"58EA7199-3373-4F97-9907-3A479A02155E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4693BD36-E522-4C8E-9667-8F3E14A05EF3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BBBC5EA-012C-4C5D-A61B-BAF134B300DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2A358FDF-C249-4D7A-9445-8B9E7D9D40AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AFF96F96-34DB-4EB3-BF59-11220673FA26\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"6.0.39\",\"matchCriteriaId\":\"029C1DD4-3B41-47D2-97D2-73A7D3D89817\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"83BA996F-C770-4E36-8FD8-916EA64E9A34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D11D6FB7-CBDB-48C1-98CB-1B3CAA36C5D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49E3C039-A949-4F1B-892A-57147EECB249\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:*\",\"matchCriteriaId\":\"0A354C34-A3FE-4B8A-9985-8874A0634BC7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F28C7801-41B9-4552-BA1E-577967BCBBEE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:*\",\"matchCriteriaId\":\"CFE300CC-FD4A-444E-8506-E5E269D0A0A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25B21085-7259-4685-9D1F-FF98E6489E10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:*\",\"matchCriteriaId\":\"F50A3EC9-516E-48A7-839B-A73F491B5B9F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C28F09D-5CAA-4CA7-A2B5-3B2820F5F409\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"635EE321-2A1F-4FF8-95BE-0C26591969D9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9A81B035-8598-4D2C-B45F-C6C9D4B10C2F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.4:alpha:*:*:*:*:*:*\",\"matchCriteriaId\":\"FAC2FC75-97D2-4EA1-A1A0-F592A6D7C1F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E1096947-82A6-4EA8-A4F2-00D91E3F7DAF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0EBFA1D3-16A6-4041-BB30-51D2EE0F2AF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.6:alpha:*:*:*:*:*:*\",\"matchCriteriaId\":\"C4871FD1-7F8C-4677-A80B-4A0BBC71DD7C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B70B372F-EFFD-4AF7-99B5-7D1B23A0C54C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.7:alpha:*:*:*:*:*:*\",\"matchCriteriaId\":\"31AB969A-9ACE-44EF-B2E5-CEC008F47C46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.7:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"06217215-72E4-4478-BACB-628A0836A645\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9C95ADA4-66F5-45C4-A677-ACE22367A75A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.8:alpha:*:*:*:*:*:*\",\"matchCriteriaId\":\"EA810F3F-ADD3-4D3F-9DFC-DBDD87B3079C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"11951A10-39A2-4FF5-8C43-DF94730FB794\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.9:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B79F2EA-C893-4359-80EC-24AE38D982E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"351E5BCF-A56B-4D91-BA3C-21A4B77D529A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2DC2BBB4-171E-4EFF-A575-A5B7FF031755\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6B6B0504-27C1-4824-A928-A878CBBAB32D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CE81AD36-ACD1-4C6C-8E7C-5326D1DA3045\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D903956B-14F5-4177-AF12-0A5F1846D3C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"81F847DC-A2F5-456C-9038-16A0E85F4C3B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF3EBD00-1E1E-452D-AFFB-08A6BD111DDD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C6B93A3A-D487-4CA1-8257-26F8FE287B8B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BD8802B2-57E0-4AA6-BC8E-00DE60468569\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8461DF95-18DC-4BF5-A703-7F19DA88DC30\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F4C9BCF-9C73-4991-B02F-E08C5DA06EBA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2823789C-2CB6-4300-94DB-BDBE83ABA8E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C5416C76-46ED-4CB1-A7F8-F24EA16DE7F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A61429EE-4331-430C-9830-58DCCBCBCB58\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31B3593F-CEDF-423C-90F8-F88EED87DC3E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AE7862B2-E1FA-4E16-92CD-8918AB461D9A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A9E03BE3-60CC-4415-B993-D0BB00F87A30\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CE92E59A-FF0D-4D1A-8B12-CC41A7E1FD3C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BFD64FE7-ABAF-49F3-B8D0-91C37C822F4B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"48E5E8C3-21AD-4230-B945-AB7DE66307B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4945C8C1-C71B-448B-9075-07C6C92599CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.36:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ED4730B0-2E09-408B-AFD4-FE00F73700FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8DE8A8A-7643-4292-BCC1-758AE0940207\"}]}]}],\"references\":[{\"url\":\"http://advisories.mageia.org/MGASA-2014-0268.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://linux.oracle.com/errata/ELSA-2014-0865.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=141017844705317\u0026w=2\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=144498216801440\u0026w=2\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0675.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0720.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2015-0765.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://seclists.org/fulldisclosure/2014/Dec/23\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://seclists.org/fulldisclosure/2014/May/135\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/59121\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/59616\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/59678\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/59732\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/59835\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/59849\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/59873\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/60729\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://svn.apache.org/viewvc?view=revision\u0026revision=1578610\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://svn.apache.org/viewvc?view=revision\u0026revision=1578611\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://svn.apache.org/viewvc?view=revision\u0026revision=1578637\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://svn.apache.org/viewvc?view=revision\u0026revision=1578655\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://svn.apache.org/viewvc?view=revision\u0026revision=1585853\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://tomcat.apache.org/security-6.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://tomcat.apache.org/security-7.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://tomcat.apache.org/security-8.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www-01.ibm.com/support/docview.wss?uid=swg21678231\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www-01.ibm.com/support/docview.wss?uid=swg21681528\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.debian.org/security/2016/dsa-3530\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.debian.org/security/2016/dsa-3552\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2015:052\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2015:053\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2015:084\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.novell.com/support/kb/doc.php?id=7010166\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securityfocus.com/archive/1/534161/100/0/threaded\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securityfocus.com/bid/67667\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securitytracker.com/id/1030301\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.vmware.com/security/advisories/VMSA-2014-0012.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"secalert@redhat.com\"}]}}"
}
}
rhsa-2014_0842
Vulnerability from csaf_redhat
Published
2014-07-07 14:49
Modified
2024-11-10 17:24
Summary
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.4 security update
Notes
Topic
An update for Red Hat JBoss Enterprise Application Platform 6.2.4 that
fixes multiple security issues is now available from the Red Hat Customer
Portal.
The Red Hat Security Response Team has rated this update as having Moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat JBoss Enterprise Application Platform 6 is a platform for Java
applications based on JBoss Application Server 7.
It was discovered that JBoss Web did not limit the length of chunk sizes
when using chunked transfer encoding. A remote attacker could use this flaw
to perform a denial of service attack against JBoss Web by streaming an
unlimited quantity of data, leading to excessive consumption of server
resources. (CVE-2014-0075)
It was found that JBoss Web did not check for overflowing values when
parsing request content length headers. A remote attacker could use this
flaw to perform an HTTP request smuggling attack on a JBoss Web server
located behind a reverse proxy that processed the content length header
correctly. (CVE-2014-0099)
It was found that the org.apache.catalina.servlets.DefaultServlet
implementation in JBoss Web allowed the definition of XML External Entities
(XXEs) in provided XSLTs. A malicious application could use this to
circumvent intended security restrictions to disclose sensitive
information. (CVE-2014-0096)
It was found that, in certain circumstances, it was possible for a
malicious web application to replace the XML parsers used by JBoss Web to
process XSLTs for the default servlet, JSP documents, tag library
descriptors (TLDs), and tag plug-in configuration files. The injected XML
parser(s) could then bypass the limits imposed on XML external entities
and/or gain access to the XML files processed for other web applications
deployed on the same JBoss Web instance. (CVE-2014-0119)
The CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product
Security.
All users of Red Hat JBoss Enterprise Application Platform 6.2.4 as
provided from the Red Hat Customer Portal are advised to apply this update.
The JBoss server process must be restarted for the update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat JBoss Enterprise Application Platform 6.2.4 that\nfixes multiple security issues is now available from the Red Hat Customer\nPortal.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Enterprise Application Platform 6 is a platform for Java\napplications based on JBoss Application Server 7.\n\nIt was discovered that JBoss Web did not limit the length of chunk sizes\nwhen using chunked transfer encoding. A remote attacker could use this flaw\nto perform a denial of service attack against JBoss Web by streaming an\nunlimited quantity of data, leading to excessive consumption of server\nresources. (CVE-2014-0075)\n\nIt was found that JBoss Web did not check for overflowing values when\nparsing request content length headers. A remote attacker could use this\nflaw to perform an HTTP request smuggling attack on a JBoss Web server\nlocated behind a reverse proxy that processed the content length header\ncorrectly. (CVE-2014-0099)\n\nIt was found that the org.apache.catalina.servlets.DefaultServlet\nimplementation in JBoss Web allowed the definition of XML External Entities\n(XXEs) in provided XSLTs. A malicious application could use this to\ncircumvent intended security restrictions to disclose sensitive\ninformation. (CVE-2014-0096)\n\nIt was found that, in certain circumstances, it was possible for a\nmalicious web application to replace the XML parsers used by JBoss Web to\nprocess XSLTs for the default servlet, JSP documents, tag library\ndescriptors (TLDs), and tag plug-in configuration files. The injected XML\nparser(s) could then bypass the limits imposed on XML external entities\nand/or gain access to the XML files processed for other web applications\ndeployed on the same JBoss Web instance. (CVE-2014-0119)\n\nThe CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product\nSecurity.\n\nAll users of Red Hat JBoss Enterprise Application Platform 6.2.4 as\nprovided from the Red Hat Customer Portal are advised to apply this update.\nThe JBoss server process must be restarted for the update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0842",
"url": "https://access.redhat.com/errata/RHSA-2014:0842"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform\u0026downloadType=securityPatches\u0026version=6.2.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform\u0026downloadType=securityPatches\u0026version=6.2.0"
},
{
"category": "external",
"summary": "1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0842.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.4 security update",
"tracking": {
"current_release_date": "2024-11-10T17:24:51+00:00",
"generator": {
"date": "2024-11-10T17:24:51+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2014:0842",
"initial_release_date": "2014-07-07T14:49:59+00:00",
"revision_history": [
{
"date": "2014-07-07T14:49:59+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:33:27+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-10T17:24:51+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Application Platform 6.2",
"product": {
"name": "Red Hat JBoss Enterprise Application Platform 6.2",
"product_id": "Red Hat JBoss Enterprise Application Platform 6.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6.2.4"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Enterprise Application Platform"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0075",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1072776"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0075"
},
{
"category": "external",
"summary": "RHBZ#1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-07T14:49:59+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting Red Hat JBoss Enterprise Application Platform installation and\ndeployed applications.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0842"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter"
},
{
"cve": "CVE-2014-0096",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1088342"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0096"
},
{
"category": "external",
"summary": "RHBZ#1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-07T14:49:59+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting Red Hat JBoss Enterprise Application Platform installation and\ndeployed applications.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0842"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs"
},
{
"cve": "CVE-2014-0099",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102030"
}
],
"notes": [
{
"category": "description",
"text": "It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Request smuggling via malicious content length header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0099"
},
{
"category": "external",
"summary": "RHBZ#1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-07T14:49:59+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting Red Hat JBoss Enterprise Application Platform installation and\ndeployed applications.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0842"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Request smuggling via malicious content length header"
},
{
"cve": "CVE-2014-0119",
"cwe": {
"id": "CWE-470",
"name": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102038"
}
],
"notes": [
{
"category": "description",
"text": "It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XML parser hijack by malicious web application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0119"
},
{
"category": "external",
"summary": "RHBZ#1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0119",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0119"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-07T14:49:59+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting Red Hat JBoss Enterprise Application Platform installation and\ndeployed applications.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0842"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XML parser hijack by malicious web application"
}
]
}
rhsa-2014_0865
Vulnerability from csaf_redhat
Published
2014-07-09 15:16
Modified
2024-11-10 17:24
Summary
Red Hat Security Advisory: tomcat6 security and bug fix update
Notes
Topic
Updated tomcat6 packages that fix three security issues and two bugs are
now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having Moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Apache Tomcat is a servlet container for the Java Servlet and JavaServer
Pages (JSP) technologies.
It was discovered that Apache Tomcat did not limit the length of chunk
sizes when using chunked transfer encoding. A remote attacker could use
this flaw to perform a denial of service attack against Tomcat by streaming
an unlimited quantity of data, leading to excessive consumption of server
resources. (CVE-2014-0075)
It was found that Apache Tomcat did not check for overflowing values when
parsing request content length headers. A remote attacker could use this
flaw to perform an HTTP request smuggling attack on a Tomcat server located
behind a reverse proxy that processed the content length header correctly.
(CVE-2014-0099)
It was found that the org.apache.catalina.servlets.DefaultServlet
implementation in Apache Tomcat allowed the definition of XML External
Entities (XXEs) in provided XSLTs. A malicious application could use this
to circumvent intended security restrictions to disclose sensitive
information. (CVE-2014-0096)
The CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product
Security.
This update also fixes the following bugs:
* The patch that resolved the CVE-2014-0050 issue contained redundant code.
This update removes the redundant code. (BZ#1094528)
* The patch that resolved the CVE-2013-4322 issue contained an invalid
check that triggered a java.io.EOFException while reading trailer headers
for chunked requests. This update fixes the check and the aforementioned
exception is no longer triggered in the described scenario. (BZ#1095602)
All Tomcat 6 users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues. Tomcat must be
restarted for this update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated tomcat6 packages that fix three security issues and two bugs are\nnow available for Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer\nPages (JSP) technologies.\n\nIt was discovered that Apache Tomcat did not limit the length of chunk\nsizes when using chunked transfer encoding. A remote attacker could use\nthis flaw to perform a denial of service attack against Tomcat by streaming\nan unlimited quantity of data, leading to excessive consumption of server\nresources. (CVE-2014-0075)\n\nIt was found that Apache Tomcat did not check for overflowing values when\nparsing request content length headers. A remote attacker could use this\nflaw to perform an HTTP request smuggling attack on a Tomcat server located\nbehind a reverse proxy that processed the content length header correctly.\n(CVE-2014-0099)\n\nIt was found that the org.apache.catalina.servlets.DefaultServlet\nimplementation in Apache Tomcat allowed the definition of XML External\nEntities (XXEs) in provided XSLTs. A malicious application could use this\nto circumvent intended security restrictions to disclose sensitive\ninformation. (CVE-2014-0096)\n\nThe CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product\nSecurity.\n\nThis update also fixes the following bugs:\n\n* The patch that resolved the CVE-2014-0050 issue contained redundant code.\nThis update removes the redundant code. (BZ#1094528)\n\n* The patch that resolved the CVE-2013-4322 issue contained an invalid\ncheck that triggered a java.io.EOFException while reading trailer headers\nfor chunked requests. This update fixes the check and the aforementioned\nexception is no longer triggered in the described scenario. (BZ#1095602)\n\nAll Tomcat 6 users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues. Tomcat must be\nrestarted for this update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0865",
"url": "https://access.redhat.com/errata/RHSA-2014:0865"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-6.html",
"url": "https://tomcat.apache.org/security-6.html"
},
{
"category": "external",
"summary": "1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "1095602",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1095602"
},
{
"category": "external",
"summary": "1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0865.json"
}
],
"title": "Red Hat Security Advisory: tomcat6 security and bug fix update",
"tracking": {
"current_release_date": "2024-11-10T17:24:15+00:00",
"generator": {
"date": "2024-11-10T17:24:15+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2014:0865",
"initial_release_date": "2014-07-09T15:16:10+00:00",
"revision_history": [
{
"date": "2014-07-09T15:16:10+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2014-07-09T15:16:10+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-10T17:24:15+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server Optional (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::workstation"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::workstation"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat6-0:6.0.24-72.el6_5.src",
"product": {
"name": "tomcat6-0:6.0.24-72.el6_5.src",
"product_id": "tomcat6-0:6.0.24-72.el6_5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6@6.0.24-72.el6_5?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat6-0:6.0.24-72.el6_5.noarch",
"product": {
"name": "tomcat6-0:6.0.24-72.el6_5.noarch",
"product_id": "tomcat6-0:6.0.24-72.el6_5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6@6.0.24-72.el6_5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"product": {
"name": "tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"product_id": "tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-lib@6.0.24-72.el6_5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"product": {
"name": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"product_id": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-servlet-2.5-api@6.0.24-72.el6_5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"product": {
"name": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"product_id": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-jsp-2.1-api@6.0.24-72.el6_5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"product": {
"name": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"product_id": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-el-2.1-api@6.0.24-72.el6_5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"product": {
"name": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"product_id": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-webapps@6.0.24-72.el6_5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"product": {
"name": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"product_id": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-javadoc@6.0.24-72.el6_5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"product": {
"name": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"product_id": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-docs-webapp@6.0.24-72.el6_5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"product": {
"name": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"product_id": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-admin-webapps@6.0.24-72.el6_5?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Client-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.src as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.src",
"relates_to_product_reference": "6Client-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Client-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Client-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Client-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Client-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Client-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-lib-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Client-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Client-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Client-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6ComputeNode-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.src as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.src",
"relates_to_product_reference": "6ComputeNode-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6ComputeNode-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6ComputeNode-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6ComputeNode-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6ComputeNode-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6ComputeNode-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-lib-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6ComputeNode-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6ComputeNode-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6ComputeNode-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.src as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.src"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.src",
"relates_to_product_reference": "6Server-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-lib-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.src as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.src",
"relates_to_product_reference": "6Server-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-lib-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.src as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.src"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.src",
"relates_to_product_reference": "6Workstation-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-lib-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.src",
"relates_to_product_reference": "6Workstation-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-lib-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-optional-6.5.z"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0075",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1072776"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0075"
},
{
"category": "external",
"summary": "RHBZ#1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-09T15:16:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0865"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter"
},
{
"cve": "CVE-2014-0096",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1088342"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0096"
},
{
"category": "external",
"summary": "RHBZ#1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-09T15:16:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0865"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs"
},
{
"cve": "CVE-2014-0099",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102030"
}
],
"notes": [
{
"category": "description",
"text": "It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Request smuggling via malicious content length header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0099"
},
{
"category": "external",
"summary": "RHBZ#1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-09T15:16:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0865"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Request smuggling via malicious content length header"
}
]
}
rhsa-2015_0234
Vulnerability from csaf_redhat
Published
2015-02-17 22:27
Modified
2024-11-14 14:33
Summary
Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.0.3 security update
Notes
Topic
Red Hat JBoss BPM Suite 6.0.3 roll up patch 2, which fixes multiple
security issues, several bugs, and adds various enhancements, is now
available from the Red Hat Customer Portal.
Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Red Hat JBoss BPM Suite is a business rules and processes management system
for the management, storage, creation, modification, and deployment of
JBoss rules and BPMN2-compliant business processes.
This roll up patch serves as a cumulative upgrade for Red Hat JBoss BPM
Suite 6.0.3, and includes bug fixes and enhancements. It includes various
bug fixes, which are listed in the README file included with the patch
files.
The following security issues are also fixed with this release,
descriptions of which can be found on the respective CVE pages linked in
the References section.
CVE-2012-6153 Apache HttpComponents client: SSL hostname verification
bypass, incomplete CVE-2012-5783 fix
CVE-2014-3577 Apache HttpComponents client: SSL hostname verification
bypass, incomplete CVE-2012-6153 fix
CVE-2013-4002 xerces-j2: Xerces-J2 OpenJDK: XML parsing Denial of Service
(JAXP, 8017298)
CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of
user-supplied content in outputText tags and EL expressions
CVE-2014-0005 security: PicketBox/JBossSX: Unauthorized access to and
modification of application server configuration and state by application
CVE-2014-0075 jbossweb: tomcat: Limited DoS in chunked transfer encoding
input filter
CVE-2014-0096 jbossweb: Apache Tomcat: XXE vulnerability via user supplied
XSLTs
CVE-2014-0099 jbossweb: Apache Tomcat: Request smuggling via malicious
content length header
CVE-2014-0119 jbossweb: Apache Tomcat 6: XML parser hijack by malicious web
application
CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation
CVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter
CVE-2014-3472 jboss-as-controller: JBoss AS Security: Invalid EJB caller
role check implementation
CVE-2014-3490 RESTEasy: XXE via parameter entities
CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage
CVE-2014-3558 hibernate-validator: Hibernate Validator: JSM bypass via
ReflectionHelper
CVE-2014-3578 spring: Spring Framework: Directory traversal
CVE-2014-3625 spring: Spring Framework: directory traversal flaw
CVE-2014-3682 jbpm-designer: XXE in BPMN2 import
CVE-2014-8114 UberFire: Information disclosure and RCE via insecure file
upload/download servlets
CVE-2014-8115 KIE Workbench: Insufficient authorization constraints
Red Hat would like to thank James Roper of Typesafe for reporting the
CVE-2014-0193 issue, CA Technologies for reporting the CVE-2014-3472 issue,
Alexander Papadakis for reporting the CVE-2014-3530 issue, and David Jorm
for reporting the CVE-2014-8114 and CVE-2014-8115 issues. The CVE-2012-6153
issue was discovered by Florian Weimer of Red Hat Product Security; the
CVE-2014-0005 issue was discovered by Josef Cacek of the Red Hat JBoss EAP
Quality Engineering team; the CVE-2014-0075, CVE-2014-3490, and
CVE-2014-3682 issues were discovered by David Jorm of Red Hat Product
Security.
All users of Red Hat JBoss BPM Suite 6.0.3 as provided from the Red Hat
Customer Portal are advised to apply this roll up patch.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss BPM Suite 6.0.3 roll up patch 2, which fixes multiple\nsecurity issues, several bugs, and adds various enhancements, is now\navailable from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss BPM Suite is a business rules and processes management system\nfor the management, storage, creation, modification, and deployment of\nJBoss rules and BPMN2-compliant business processes.\n\nThis roll up patch serves as a cumulative upgrade for Red Hat JBoss BPM\nSuite 6.0.3, and includes bug fixes and enhancements. It includes various\nbug fixes, which are listed in the README file included with the patch\nfiles.\n\nThe following security issues are also fixed with this release,\ndescriptions of which can be found on the respective CVE pages linked in\nthe References section.\n\nCVE-2012-6153 Apache HttpComponents client: SSL hostname verification\nbypass, incomplete CVE-2012-5783 fix\n\nCVE-2014-3577 Apache HttpComponents client: SSL hostname verification\nbypass, incomplete CVE-2012-6153 fix\n\nCVE-2013-4002 xerces-j2: Xerces-J2 OpenJDK: XML parsing Denial of Service\n(JAXP, 8017298)\n\nCVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of\nuser-supplied content in outputText tags and EL expressions\n\nCVE-2014-0005 security: PicketBox/JBossSX: Unauthorized access to and\nmodification of application server configuration and state by application\n\nCVE-2014-0075 jbossweb: tomcat: Limited DoS in chunked transfer encoding\ninput filter\n\nCVE-2014-0096 jbossweb: Apache Tomcat: XXE vulnerability via user supplied\nXSLTs\n\nCVE-2014-0099 jbossweb: Apache Tomcat: Request smuggling via malicious\ncontent length header\n\nCVE-2014-0119 jbossweb: Apache Tomcat 6: XML parser hijack by malicious web\napplication\n\nCVE-2014-0193 netty: DoS via memory exhaustion during data aggregation\n\nCVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter\n\nCVE-2014-3472 jboss-as-controller: JBoss AS Security: Invalid EJB caller\nrole check implementation\n\nCVE-2014-3490 RESTEasy: XXE via parameter entities\n\nCVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage\n\nCVE-2014-3558 hibernate-validator: Hibernate Validator: JSM bypass via\nReflectionHelper\n\nCVE-2014-3578 spring: Spring Framework: Directory traversal\n\nCVE-2014-3625 spring: Spring Framework: directory traversal flaw\n\nCVE-2014-3682 jbpm-designer: XXE in BPMN2 import\n\nCVE-2014-8114 UberFire: Information disclosure and RCE via insecure file\nupload/download servlets\n\nCVE-2014-8115 KIE Workbench: Insufficient authorization constraints\n\nRed Hat would like to thank James Roper of Typesafe for reporting the\nCVE-2014-0193 issue, CA Technologies for reporting the CVE-2014-3472 issue,\nAlexander Papadakis for reporting the CVE-2014-3530 issue, and David Jorm\nfor reporting the CVE-2014-8114 and CVE-2014-8115 issues. The CVE-2012-6153\nissue was discovered by Florian Weimer of Red Hat Product Security; the\nCVE-2014-0005 issue was discovered by Josef Cacek of the Red Hat JBoss EAP\nQuality Engineering team; the CVE-2014-0075, CVE-2014-3490, and\nCVE-2014-3682 issues were discovered by David Jorm of Red Hat Product\nSecurity.\n\nAll users of Red Hat JBoss BPM Suite 6.0.3 as provided from the Red Hat\nCustomer Portal are advised to apply this roll up patch.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:0234",
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=distributions\u0026version=6.0.3",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=distributions\u0026version=6.0.3"
},
{
"category": "external",
"summary": "1019176",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1019176"
},
{
"category": "external",
"summary": "1049736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049736"
},
{
"category": "external",
"summary": "1065139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
},
{
"category": "external",
"summary": "1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "1103815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103815"
},
{
"category": "external",
"summary": "1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "external",
"summary": "1120495",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120495"
},
{
"category": "external",
"summary": "1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "1131882",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131882"
},
{
"category": "external",
"summary": "1148260",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1148260"
},
{
"category": "external",
"summary": "1165936",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1165936"
},
{
"category": "external",
"summary": "1169544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1169544"
},
{
"category": "external",
"summary": "1169545",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1169545"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0234.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.0.3 security update",
"tracking": {
"current_release_date": "2024-11-14T14:33:40+00:00",
"generator": {
"date": "2024-11-14T14:33:40+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2015:0234",
"initial_release_date": "2015-02-17T22:27:47+00:00",
"revision_history": [
{
"date": "2015-02-17T22:27:47+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:35:14+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T14:33:40+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss BPMS 6.0",
"product": {
"name": "Red Hat JBoss BPMS 6.0",
"product_id": "Red Hat JBoss BPMS 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_bpms:6.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Process Automation Manager"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Florian Weimer"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2012-6153",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2012-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129916"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-6153"
},
{
"category": "external",
"summary": "RHBZ#1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
}
],
"release_date": "2014-08-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
},
{
"cve": "CVE-2013-4002",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2013-10-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1019176"
}
],
"notes": [
{
"category": "description",
"text": "A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: XML parsing Denial of Service (JAXP, 8017298)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Fuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Server 4 and 5; Red Hat JBoss Enterprise Web Platform 5; Red Hat JBoss SOA Platform 4 and 5; and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4002"
},
{
"category": "external",
"summary": "RHBZ#1019176",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1019176"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4002",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html"
}
],
"release_date": "2013-10-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: XML parsing Denial of Service (JAXP, 8017298)"
},
{
"cve": "CVE-2013-5855",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2014-02-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1065139"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Mojarra JavaServer Faces did not properly escape user-supplied content in certain circumstances. Contents of outputText tags and raw EL expressions that immediately follow script or style elements were not escaped. A remote attacker could use a specially crafted URL to execute arbitrary web script in the user\u0027s browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-5855"
},
{
"category": "external",
"summary": "RHBZ#1065139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-5855",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5855"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855"
},
{
"category": "external",
"summary": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209",
"url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209"
}
],
"release_date": "2014-02-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions"
},
{
"acknowledgments": [
{
"names": [
"Josef Cacek"
],
"organization": "Red Hat JBoss EAP Quality Engineering team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0005",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2014-01-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049736"
}
],
"notes": [
{
"category": "description",
"text": "It was identified that PicketBox/JBossSX allowed any deployed application to alter or read the underlying application server configuration and state without any authorization checks. An attacker able to deploy applications could use this flaw to circumvent security constraints applied to other applications deployed on the same system, disclose privileged information, and in certain cases allow arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0005"
},
{
"category": "external",
"summary": "RHBZ#1049736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0005",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0005"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0005",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0005"
}
],
"release_date": "2014-03-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 3.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0075",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1072776"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0075"
},
{
"category": "external",
"summary": "RHBZ#1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter"
},
{
"cve": "CVE-2014-0096",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1088342"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0096"
},
{
"category": "external",
"summary": "RHBZ#1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs"
},
{
"cve": "CVE-2014-0099",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102030"
}
],
"notes": [
{
"category": "description",
"text": "It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Request smuggling via malicious content length header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0099"
},
{
"category": "external",
"summary": "RHBZ#1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Request smuggling via malicious content length header"
},
{
"cve": "CVE-2014-0119",
"cwe": {
"id": "CWE-470",
"name": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102038"
}
],
"notes": [
{
"category": "description",
"text": "It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XML parser hijack by malicious web application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0119"
},
{
"category": "external",
"summary": "RHBZ#1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0119",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0119"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XML parser hijack by malicious web application"
},
{
"acknowledgments": [
{
"names": [
"James Roper"
],
"organization": "Typesafe"
}
],
"cve": "CVE-2014-0193",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-04-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1092783"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: DoS via memory exhaustion during data aggregation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0193"
},
{
"category": "external",
"summary": "RHBZ#1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0193",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193"
}
],
"release_date": "2014-05-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "netty: DoS via memory exhaustion during data aggregation"
},
{
"cve": "CVE-2014-0227",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109196"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0227"
},
{
"category": "external",
"summary": "RHBZ#1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0227",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43",
"url": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55",
"url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55"
}
],
"release_date": "2015-02-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter"
},
{
"acknowledgments": [
{
"names": [
"CA Technologies"
]
}
],
"cve": "CVE-2014-3472",
"cwe": {
"id": "CWE-184",
"name": "Incomplete List of Disallowed Inputs"
},
"discovery_date": "2014-05-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1103815"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the isCallerInRole() method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Security: Invalid EJB caller role check implementation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3472"
},
{
"category": "external",
"summary": "RHBZ#1103815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3472",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3472"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3472",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3472"
}
],
"release_date": "2014-08-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Security: Invalid EJB caller role check implementation"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3490",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1107901"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTEasy: XXE via parameter entities",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3490"
},
{
"category": "external",
"summary": "RHBZ#1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3490",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3490"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490"
}
],
"release_date": "2014-07-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTEasy: XXE via parameter entities"
},
{
"acknowledgments": [
{
"names": [
"Alexander Papadakis"
]
}
],
"cve": "CVE-2014-3530",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1112987"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "PicketLink: XXE via insecure DocumentBuilderFactory usage",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw could allow remote, unauthenticated attackers to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. All systems hosting PicketLink applications using SAML Identity Providers and Service Providers may be affected. It is strongly advised that anyone running an affected system applies patches to address this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3530"
},
{
"category": "external",
"summary": "RHBZ#1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3530",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3530"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530"
}
],
"release_date": "2014-07-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "PicketLink: XXE via insecure DocumentBuilderFactory usage"
},
{
"cve": "CVE-2014-3558",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"discovery_date": "2014-07-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1120495"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the implementation of org.hibernate.validator.util.ReflectionHelper together with the permissions required to run Hibernate Validator under the Java Security Manager could allow a malicious application deployed in the same application container to execute several actions with escalated privileges, which might otherwise not be possible. This flaw could be used to perform various attacks, including but not restricted to, arbitrary code execution in systems that are otherwise secured by the Java Security Manager.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Validator: JSM bypass via ReflectionHelper",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3558"
},
{
"category": "external",
"summary": "RHBZ#1120495",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120495"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3558",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3558"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3558",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3558"
}
],
"release_date": "2014-07-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Validator: JSM bypass via ReflectionHelper"
},
{
"cve": "CVE-2014-3577",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2014-08-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129074"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3577"
},
{
"category": "external",
"summary": "RHBZ#1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
}
],
"release_date": "2014-08-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
},
{
"cve": "CVE-2014-3578",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2014-08-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1131882"
}
],
"notes": [
{
"category": "description",
"text": "A directory traversal flaw was found in the Spring Framework. A remote attacker could use this flaw to access arbitrary files on a server, and bypassing security restrictions that are otherwise in place.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Framework: Directory traversal",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3578"
},
{
"category": "external",
"summary": "RHBZ#1131882",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131882"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3578",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3578"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3578",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3578"
},
{
"category": "external",
"summary": "http://www.pivotal.io/security/cve-2014-3578",
"url": "http://www.pivotal.io/security/cve-2014-3578"
},
{
"category": "external",
"summary": "https://jvn.jp/en/jp/JVN49154900/",
"url": "https://jvn.jp/en/jp/JVN49154900/"
}
],
"release_date": "2014-09-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Framework: Directory traversal"
},
{
"cve": "CVE-2014-3625",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2014-11-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1165936"
}
],
"notes": [
{
"category": "description",
"text": "A directory traversal flaw was found in the way the Spring Framework sanitized certain URLs. A remote attacker could use this flaw to obtain any file on the file system that was also accessible to the process in which the Spring web application was running.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Framework: directory traversal flaw",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3625"
},
{
"category": "external",
"summary": "RHBZ#1165936",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1165936"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3625",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3625"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3625",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3625"
}
],
"release_date": "2014-11-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Framework: directory traversal flaw"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3682",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-10-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1148260"
}
],
"notes": [
{
"category": "description",
"text": "An XML External Entity (XXE) flaw was found in the jbpm-designer BPMN2 import function. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jbpm-designer: XXE in BPMN2 import",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3682"
},
{
"category": "external",
"summary": "RHBZ#1148260",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1148260"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3682",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3682"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3682",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3682"
}
],
"release_date": "2015-02-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jbpm-designer: XXE in BPMN2 import"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
]
}
],
"cve": "CVE-2014-8114",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2014-11-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1169544"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the default implementation of FileUploadServlet and FileDownloadServlet provided by the UberFire Framework did not restrict the paths to which a file could be written or read from. In applications using this framework and exposing these servlets, a remote attacker could gain access to information stored in files accessible to the application container process, or execute arbitrary code by uploading malicious content.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "UberFire: Information disclosure and RCE via insecure file upload/download servlets",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-8114"
},
{
"category": "external",
"summary": "RHBZ#1169544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1169544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-8114",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-8114"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-8114",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8114"
}
],
"release_date": "2015-02-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "UberFire: Information disclosure and RCE via insecure file upload/download servlets"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
]
}
],
"cve": "CVE-2014-8115",
"cwe": {
"id": "CWE-285",
"name": "Improper Authorization"
},
"discovery_date": "2014-11-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1169545"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the default authorization constrains applied on servelets deployed in the KIE Workbench application were insufficient. A remote, authenticated user without sufficient privileges could use this flaw to upload or download arbitrary files, perform privileged actions that otherwise cannot be accessed, or perform other more complex attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Workbench: Insufficient authorization constraints",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat JBoss BRMS 5 is now in Phase 3, Extended Life Support, of its life cycle. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-8115"
},
{
"category": "external",
"summary": "RHBZ#1169545",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1169545"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-8115",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-8115"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-8115",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8115"
}
],
"release_date": "2015-02-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:47+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0234"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Workbench: Insufficient authorization constraints"
}
]
}
rhsa-2015_0720
Vulnerability from csaf_redhat
Published
2015-03-24 21:05
Modified
2024-11-14 14:33
Summary
Red Hat Security Advisory: Red Hat JBoss Fuse Service Works 6.0.0 security update
Notes
Topic
Red Hat JBoss Fuse Service Works 6.0.0 roll up patch 4, which fixes
multiple security issues and various bugs, is now available from the Red
Hat Customer Portal.
Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Red Hat JBoss Fuse Service Works is the next-generation ESB and business
process automation infrastructure.
This roll up patch serves as a cumulative upgrade for Red Hat JBoss Fuse
Service Works 6.0.0. It includes various bug fixes, which are listed in the
README file included with the patch files.
The following security issues are also fixed with this release,
descriptions of which can be found on the respective CVE pages linked in
the References section.
CVE-2012-6153 Apache HttpComponents client: SSL hostname verification
bypass, incomplete CVE-2012-5783 fix
CVE-2014-3577 Apache HttpComponents client: SSL hostname verification
bypass, incomplete CVE-2012-6153 fix
CVE-2014-3625 spring: Spring Framework: directory traversal flaw
CVE-2014-3578 spring: Spring Framework: Directory traversal
CVE-2014-3558 hibernate-validator: Hibernate Validator: JSM bypass via
ReflectionHelper
CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage
CVE-2014-3490 RESTEasy: XXE via parameter entities
CVE-2014-3481 jboss-as-jaxrs: JBoss AS JAX-RS: Information disclosure via
XML eXternal Entity (XXE)
CVE-2014-3472 jboss-as-controller: JBoss AS Security: Invalid EJB caller
role check implementation
CVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding
input filter
CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation
CVE-2014-0119 jbossweb: Apache Tomcat 6: XML parser hijack by malicious web
application
CVE-2014-0099 jbossweb: Apache Tomcat: Request smuggling via malicious
content length header
CVE-2014-0096 jbossweb: Apache Tomcat: XXE vulnerability via user supplied
XSLTs
CVE-2014-0075 jbossweb: tomcat: Limited DoS in chunked transfer encoding
input filter
CVE-2014-0005 security: PicketBox/JBossSX: Unauthorized access to and
modification of application server configuration and state by application
CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of
user-supplied content in outputText tags and EL expressions
CVE-2013-4002 xerces-j2: Xerces-J2 OpenJDK: XML parsing Denial of Service
(JAXP, 8017298)
Red Hat would like to thank James Roper of Typesafe for reporting the
CVE-2014-0193 issue; CA Technologies for reporting the CVE-2014-3472
issue; and Alexander Papadakis for reporting the CVE-2014-3530 issue. The
CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat Product
Security; the CVE-2014-0005 issue was discovered by Josef Cacek of the Red
Hat JBoss EAP Quality Engineering team; the CVE-2014-3481 issue was
discovered by the Red Hat JBoss Enterprise Application Platform QE team;
and the CVE-2014-0075 and CVE-2014-3490 issues were discovered by David
Jorm of Red Hat Product Security.
All users of Red Hat JBoss Fuse Service Works 6.0.0 as provided from the
Red Hat Customer Portal are advised to apply this roll up patch.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Fuse Service Works 6.0.0 roll up patch 4, which fixes\nmultiple security issues and various bugs, is now available from the Red\nHat Customer Portal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Fuse Service Works is the next-generation ESB and business\nprocess automation infrastructure.\n\nThis roll up patch serves as a cumulative upgrade for Red Hat JBoss Fuse\nService Works 6.0.0. It includes various bug fixes, which are listed in the\nREADME file included with the patch files.\n\nThe following security issues are also fixed with this release,\ndescriptions of which can be found on the respective CVE pages linked in\nthe References section.\n\nCVE-2012-6153 Apache HttpComponents client: SSL hostname verification\nbypass, incomplete CVE-2012-5783 fix\n\nCVE-2014-3577 Apache HttpComponents client: SSL hostname verification\nbypass, incomplete CVE-2012-6153 fix\n\nCVE-2014-3625 spring: Spring Framework: directory traversal flaw\n\nCVE-2014-3578 spring: Spring Framework: Directory traversal\n\nCVE-2014-3558 hibernate-validator: Hibernate Validator: JSM bypass via\nReflectionHelper\n\nCVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage\n\nCVE-2014-3490 RESTEasy: XXE via parameter entities\n\nCVE-2014-3481 jboss-as-jaxrs: JBoss AS JAX-RS: Information disclosure via\nXML eXternal Entity (XXE)\n\nCVE-2014-3472 jboss-as-controller: JBoss AS Security: Invalid EJB caller\nrole check implementation\n\nCVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding\ninput filter\n\nCVE-2014-0193 netty: DoS via memory exhaustion during data aggregation\n\nCVE-2014-0119 jbossweb: Apache Tomcat 6: XML parser hijack by malicious web\napplication\n\nCVE-2014-0099 jbossweb: Apache Tomcat: Request smuggling via malicious\ncontent length header\n\nCVE-2014-0096 jbossweb: Apache Tomcat: XXE vulnerability via user supplied\nXSLTs\n\nCVE-2014-0075 jbossweb: tomcat: Limited DoS in chunked transfer encoding\ninput filter\n\nCVE-2014-0005 security: PicketBox/JBossSX: Unauthorized access to and\nmodification of application server configuration and state by application\n\nCVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of\nuser-supplied content in outputText tags and EL expressions\n\nCVE-2013-4002 xerces-j2: Xerces-J2 OpenJDK: XML parsing Denial of Service\n(JAXP, 8017298)\n\nRed Hat would like to thank James Roper of Typesafe for reporting the\nCVE-2014-0193 issue; CA Technologies for reporting the CVE-2014-3472\nissue; and Alexander Papadakis for reporting the CVE-2014-3530 issue. The\nCVE-2012-6153 issue was discovered by Florian Weimer of Red Hat Product\nSecurity; the CVE-2014-0005 issue was discovered by Josef Cacek of the Red\nHat JBoss EAP Quality Engineering team; the CVE-2014-3481 issue was\ndiscovered by the Red Hat JBoss Enterprise Application Platform QE team;\nand the CVE-2014-0075 and CVE-2014-3490 issues were discovered by David\nJorm of Red Hat Product Security.\n\nAll users of Red Hat JBoss Fuse Service Works 6.0.0 as provided from the\nRed Hat Customer Portal are advised to apply this roll up patch.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:0720",
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse.serviceworks\u0026downloadType=securityPatches\u0026version=6.0.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse.serviceworks\u0026downloadType=securityPatches\u0026version=6.0.0"
},
{
"category": "external",
"summary": "1019176",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1019176"
},
{
"category": "external",
"summary": "1049736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049736"
},
{
"category": "external",
"summary": "1065139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
},
{
"category": "external",
"summary": "1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "1103815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103815"
},
{
"category": "external",
"summary": "1105242",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1105242"
},
{
"category": "external",
"summary": "1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "external",
"summary": "1120495",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120495"
},
{
"category": "external",
"summary": "1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "1131882",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131882"
},
{
"category": "external",
"summary": "1165936",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1165936"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0720.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Fuse Service Works 6.0.0 security update",
"tracking": {
"current_release_date": "2024-11-14T14:33:43+00:00",
"generator": {
"date": "2024-11-14T14:33:43+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2015:0720",
"initial_release_date": "2015-03-24T21:05:53+00:00",
"revision_history": [
{
"date": "2015-03-24T21:05:53+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:36:11+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T14:33:43+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Fuse Service Works 6.0",
"product": {
"name": "Red Hat JBoss Fuse Service Works 6.0",
"product_id": "Red Hat JBoss Fuse Service Works 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_fuse_service_works:6.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Fuse Service Works"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Florian Weimer"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2012-6153",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2012-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129916"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-6153"
},
{
"category": "external",
"summary": "RHBZ#1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
}
],
"release_date": "2014-08-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
},
{
"cve": "CVE-2013-4002",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2013-10-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1019176"
}
],
"notes": [
{
"category": "description",
"text": "A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: XML parsing Denial of Service (JAXP, 8017298)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Fuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Server 4 and 5; Red Hat JBoss Enterprise Web Platform 5; Red Hat JBoss SOA Platform 4 and 5; and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4002"
},
{
"category": "external",
"summary": "RHBZ#1019176",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1019176"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4002",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html"
}
],
"release_date": "2013-10-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: XML parsing Denial of Service (JAXP, 8017298)"
},
{
"cve": "CVE-2013-5855",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2014-02-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1065139"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Mojarra JavaServer Faces did not properly escape user-supplied content in certain circumstances. Contents of outputText tags and raw EL expressions that immediately follow script or style elements were not escaped. A remote attacker could use a specially crafted URL to execute arbitrary web script in the user\u0027s browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-5855"
},
{
"category": "external",
"summary": "RHBZ#1065139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-5855",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5855"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855"
},
{
"category": "external",
"summary": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209",
"url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209"
}
],
"release_date": "2014-02-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions"
},
{
"acknowledgments": [
{
"names": [
"Josef Cacek"
],
"organization": "Red Hat JBoss EAP Quality Engineering team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0005",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2014-01-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049736"
}
],
"notes": [
{
"category": "description",
"text": "It was identified that PicketBox/JBossSX allowed any deployed application to alter or read the underlying application server configuration and state without any authorization checks. An attacker able to deploy applications could use this flaw to circumvent security constraints applied to other applications deployed on the same system, disclose privileged information, and in certain cases allow arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0005"
},
{
"category": "external",
"summary": "RHBZ#1049736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0005",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0005"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0005",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0005"
}
],
"release_date": "2014-03-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 3.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0075",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1072776"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0075"
},
{
"category": "external",
"summary": "RHBZ#1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter"
},
{
"cve": "CVE-2014-0096",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1088342"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0096"
},
{
"category": "external",
"summary": "RHBZ#1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs"
},
{
"cve": "CVE-2014-0099",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102030"
}
],
"notes": [
{
"category": "description",
"text": "It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Request smuggling via malicious content length header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0099"
},
{
"category": "external",
"summary": "RHBZ#1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Request smuggling via malicious content length header"
},
{
"cve": "CVE-2014-0119",
"cwe": {
"id": "CWE-470",
"name": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102038"
}
],
"notes": [
{
"category": "description",
"text": "It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XML parser hijack by malicious web application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0119"
},
{
"category": "external",
"summary": "RHBZ#1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0119",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0119"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XML parser hijack by malicious web application"
},
{
"acknowledgments": [
{
"names": [
"James Roper"
],
"organization": "Typesafe"
}
],
"cve": "CVE-2014-0193",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-04-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1092783"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: DoS via memory exhaustion during data aggregation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0193"
},
{
"category": "external",
"summary": "RHBZ#1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0193",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193"
}
],
"release_date": "2014-05-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "netty: DoS via memory exhaustion during data aggregation"
},
{
"cve": "CVE-2014-0227",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109196"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0227"
},
{
"category": "external",
"summary": "RHBZ#1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0227",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43",
"url": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55",
"url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55"
}
],
"release_date": "2015-02-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter"
},
{
"acknowledgments": [
{
"names": [
"CA Technologies"
]
}
],
"cve": "CVE-2014-3472",
"cwe": {
"id": "CWE-184",
"name": "Incomplete List of Disallowed Inputs"
},
"discovery_date": "2014-05-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1103815"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the isCallerInRole() method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Security: Invalid EJB caller role check implementation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3472"
},
{
"category": "external",
"summary": "RHBZ#1103815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3472",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3472"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3472",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3472"
}
],
"release_date": "2014-08-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Security: Invalid EJB caller role check implementation"
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3481",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1105242"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the default context parameters as provided to RESTEasy deployments by JBoss EAP did not explicitly disable external entity expansion for RESTEasy. A remote attacker could use this flaw to perform XML External Entity (XXE) attacks on RESTEasy applications accepting XML input.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JAX-RS: Information disclosure via XML eXternal Entity (XXE)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3481"
},
{
"category": "external",
"summary": "RHBZ#1105242",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1105242"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3481",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3481"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3481",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3481"
}
],
"release_date": "2014-06-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "JAX-RS: Information disclosure via XML eXternal Entity (XXE)"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3490",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1107901"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTEasy: XXE via parameter entities",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3490"
},
{
"category": "external",
"summary": "RHBZ#1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3490",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3490"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490"
}
],
"release_date": "2014-07-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTEasy: XXE via parameter entities"
},
{
"acknowledgments": [
{
"names": [
"Alexander Papadakis"
]
}
],
"cve": "CVE-2014-3530",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1112987"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "PicketLink: XXE via insecure DocumentBuilderFactory usage",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw could allow remote, unauthenticated attackers to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. All systems hosting PicketLink applications using SAML Identity Providers and Service Providers may be affected. It is strongly advised that anyone running an affected system applies patches to address this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3530"
},
{
"category": "external",
"summary": "RHBZ#1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3530",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3530"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530"
}
],
"release_date": "2014-07-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "PicketLink: XXE via insecure DocumentBuilderFactory usage"
},
{
"cve": "CVE-2014-3558",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"discovery_date": "2014-07-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1120495"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the implementation of org.hibernate.validator.util.ReflectionHelper together with the permissions required to run Hibernate Validator under the Java Security Manager could allow a malicious application deployed in the same application container to execute several actions with escalated privileges, which might otherwise not be possible. This flaw could be used to perform various attacks, including but not restricted to, arbitrary code execution in systems that are otherwise secured by the Java Security Manager.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Validator: JSM bypass via ReflectionHelper",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3558"
},
{
"category": "external",
"summary": "RHBZ#1120495",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120495"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3558",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3558"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3558",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3558"
}
],
"release_date": "2014-07-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Validator: JSM bypass via ReflectionHelper"
},
{
"cve": "CVE-2014-3577",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2014-08-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129074"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3577"
},
{
"category": "external",
"summary": "RHBZ#1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
}
],
"release_date": "2014-08-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
},
{
"cve": "CVE-2014-3578",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2014-08-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1131882"
}
],
"notes": [
{
"category": "description",
"text": "A directory traversal flaw was found in the Spring Framework. A remote attacker could use this flaw to access arbitrary files on a server, and bypassing security restrictions that are otherwise in place.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Framework: Directory traversal",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3578"
},
{
"category": "external",
"summary": "RHBZ#1131882",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131882"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3578",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3578"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3578",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3578"
},
{
"category": "external",
"summary": "http://www.pivotal.io/security/cve-2014-3578",
"url": "http://www.pivotal.io/security/cve-2014-3578"
},
{
"category": "external",
"summary": "https://jvn.jp/en/jp/JVN49154900/",
"url": "https://jvn.jp/en/jp/JVN49154900/"
}
],
"release_date": "2014-09-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Framework: Directory traversal"
},
{
"cve": "CVE-2014-3625",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2014-11-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1165936"
}
],
"notes": [
{
"category": "description",
"text": "A directory traversal flaw was found in the way the Spring Framework sanitized certain URLs. A remote attacker could use this flaw to obtain any file on the file system that was also accessible to the process in which the Spring web application was running.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Framework: directory traversal flaw",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3625"
},
{
"category": "external",
"summary": "RHBZ#1165936",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1165936"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3625",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3625"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3625",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3625"
}
],
"release_date": "2014-11-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-24T21:05:53+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application\nServer process.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0720"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Framework: directory traversal flaw"
}
]
}
rhsa-2014_0827
Vulnerability from csaf_redhat
Published
2014-07-02 08:44
Modified
2024-11-10 17:24
Summary
Red Hat Security Advisory: tomcat security update
Notes
Topic
Updated tomcat packages that fix three security issues are now available
for Red Hat Enterprise Linux 7.
The Red Hat Security Response Team has rated this update as having Moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Apache Tomcat is a servlet container for the Java Servlet and JavaServer
Pages (JSP) technologies.
It was discovered that Apache Tomcat did not limit the length of chunk
sizes when using chunked transfer encoding. A remote attacker could use
this flaw to perform a denial of service attack against Tomcat by streaming
an unlimited quantity of data, leading to excessive consumption of server
resources. (CVE-2014-0075)
It was found that Apache Tomcat did not check for overflowing values when
parsing request content length headers. A remote attacker could use this
flaw to perform an HTTP request smuggling attack on a Tomcat server located
behind a reverse proxy that processed the content length header correctly.
(CVE-2014-0099)
It was found that the org.apache.catalina.servlets.DefaultServlet
implementation in Apache Tomcat allowed the definition of XML External
Entities (XXEs) in provided XSLTs. A malicious application could use this
to circumvent intended security restrictions to disclose sensitive
information. (CVE-2014-0096)
The CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product
Security.
All Tomcat 7 users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues. Tomcat must be
restarted for this update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated tomcat packages that fix three security issues are now available\nfor Red Hat Enterprise Linux 7.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer\nPages (JSP) technologies.\n\nIt was discovered that Apache Tomcat did not limit the length of chunk\nsizes when using chunked transfer encoding. A remote attacker could use\nthis flaw to perform a denial of service attack against Tomcat by streaming\nan unlimited quantity of data, leading to excessive consumption of server\nresources. (CVE-2014-0075)\n\nIt was found that Apache Tomcat did not check for overflowing values when\nparsing request content length headers. A remote attacker could use this\nflaw to perform an HTTP request smuggling attack on a Tomcat server located\nbehind a reverse proxy that processed the content length header correctly.\n(CVE-2014-0099)\n\nIt was found that the org.apache.catalina.servlets.DefaultServlet\nimplementation in Apache Tomcat allowed the definition of XML External\nEntities (XXEs) in provided XSLTs. A malicious application could use this\nto circumvent intended security restrictions to disclose sensitive\ninformation. (CVE-2014-0096)\n\nThe CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product\nSecurity.\n\nAll Tomcat 7 users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues. Tomcat must be\nrestarted for this update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0827",
"url": "https://access.redhat.com/errata/RHSA-2014:0827"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-7.html",
"url": "http://tomcat.apache.org/security-7.html"
},
{
"category": "external",
"summary": "1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0827.json"
}
],
"title": "Red Hat Security Advisory: tomcat security update",
"tracking": {
"current_release_date": "2024-11-10T17:24:45+00:00",
"generator": {
"date": "2024-11-10T17:24:45+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2014:0827",
"initial_release_date": "2014-07-02T08:44:18+00:00",
"revision_history": [
{
"date": "2014-07-02T08:44:18+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2014-07-02T08:44:18+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-10T17:24:45+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Client (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.0.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Client Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.0.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ComputeNode (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.0.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.0.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.0.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.0.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.0.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::workstation"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.0.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::workstation"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat-0:7.0.42-6.el7_0.noarch",
"product": {
"name": "tomcat-0:7.0.42-6.el7_0.noarch",
"product_id": "tomcat-0:7.0.42-6.el7_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat@7.0.42-6.el7_0?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"product": {
"name": "tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"product_id": "tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-jsp-2.2-api@7.0.42-6.el7_0?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"product": {
"name": "tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"product_id": "tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-webapps@7.0.42-6.el7_0?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"product": {
"name": "tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"product_id": "tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-javadoc@7.0.42-6.el7_0?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"product": {
"name": "tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"product_id": "tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-admin-webapps@7.0.42-6.el7_0?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"product": {
"name": "tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"product_id": "tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-el-2.2-api@7.0.42-6.el7_0?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-lib-0:7.0.42-6.el7_0.noarch",
"product": {
"name": "tomcat-lib-0:7.0.42-6.el7_0.noarch",
"product_id": "tomcat-lib-0:7.0.42-6.el7_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-lib@7.0.42-6.el7_0?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"product": {
"name": "tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"product_id": "tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-jsvc@7.0.42-6.el7_0?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"product": {
"name": "tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"product_id": "tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-docs-webapp@7.0.42-6.el7_0?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"product": {
"name": "tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"product_id": "tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-servlet-3.0-api@7.0.42-6.el7_0?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat-0:7.0.42-6.el7_0.src",
"product": {
"name": "tomcat-0:7.0.42-6.el7_0.src",
"product_id": "tomcat-0:7.0.42-6.el7_0.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat@7.0.42-6.el7_0?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Client-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.42-6.el7_0.src as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.0.Z:tomcat-0:7.0.42-6.el7_0.src"
},
"product_reference": "tomcat-0:7.0.42-6.el7_0.src",
"relates_to_product_reference": "7Client-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Client-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Client-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Client-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Client-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Client-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Client-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-lib-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Client-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Client-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Client-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Client-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.42-6.el7_0.src as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src"
},
"product_reference": "tomcat-0:7.0.42-6.el7_0.src",
"relates_to_product_reference": "7Client-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Client-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Client-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Client-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Client-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Client-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Client-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-lib-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Client-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Client-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Client-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7ComputeNode-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.42-6.el7_0.src as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.0.Z:tomcat-0:7.0.42-6.el7_0.src"
},
"product_reference": "tomcat-0:7.0.42-6.el7_0.src",
"relates_to_product_reference": "7ComputeNode-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7ComputeNode-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7ComputeNode-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7ComputeNode-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7ComputeNode-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7ComputeNode-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7ComputeNode-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-lib-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7ComputeNode-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7ComputeNode-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7ComputeNode-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.42-6.el7_0.src as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src"
},
"product_reference": "tomcat-0:7.0.42-6.el7_0.src",
"relates_to_product_reference": "7ComputeNode-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-lib-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Server-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.42-6.el7_0.src as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.0.Z:tomcat-0:7.0.42-6.el7_0.src"
},
"product_reference": "tomcat-0:7.0.42-6.el7_0.src",
"relates_to_product_reference": "7Server-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Server-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Server-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Server-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Server-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Server-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Server-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-lib-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Server-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Server-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Server-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Server-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.42-6.el7_0.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src"
},
"product_reference": "tomcat-0:7.0.42-6.el7_0.src",
"relates_to_product_reference": "7Server-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Server-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Server-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Server-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Server-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Server-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Server-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-lib-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Server-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Server-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Server-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Workstation-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.42-6.el7_0.src as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.0.Z:tomcat-0:7.0.42-6.el7_0.src"
},
"product_reference": "tomcat-0:7.0.42-6.el7_0.src",
"relates_to_product_reference": "7Workstation-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Workstation-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Workstation-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Workstation-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Workstation-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Workstation-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Workstation-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-lib-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Workstation-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Workstation-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Workstation-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Workstation-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.42-6.el7_0.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src"
},
"product_reference": "tomcat-0:7.0.42-6.el7_0.src",
"relates_to_product_reference": "7Workstation-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Workstation-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Workstation-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Workstation-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Workstation-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Workstation-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Workstation-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-lib-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Workstation-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Workstation-optional-7.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.42-6.el7_0.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"relates_to_product_reference": "7Workstation-optional-7.0.Z"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0075",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1072776"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Client-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Client-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7ComputeNode-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7ComputeNode-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Server-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Server-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Workstation-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Workstation-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0075"
},
{
"category": "external",
"summary": "RHBZ#1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-02T08:44:18+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"7Client-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Client-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Client-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7ComputeNode-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7ComputeNode-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Server-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Server-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Workstation-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Workstation-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0827"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"7Client-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Client-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Client-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7ComputeNode-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7ComputeNode-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Server-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Server-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Workstation-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Workstation-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter"
},
{
"cve": "CVE-2014-0096",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1088342"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Client-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Client-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7ComputeNode-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7ComputeNode-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Server-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Server-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Workstation-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Workstation-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0096"
},
{
"category": "external",
"summary": "RHBZ#1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-02T08:44:18+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"7Client-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Client-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Client-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7ComputeNode-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7ComputeNode-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Server-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Server-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Workstation-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Workstation-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0827"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"7Client-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Client-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Client-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7ComputeNode-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7ComputeNode-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Server-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Server-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Workstation-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Workstation-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs"
},
{
"cve": "CVE-2014-0099",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102030"
}
],
"notes": [
{
"category": "description",
"text": "It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Request smuggling via malicious content length header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Client-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Client-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7ComputeNode-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7ComputeNode-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Server-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Server-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Workstation-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Workstation-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0099"
},
{
"category": "external",
"summary": "RHBZ#1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-02T08:44:18+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"7Client-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Client-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Client-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7ComputeNode-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7ComputeNode-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Server-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Server-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Workstation-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Workstation-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0827"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"7Client-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Client-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Client-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Client-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Client-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7ComputeNode-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7ComputeNode-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7ComputeNode-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Server-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Server-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Server-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Server-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Workstation-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-0:7.0.42-6.el7_0.src",
"7Workstation-optional-7.0.Z:tomcat-admin-webapps-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-docs-webapp-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-el-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-javadoc-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-jsp-2.2-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-jsvc-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-lib-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-servlet-3.0-api-0:7.0.42-6.el7_0.noarch",
"7Workstation-optional-7.0.Z:tomcat-webapps-0:7.0.42-6.el7_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Request smuggling via malicious content length header"
}
]
}
rhsa-2014_0835
Vulnerability from csaf_redhat
Published
2014-07-03 17:01
Modified
2024-11-10 17:24
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat7 security update
Notes
Topic
Updated tomcat7 packages that fix three security issues are now available
for Red Hat JBoss Web Server 2.0.1 on Red Hat Enterprise Linux 5 and 6.
The Red Hat Security Response Team has rated this update as having Moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of
components for hosting Java web applications. It is comprised of the Apache
HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector
(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat
Native library.
It was discovered that Apache Tomcat did not limit the length of chunk
sizes when using chunked transfer encoding. A remote attacker could use
this flaw to perform a denial of service attack against Tomcat by streaming
an unlimited quantity of data, leading to excessive consumption of server
resources. (CVE-2014-0075)
It was found that Apache Tomcat did not check for overflowing values when
parsing request content length headers. A remote attacker could use this
flaw to perform an HTTP request smuggling attack on a Tomcat server located
behind a reverse proxy that processed the content length header correctly.
(CVE-2014-0099)
It was found that the org.apache.catalina.servlets.DefaultServlet
implementation in Apache Tomcat allowed the definition of XML External
Entities (XXEs) in provided XSLTs. A malicious application could use this
to circumvent intended security restrictions to disclose sensitive
information. (CVE-2014-0096)
The CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product
Security.
All users of Red Hat JBoss Web Server 2.0.1 are advised to upgrade to these
updated tomcat7 packages, which contain backported patches to correct these
issues. The Red Hat JBoss Web Server process must be restarted for the
update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated tomcat7 packages that fix three security issues are now available\nfor Red Hat JBoss Web Server 2.0.1 on Red Hat Enterprise Linux 5 and 6.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of\ncomponents for hosting Java web applications. It is comprised of the Apache\nHTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector\n(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat\nNative library.\n\nIt was discovered that Apache Tomcat did not limit the length of chunk\nsizes when using chunked transfer encoding. A remote attacker could use\nthis flaw to perform a denial of service attack against Tomcat by streaming\nan unlimited quantity of data, leading to excessive consumption of server\nresources. (CVE-2014-0075)\n\nIt was found that Apache Tomcat did not check for overflowing values when\nparsing request content length headers. A remote attacker could use this\nflaw to perform an HTTP request smuggling attack on a Tomcat server located\nbehind a reverse proxy that processed the content length header correctly.\n(CVE-2014-0099)\n\nIt was found that the org.apache.catalina.servlets.DefaultServlet\nimplementation in Apache Tomcat allowed the definition of XML External\nEntities (XXEs) in provided XSLTs. A malicious application could use this\nto circumvent intended security restrictions to disclose sensitive\ninformation. (CVE-2014-0096)\n\nThe CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product\nSecurity.\n\nAll users of Red Hat JBoss Web Server 2.0.1 are advised to upgrade to these\nupdated tomcat7 packages, which contain backported patches to correct these\nissues. The Red Hat JBoss Web Server process must be restarted for the\nupdate to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0835",
"url": "https://access.redhat.com/errata/RHSA-2014:0835"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0835.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat7 security update",
"tracking": {
"current_release_date": "2024-11-10T17:24:35+00:00",
"generator": {
"date": "2024-11-10T17:24:35+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2014:0835",
"initial_release_date": "2014-07-03T17:01:05+00:00",
"revision_history": [
{
"date": "2014-07-03T17:01:05+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2014-07-03T17:01:05+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-10T17:24:35+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product": {
"name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5"
}
}
},
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product": {
"name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat7-admin-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product": {
"name": "tomcat7-admin-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product_id": "tomcat7-admin-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-admin-webapps@7.0.40-14_patch_03.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-jsp-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product": {
"name": "tomcat7-jsp-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product_id": "tomcat7-jsp-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-jsp-2.2-api@7.0.40-14_patch_03.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product": {
"name": "tomcat7-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product_id": "tomcat7-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-webapps@7.0.40-14_patch_03.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-docs-webapp-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product": {
"name": "tomcat7-docs-webapp-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product_id": "tomcat7-docs-webapp-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-docs-webapp@7.0.40-14_patch_03.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product": {
"name": "tomcat7-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product_id": "tomcat7-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.40-14_patch_03.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-lib-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product": {
"name": "tomcat7-lib-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product_id": "tomcat7-lib-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-lib@7.0.40-14_patch_03.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-log4j-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product": {
"name": "tomcat7-log4j-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product_id": "tomcat7-log4j-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-log4j@7.0.40-14_patch_03.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-javadoc-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product": {
"name": "tomcat7-javadoc-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product_id": "tomcat7-javadoc-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-javadoc@7.0.40-14_patch_03.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-servlet-3.0-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product": {
"name": "tomcat7-servlet-3.0-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product_id": "tomcat7-servlet-3.0-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-servlet-3.0-api@7.0.40-14_patch_03.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-el-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product": {
"name": "tomcat7-el-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product_id": "tomcat7-el-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-el-2.2-api@7.0.40-14_patch_03.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-servlet-3.0-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product": {
"name": "tomcat7-servlet-3.0-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product_id": "tomcat7-servlet-3.0-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-servlet-3.0-api@7.0.40-11_patch_03.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product": {
"name": "tomcat7-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product_id": "tomcat7-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.40-11_patch_03.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-admin-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product": {
"name": "tomcat7-admin-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product_id": "tomcat7-admin-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-admin-webapps@7.0.40-11_patch_03.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-javadoc-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product": {
"name": "tomcat7-javadoc-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product_id": "tomcat7-javadoc-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-javadoc@7.0.40-11_patch_03.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-log4j-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product": {
"name": "tomcat7-log4j-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product_id": "tomcat7-log4j-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-log4j@7.0.40-11_patch_03.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-jsp-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product": {
"name": "tomcat7-jsp-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product_id": "tomcat7-jsp-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-jsp-2.2-api@7.0.40-11_patch_03.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-el-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product": {
"name": "tomcat7-el-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product_id": "tomcat7-el-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-el-2.2-api@7.0.40-11_patch_03.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-docs-webapp-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product": {
"name": "tomcat7-docs-webapp-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product_id": "tomcat7-docs-webapp-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-docs-webapp@7.0.40-11_patch_03.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-lib-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product": {
"name": "tomcat7-lib-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product_id": "tomcat7-lib-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-lib@7.0.40-11_patch_03.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product": {
"name": "tomcat7-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product_id": "tomcat7-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-webapps@7.0.40-11_patch_03.ep6.el6?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat7-0:7.0.40-14_patch_03.ep6.el5.src",
"product": {
"name": "tomcat7-0:7.0.40-14_patch_03.ep6.el5.src",
"product_id": "tomcat7-0:7.0.40-14_patch_03.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.40-14_patch_03.ep6.el5?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.40-11_patch_03.ep6.el6.src",
"product": {
"name": "tomcat7-0:7.0.40-11_patch_03.ep6.el6.src",
"product_id": "tomcat7-0:7.0.40-11_patch_03.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.40-11_patch_03.ep6.el6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.40-14_patch_03.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-0:7.0.40-14_patch_03.ep6.el5.noarch"
},
"product_reference": "tomcat7-0:7.0.40-14_patch_03.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.40-14_patch_03.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-0:7.0.40-14_patch_03.ep6.el5.src"
},
"product_reference": "tomcat7-0:7.0.40-14_patch_03.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-admin-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch"
},
"product_reference": "tomcat7-admin-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-docs-webapp-0:7.0.40-14_patch_03.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-14_patch_03.ep6.el5.noarch"
},
"product_reference": "tomcat7-docs-webapp-0:7.0.40-14_patch_03.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-el-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch"
},
"product_reference": "tomcat7-el-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-javadoc-0:7.0.40-14_patch_03.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-14_patch_03.ep6.el5.noarch"
},
"product_reference": "tomcat7-javadoc-0:7.0.40-14_patch_03.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-jsp-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch"
},
"product_reference": "tomcat7-jsp-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-lib-0:7.0.40-14_patch_03.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-lib-0:7.0.40-14_patch_03.ep6.el5.noarch"
},
"product_reference": "tomcat7-lib-0:7.0.40-14_patch_03.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-log4j-0:7.0.40-14_patch_03.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-log4j-0:7.0.40-14_patch_03.ep6.el5.noarch"
},
"product_reference": "tomcat7-log4j-0:7.0.40-14_patch_03.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-servlet-3.0-api-0:7.0.40-14_patch_03.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-14_patch_03.ep6.el5.noarch"
},
"product_reference": "tomcat7-servlet-3.0-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat7-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch"
},
"product_reference": "tomcat7-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.40-11_patch_03.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-0:7.0.40-11_patch_03.ep6.el6.noarch"
},
"product_reference": "tomcat7-0:7.0.40-11_patch_03.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.40-11_patch_03.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-0:7.0.40-11_patch_03.ep6.el6.src"
},
"product_reference": "tomcat7-0:7.0.40-11_patch_03.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-admin-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch"
},
"product_reference": "tomcat7-admin-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-docs-webapp-0:7.0.40-11_patch_03.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-11_patch_03.ep6.el6.noarch"
},
"product_reference": "tomcat7-docs-webapp-0:7.0.40-11_patch_03.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-el-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch"
},
"product_reference": "tomcat7-el-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-javadoc-0:7.0.40-11_patch_03.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-11_patch_03.ep6.el6.noarch"
},
"product_reference": "tomcat7-javadoc-0:7.0.40-11_patch_03.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-jsp-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch"
},
"product_reference": "tomcat7-jsp-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-lib-0:7.0.40-11_patch_03.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-lib-0:7.0.40-11_patch_03.ep6.el6.noarch"
},
"product_reference": "tomcat7-lib-0:7.0.40-11_patch_03.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-log4j-0:7.0.40-11_patch_03.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-log4j-0:7.0.40-11_patch_03.ep6.el6.noarch"
},
"product_reference": "tomcat7-log4j-0:7.0.40-11_patch_03.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-servlet-3.0-api-0:7.0.40-11_patch_03.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-11_patch_03.ep6.el6.noarch"
},
"product_reference": "tomcat7-servlet-3.0-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch"
},
"product_reference": "tomcat7-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0075",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1072776"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Server-JBEWS-2:tomcat7-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.40-14_patch_03.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.40-11_patch_03.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0075"
},
{
"category": "external",
"summary": "RHBZ#1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-03T17:01:05+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"5Server-JBEWS-2:tomcat7-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.40-14_patch_03.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.40-11_patch_03.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0835"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"5Server-JBEWS-2:tomcat7-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.40-14_patch_03.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.40-11_patch_03.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter"
},
{
"cve": "CVE-2014-0096",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1088342"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Server-JBEWS-2:tomcat7-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.40-14_patch_03.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.40-11_patch_03.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0096"
},
{
"category": "external",
"summary": "RHBZ#1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-03T17:01:05+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"5Server-JBEWS-2:tomcat7-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.40-14_patch_03.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.40-11_patch_03.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0835"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"5Server-JBEWS-2:tomcat7-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.40-14_patch_03.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.40-11_patch_03.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs"
},
{
"cve": "CVE-2014-0099",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102030"
}
],
"notes": [
{
"category": "description",
"text": "It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Request smuggling via malicious content length header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Server-JBEWS-2:tomcat7-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.40-14_patch_03.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.40-11_patch_03.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0099"
},
{
"category": "external",
"summary": "RHBZ#1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-03T17:01:05+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"5Server-JBEWS-2:tomcat7-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.40-14_patch_03.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.40-11_patch_03.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0835"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"5Server-JBEWS-2:tomcat7-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-0:7.0.40-14_patch_03.ep6.el5.src",
"5Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-lib-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-log4j-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-14_patch_03.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat7-webapps-0:7.0.40-14_patch_03.ep6.el5.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.40-11_patch_03.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.40-11_patch_03.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.40-11_patch_03.ep6.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Request smuggling via malicious content length header"
}
]
}
rhsa-2014_0843
Vulnerability from csaf_redhat
Published
2014-07-07 14:49
Modified
2024-11-10 17:24
Summary
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.4 security update
Notes
Topic
Updated Red Hat JBoss Enterprise Application Platform 6.2.4 packages that
fix multiple security issues are now available for Red Hat Enterprise Linux
5 and 6.
The Red Hat Security Response Team has rated this update as having Moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat JBoss Enterprise Application Platform 6 is a platform for Java
applications based on JBoss Application Server 7.
It was discovered that JBoss Web did not limit the length of chunk sizes
when using chunked transfer encoding. A remote attacker could use this flaw
to perform a denial of service attack against JBoss Web by streaming an
unlimited quantity of data, leading to excessive consumption of server
resources. (CVE-2014-0075)
It was found that JBoss Web did not check for overflowing values when
parsing request content length headers. A remote attacker could use this
flaw to perform an HTTP request smuggling attack on a JBoss Web server
located behind a reverse proxy that processed the content length header
correctly. (CVE-2014-0099)
It was found that the org.apache.catalina.servlets.DefaultServlet
implementation in JBoss Web allowed the definition of XML External Entities
(XXEs) in provided XSLTs. A malicious application could use this to
circumvent intended security restrictions to disclose sensitive
information. (CVE-2014-0096)
It was found that, in certain circumstances, it was possible for a
malicious web application to replace the XML parsers used by JBoss Web to
process XSLTs for the default servlet, JSP documents, tag library
descriptors (TLDs), and tag plug-in configuration files. The injected XML
parser(s) could then bypass the limits imposed on XML external entities
and/or gain access to the XML files processed for other web applications
deployed on the same JBoss Web instance. (CVE-2014-0119)
The CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product
Security.
All users of Red Hat JBoss Enterprise Application Platform 6.2.4 on Red Hat
Enterprise Linux 5 and 6 are advised to upgrade to these updated packages.
The JBoss server process must be restarted for the update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated Red Hat JBoss Enterprise Application Platform 6.2.4 packages that\nfix multiple security issues are now available for Red Hat Enterprise Linux\n5 and 6.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Enterprise Application Platform 6 is a platform for Java\napplications based on JBoss Application Server 7.\n\nIt was discovered that JBoss Web did not limit the length of chunk sizes\nwhen using chunked transfer encoding. A remote attacker could use this flaw\nto perform a denial of service attack against JBoss Web by streaming an\nunlimited quantity of data, leading to excessive consumption of server\nresources. (CVE-2014-0075)\n\nIt was found that JBoss Web did not check for overflowing values when\nparsing request content length headers. A remote attacker could use this\nflaw to perform an HTTP request smuggling attack on a JBoss Web server\nlocated behind a reverse proxy that processed the content length header\ncorrectly. (CVE-2014-0099)\n\nIt was found that the org.apache.catalina.servlets.DefaultServlet\nimplementation in JBoss Web allowed the definition of XML External Entities\n(XXEs) in provided XSLTs. A malicious application could use this to\ncircumvent intended security restrictions to disclose sensitive\ninformation. (CVE-2014-0096)\n\nIt was found that, in certain circumstances, it was possible for a\nmalicious web application to replace the XML parsers used by JBoss Web to\nprocess XSLTs for the default servlet, JSP documents, tag library\ndescriptors (TLDs), and tag plug-in configuration files. The injected XML\nparser(s) could then bypass the limits imposed on XML external entities\nand/or gain access to the XML files processed for other web applications\ndeployed on the same JBoss Web instance. (CVE-2014-0119)\n\nThe CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product\nSecurity.\n\nAll users of Red Hat JBoss Enterprise Application Platform 6.2.4 on Red Hat\nEnterprise Linux 5 and 6 are advised to upgrade to these updated packages.\nThe JBoss server process must be restarted for the update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0843",
"url": "https://access.redhat.com/errata/RHSA-2014:0843"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0843.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.4 security update",
"tracking": {
"current_release_date": "2024-11-10T17:24:56+00:00",
"generator": {
"date": "2024-11-10T17:24:56+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2014:0843",
"initial_release_date": "2014-07-07T14:49:49+00:00",
"revision_history": [
{
"date": "2014-07-07T14:49:49+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2014-07-07T14:49:49+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-10T17:24:56+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server",
"product": {
"name": "Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server",
"product_id": "6Server-JBEAP-6.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server",
"product": {
"name": "Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server",
"product_id": "5Server-JBEAP-6.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el5"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Enterprise Application Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.noarch",
"product": {
"name": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.noarch",
"product_id": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbossweb@7.3.2-4.Final_redhat_3.1.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.noarch",
"product": {
"name": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.noarch",
"product_id": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbossweb@7.3.2-4.Final_redhat_3.1.ep6.el5?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.src",
"product": {
"name": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.src",
"product_id": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbossweb@7.3.2-4.Final_redhat_3.1.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.src",
"product": {
"name": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.src",
"product_id": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbossweb@7.3.2-4.Final_redhat_3.1.ep6.el5?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server",
"product_id": "5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.noarch"
},
"product_reference": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEAP-6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.src as a component of Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server",
"product_id": "5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.src"
},
"product_reference": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEAP-6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server",
"product_id": "6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.noarch"
},
"product_reference": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEAP-6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.src as a component of Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server",
"product_id": "6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.src"
},
"product_reference": "jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEAP-6.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0075",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1072776"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.noarch",
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.src",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.noarch",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0075"
},
{
"category": "external",
"summary": "RHBZ#1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-07T14:49:49+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied. Also, back up any customized Red\nHat JBoss Enterprise Application Platform 6 configuration files. On update,\nthe configuration files that have been locally modified will not be\nupdated. The updated version of such files will be stored as the rpmnew\nfiles. Make sure to locate any such files after the update and merge any\nchanges manually.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.noarch",
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.src",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.noarch",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0843"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.noarch",
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.src",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.noarch",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter"
},
{
"cve": "CVE-2014-0096",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1088342"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.noarch",
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.src",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.noarch",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0096"
},
{
"category": "external",
"summary": "RHBZ#1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-07T14:49:49+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied. Also, back up any customized Red\nHat JBoss Enterprise Application Platform 6 configuration files. On update,\nthe configuration files that have been locally modified will not be\nupdated. The updated version of such files will be stored as the rpmnew\nfiles. Make sure to locate any such files after the update and merge any\nchanges manually.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.noarch",
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.src",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.noarch",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0843"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.noarch",
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.src",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.noarch",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs"
},
{
"cve": "CVE-2014-0099",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102030"
}
],
"notes": [
{
"category": "description",
"text": "It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Request smuggling via malicious content length header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.noarch",
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.src",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.noarch",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0099"
},
{
"category": "external",
"summary": "RHBZ#1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-07T14:49:49+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied. Also, back up any customized Red\nHat JBoss Enterprise Application Platform 6 configuration files. On update,\nthe configuration files that have been locally modified will not be\nupdated. The updated version of such files will be stored as the rpmnew\nfiles. Make sure to locate any such files after the update and merge any\nchanges manually.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.noarch",
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.src",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.noarch",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0843"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.noarch",
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.src",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.noarch",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Request smuggling via malicious content length header"
},
{
"cve": "CVE-2014-0119",
"cwe": {
"id": "CWE-470",
"name": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102038"
}
],
"notes": [
{
"category": "description",
"text": "It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XML parser hijack by malicious web application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.noarch",
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.src",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.noarch",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0119"
},
{
"category": "external",
"summary": "RHBZ#1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0119",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0119"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-07T14:49:49+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied. Also, back up any customized Red\nHat JBoss Enterprise Application Platform 6 configuration files. On update,\nthe configuration files that have been locally modified will not be\nupdated. The updated version of such files will be stored as the rpmnew\nfiles. Make sure to locate any such files after the update and merge any\nchanges manually.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.noarch",
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.src",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.noarch",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0843"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.noarch",
"5Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el5.src",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.noarch",
"6Server-JBEAP-6.2:jbossweb-0:7.3.2-4.Final_redhat_3.1.ep6.el6.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XML parser hijack by malicious web application"
}
]
}
rhsa-2014_0895
Vulnerability from csaf_redhat
Published
2014-07-16 17:12
Modified
2024-11-10 17:24
Summary
Red Hat Security Advisory: Red Hat JBoss Data Grid 6.3.0 update
Notes
Topic
Red Hat JBoss Data Grid 6.3.0, which fixes multiple security issues,
various bugs, and adds enhancements, is now available from the Red Hat
Customer Portal.
The Red Hat Security Response Team has rated this update as having Moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat JBoss Data Grid is a distributed in-memory data grid, based on
Infinispan.
This release of Red Hat JBoss Data Grid 6.3.0 serves as a replacement for
Red Hat JBoss Data Grid 6.2.1. It includes various bug fixes and
enhancements which are detailed in the Red Hat JBoss Data Grid 6.3.0
Release Notes. The Release Notes will be available shortly from
https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Data_Grid/
This update also fixes the following security issues:
It was discovered that JBoss Web did not limit the length of chunk sizes
when using chunked transfer encoding. A remote attacker could use this flaw
to perform a denial of service attack against JBoss Web by streaming an
unlimited quantity of data, leading to excessive consumption of server
resources. (CVE-2014-0075)
It was found that JBoss Web did not check for overflowing values when
parsing request content length headers. A remote attacker could use this
flaw to perform an HTTP request smuggling attack on a JBoss Web server
located behind a reverse proxy that processed the content length header
correctly. (CVE-2014-0099)
It was found that the security audit functionality, provided by Red Hat
JBoss Data Grid, logged request parameters in plain text. This may have
caused passwords to be included in the audit log files when using BASIC or
FORM-based authentication. A local attacker with access to audit log files
could possibly use this flaw to obtain application or server authentication
credentials. Refer to the Solution section of this advisory for additional
information on the fix for this issue. (CVE-2014-0058)
It was found that the security auditing functionality provided by PicketBox
and JBossSX, both security frameworks for Java applications, used a
world-readable audit.log file to record sensitive information. A local user
could possibly use this flaw to gain access to the sensitive information in
the audit.log file. (CVE-2014-0059)
It was found that the org.apache.catalina.servlets.DefaultServlet
implementation in JBoss Web allowed the definition of XML External Entities
(XXEs) in provided XSLTs. A malicious application could use this to
circumvent intended security restrictions to disclose sensitive
information. (CVE-2014-0096)
It was found that, in certain circumstances, it was possible for a
malicious web application to replace the XML parsers used by JBoss Web to
process XSLTs for the default servlet, JSP documents, tag library
descriptors (TLDs), and tag plug-in configuration files. The injected XML
parser(s) could then bypass the limits imposed on XML external entities
and/or gain access to the XML files processed for other web applications
deployed on the same JBoss Web instance. (CVE-2014-0119)
The CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product
Security.
All users of Red Hat JBoss Data Grid 6.2.1 as provided from the Red Hat
Customer Portal are advised to upgrade to Red Hat JBoss Data Grid 6.3.0.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Data Grid 6.3.0, which fixes multiple security issues,\nvarious bugs, and adds enhancements, is now available from the Red Hat\nCustomer Portal.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Data Grid is a distributed in-memory data grid, based on\nInfinispan.\n\nThis release of Red Hat JBoss Data Grid 6.3.0 serves as a replacement for\nRed Hat JBoss Data Grid 6.2.1. It includes various bug fixes and\nenhancements which are detailed in the Red Hat JBoss Data Grid 6.3.0\nRelease Notes. The Release Notes will be available shortly from\nhttps://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Data_Grid/\n\nThis update also fixes the following security issues:\n\nIt was discovered that JBoss Web did not limit the length of chunk sizes\nwhen using chunked transfer encoding. A remote attacker could use this flaw\nto perform a denial of service attack against JBoss Web by streaming an\nunlimited quantity of data, leading to excessive consumption of server\nresources. (CVE-2014-0075)\n\nIt was found that JBoss Web did not check for overflowing values when\nparsing request content length headers. A remote attacker could use this\nflaw to perform an HTTP request smuggling attack on a JBoss Web server\nlocated behind a reverse proxy that processed the content length header\ncorrectly. (CVE-2014-0099)\n\nIt was found that the security audit functionality, provided by Red Hat\nJBoss Data Grid, logged request parameters in plain text. This may have\ncaused passwords to be included in the audit log files when using BASIC or\nFORM-based authentication. A local attacker with access to audit log files\ncould possibly use this flaw to obtain application or server authentication\ncredentials. Refer to the Solution section of this advisory for additional\ninformation on the fix for this issue. (CVE-2014-0058)\n\nIt was found that the security auditing functionality provided by PicketBox\nand JBossSX, both security frameworks for Java applications, used a\nworld-readable audit.log file to record sensitive information. A local user\ncould possibly use this flaw to gain access to the sensitive information in\nthe audit.log file. (CVE-2014-0059)\n\nIt was found that the org.apache.catalina.servlets.DefaultServlet\nimplementation in JBoss Web allowed the definition of XML External Entities\n(XXEs) in provided XSLTs. A malicious application could use this to\ncircumvent intended security restrictions to disclose sensitive\ninformation. (CVE-2014-0096)\n\nIt was found that, in certain circumstances, it was possible for a\nmalicious web application to replace the XML parsers used by JBoss Web to\nprocess XSLTs for the default servlet, JSP documents, tag library\ndescriptors (TLDs), and tag plug-in configuration files. The injected XML\nparser(s) could then bypass the limits imposed on XML external entities\nand/or gain access to the XML files processed for other web applications\ndeployed on the same JBoss Web instance. (CVE-2014-0119)\n\nThe CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product\nSecurity.\n\nAll users of Red Hat JBoss Data Grid 6.2.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Data Grid 6.3.0.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0895",
"url": "https://access.redhat.com/errata/RHSA-2014:0895"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.grid\u0026downloadType=distributions",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.grid\u0026downloadType=distributions"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Data_Grid/",
"url": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Data_Grid/"
},
{
"category": "external",
"summary": "1063641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063641"
},
{
"category": "external",
"summary": "1063642",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063642"
},
{
"category": "external",
"summary": "1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0895.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Data Grid 6.3.0 update",
"tracking": {
"current_release_date": "2024-11-10T17:24:10+00:00",
"generator": {
"date": "2024-11-10T17:24:10+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2014:0895",
"initial_release_date": "2014-07-16T17:12:23+00:00",
"revision_history": [
{
"date": "2014-07-16T17:12:23+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:35:29+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-10T17:24:10+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Data Grid 6.3",
"product": {
"name": "Red Hat JBoss Data Grid 6.3",
"product_id": "Red Hat JBoss Data Grid 6.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_data_grid:6.3.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Data Grid"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2014-0058",
"discovery_date": "2014-02-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1063641"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain application or server authentication credentials.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "EAP6: Plain text password logging during security audit",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Grid 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0058"
},
{
"category": "external",
"summary": "RHBZ#1063641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0058",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0058"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0058",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0058"
}
],
"release_date": "2014-02-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-16T17:12:23+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Data Grid installation.\n\nThe provided patch to fix CVE-2014-0058 also allows greater control over\nwhich of the following components of web requests are captured in audit\nlogs:\n\n- parameters\n- cookies\n- headers\n- attributes\n\nIt is also possible to selectively mask some elements of headers,\nparameters, cookies, and attributes using masks. This capability is\nprovided by two system properties, which are introduced by this patch:\n\n1) org.jboss.security.web.audit\n\nDescription:\nThis property controls the granularity of the security auditing of web\nrequests.\n\nPossible values:\noff = Disables auditing of web requests\nheaders = Audits only the headers of web requests\ncookies = Audits only the cookies of web requests\nparameters = Audits only the parameters of web requests\nattributes = Audits only the attributes of web requests\nheaders,cookies,parameters = Audits the headers, cookies, and parameters of\nweb requests\nheaders,cookies = Audits the headers and cookies of web requests\n\nDefault Value:\nheaders, parameters\n\nExamples:\nSetting \"org.jboss.security.web.audit=off\" disables security auditing of\nweb requests entirely.\nSetting \"org.jboss.security.web.audit=headers\" enables security auditing of\nonly headers in web requests.\n\n2) org.jboss.security.web.audit.mask\n\nDescription:\nThis property can be used to specify a list of strings to be matched\nagainst headers, parameters, cookies, and attributes of web requests.\nAny element matching the specified masks will be excluded from security\naudit logging.\n\nPossible values:\nAny comma separated string indicating keys of headers, parameters, cookies,\nand attributes.\n\nDefault Value:\nj_password, authorization\n\nNote that currently the matching of the masks is fuzzy rather than strict.\nFor example, a mask of \"authorization\" will mask both the header called\nauthorization and the parameter called \"custom_authorization\". A future\nrelease may introduce strict masks.",
"product_ids": [
"Red Hat JBoss Data Grid 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0895"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 1.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Grid 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "EAP6: Plain text password logging during security audit"
},
{
"cve": "CVE-2014-0059",
"cwe": {
"id": "CWE-532",
"name": "Insertion of Sensitive Information into Log File"
},
"discovery_date": "2014-02-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1063642"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the security auditing functionality provided by PicketBox and JBossSX, both security frameworks for Java applications, used a world-readable audit.log file to record sensitive information. A local user could possibly use this flaw to gain access to the sensitive information in the audit.log file.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JBossSX/PicketBox: World readable audit.log file",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Grid 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0059"
},
{
"category": "external",
"summary": "RHBZ#1063642",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063642"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0059",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0059"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0059",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0059"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-16T17:12:23+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Data Grid installation.\n\nThe provided patch to fix CVE-2014-0058 also allows greater control over\nwhich of the following components of web requests are captured in audit\nlogs:\n\n- parameters\n- cookies\n- headers\n- attributes\n\nIt is also possible to selectively mask some elements of headers,\nparameters, cookies, and attributes using masks. This capability is\nprovided by two system properties, which are introduced by this patch:\n\n1) org.jboss.security.web.audit\n\nDescription:\nThis property controls the granularity of the security auditing of web\nrequests.\n\nPossible values:\noff = Disables auditing of web requests\nheaders = Audits only the headers of web requests\ncookies = Audits only the cookies of web requests\nparameters = Audits only the parameters of web requests\nattributes = Audits only the attributes of web requests\nheaders,cookies,parameters = Audits the headers, cookies, and parameters of\nweb requests\nheaders,cookies = Audits the headers and cookies of web requests\n\nDefault Value:\nheaders, parameters\n\nExamples:\nSetting \"org.jboss.security.web.audit=off\" disables security auditing of\nweb requests entirely.\nSetting \"org.jboss.security.web.audit=headers\" enables security auditing of\nonly headers in web requests.\n\n2) org.jboss.security.web.audit.mask\n\nDescription:\nThis property can be used to specify a list of strings to be matched\nagainst headers, parameters, cookies, and attributes of web requests.\nAny element matching the specified masks will be excluded from security\naudit logging.\n\nPossible values:\nAny comma separated string indicating keys of headers, parameters, cookies,\nand attributes.\n\nDefault Value:\nj_password, authorization\n\nNote that currently the matching of the masks is fuzzy rather than strict.\nFor example, a mask of \"authorization\" will mask both the header called\nauthorization and the parameter called \"custom_authorization\". A future\nrelease may introduce strict masks.",
"product_ids": [
"Red Hat JBoss Data Grid 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0895"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Grid 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "JBossSX/PicketBox: World readable audit.log file"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0075",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1072776"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Grid 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0075"
},
{
"category": "external",
"summary": "RHBZ#1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-16T17:12:23+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Data Grid installation.\n\nThe provided patch to fix CVE-2014-0058 also allows greater control over\nwhich of the following components of web requests are captured in audit\nlogs:\n\n- parameters\n- cookies\n- headers\n- attributes\n\nIt is also possible to selectively mask some elements of headers,\nparameters, cookies, and attributes using masks. This capability is\nprovided by two system properties, which are introduced by this patch:\n\n1) org.jboss.security.web.audit\n\nDescription:\nThis property controls the granularity of the security auditing of web\nrequests.\n\nPossible values:\noff = Disables auditing of web requests\nheaders = Audits only the headers of web requests\ncookies = Audits only the cookies of web requests\nparameters = Audits only the parameters of web requests\nattributes = Audits only the attributes of web requests\nheaders,cookies,parameters = Audits the headers, cookies, and parameters of\nweb requests\nheaders,cookies = Audits the headers and cookies of web requests\n\nDefault Value:\nheaders, parameters\n\nExamples:\nSetting \"org.jboss.security.web.audit=off\" disables security auditing of\nweb requests entirely.\nSetting \"org.jboss.security.web.audit=headers\" enables security auditing of\nonly headers in web requests.\n\n2) org.jboss.security.web.audit.mask\n\nDescription:\nThis property can be used to specify a list of strings to be matched\nagainst headers, parameters, cookies, and attributes of web requests.\nAny element matching the specified masks will be excluded from security\naudit logging.\n\nPossible values:\nAny comma separated string indicating keys of headers, parameters, cookies,\nand attributes.\n\nDefault Value:\nj_password, authorization\n\nNote that currently the matching of the masks is fuzzy rather than strict.\nFor example, a mask of \"authorization\" will mask both the header called\nauthorization and the parameter called \"custom_authorization\". A future\nrelease may introduce strict masks.",
"product_ids": [
"Red Hat JBoss Data Grid 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0895"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Grid 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter"
},
{
"cve": "CVE-2014-0096",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1088342"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Grid 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0096"
},
{
"category": "external",
"summary": "RHBZ#1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-16T17:12:23+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Data Grid installation.\n\nThe provided patch to fix CVE-2014-0058 also allows greater control over\nwhich of the following components of web requests are captured in audit\nlogs:\n\n- parameters\n- cookies\n- headers\n- attributes\n\nIt is also possible to selectively mask some elements of headers,\nparameters, cookies, and attributes using masks. This capability is\nprovided by two system properties, which are introduced by this patch:\n\n1) org.jboss.security.web.audit\n\nDescription:\nThis property controls the granularity of the security auditing of web\nrequests.\n\nPossible values:\noff = Disables auditing of web requests\nheaders = Audits only the headers of web requests\ncookies = Audits only the cookies of web requests\nparameters = Audits only the parameters of web requests\nattributes = Audits only the attributes of web requests\nheaders,cookies,parameters = Audits the headers, cookies, and parameters of\nweb requests\nheaders,cookies = Audits the headers and cookies of web requests\n\nDefault Value:\nheaders, parameters\n\nExamples:\nSetting \"org.jboss.security.web.audit=off\" disables security auditing of\nweb requests entirely.\nSetting \"org.jboss.security.web.audit=headers\" enables security auditing of\nonly headers in web requests.\n\n2) org.jboss.security.web.audit.mask\n\nDescription:\nThis property can be used to specify a list of strings to be matched\nagainst headers, parameters, cookies, and attributes of web requests.\nAny element matching the specified masks will be excluded from security\naudit logging.\n\nPossible values:\nAny comma separated string indicating keys of headers, parameters, cookies,\nand attributes.\n\nDefault Value:\nj_password, authorization\n\nNote that currently the matching of the masks is fuzzy rather than strict.\nFor example, a mask of \"authorization\" will mask both the header called\nauthorization and the parameter called \"custom_authorization\". A future\nrelease may introduce strict masks.",
"product_ids": [
"Red Hat JBoss Data Grid 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0895"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Grid 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs"
},
{
"cve": "CVE-2014-0099",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102030"
}
],
"notes": [
{
"category": "description",
"text": "It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Request smuggling via malicious content length header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Grid 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0099"
},
{
"category": "external",
"summary": "RHBZ#1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-16T17:12:23+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Data Grid installation.\n\nThe provided patch to fix CVE-2014-0058 also allows greater control over\nwhich of the following components of web requests are captured in audit\nlogs:\n\n- parameters\n- cookies\n- headers\n- attributes\n\nIt is also possible to selectively mask some elements of headers,\nparameters, cookies, and attributes using masks. This capability is\nprovided by two system properties, which are introduced by this patch:\n\n1) org.jboss.security.web.audit\n\nDescription:\nThis property controls the granularity of the security auditing of web\nrequests.\n\nPossible values:\noff = Disables auditing of web requests\nheaders = Audits only the headers of web requests\ncookies = Audits only the cookies of web requests\nparameters = Audits only the parameters of web requests\nattributes = Audits only the attributes of web requests\nheaders,cookies,parameters = Audits the headers, cookies, and parameters of\nweb requests\nheaders,cookies = Audits the headers and cookies of web requests\n\nDefault Value:\nheaders, parameters\n\nExamples:\nSetting \"org.jboss.security.web.audit=off\" disables security auditing of\nweb requests entirely.\nSetting \"org.jboss.security.web.audit=headers\" enables security auditing of\nonly headers in web requests.\n\n2) org.jboss.security.web.audit.mask\n\nDescription:\nThis property can be used to specify a list of strings to be matched\nagainst headers, parameters, cookies, and attributes of web requests.\nAny element matching the specified masks will be excluded from security\naudit logging.\n\nPossible values:\nAny comma separated string indicating keys of headers, parameters, cookies,\nand attributes.\n\nDefault Value:\nj_password, authorization\n\nNote that currently the matching of the masks is fuzzy rather than strict.\nFor example, a mask of \"authorization\" will mask both the header called\nauthorization and the parameter called \"custom_authorization\". A future\nrelease may introduce strict masks.",
"product_ids": [
"Red Hat JBoss Data Grid 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0895"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Grid 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Request smuggling via malicious content length header"
},
{
"cve": "CVE-2014-0119",
"cwe": {
"id": "CWE-470",
"name": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102038"
}
],
"notes": [
{
"category": "description",
"text": "It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XML parser hijack by malicious web application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Grid 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0119"
},
{
"category": "external",
"summary": "RHBZ#1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0119",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0119"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-16T17:12:23+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Data Grid installation.\n\nThe provided patch to fix CVE-2014-0058 also allows greater control over\nwhich of the following components of web requests are captured in audit\nlogs:\n\n- parameters\n- cookies\n- headers\n- attributes\n\nIt is also possible to selectively mask some elements of headers,\nparameters, cookies, and attributes using masks. This capability is\nprovided by two system properties, which are introduced by this patch:\n\n1) org.jboss.security.web.audit\n\nDescription:\nThis property controls the granularity of the security auditing of web\nrequests.\n\nPossible values:\noff = Disables auditing of web requests\nheaders = Audits only the headers of web requests\ncookies = Audits only the cookies of web requests\nparameters = Audits only the parameters of web requests\nattributes = Audits only the attributes of web requests\nheaders,cookies,parameters = Audits the headers, cookies, and parameters of\nweb requests\nheaders,cookies = Audits the headers and cookies of web requests\n\nDefault Value:\nheaders, parameters\n\nExamples:\nSetting \"org.jboss.security.web.audit=off\" disables security auditing of\nweb requests entirely.\nSetting \"org.jboss.security.web.audit=headers\" enables security auditing of\nonly headers in web requests.\n\n2) org.jboss.security.web.audit.mask\n\nDescription:\nThis property can be used to specify a list of strings to be matched\nagainst headers, parameters, cookies, and attributes of web requests.\nAny element matching the specified masks will be excluded from security\naudit logging.\n\nPossible values:\nAny comma separated string indicating keys of headers, parameters, cookies,\nand attributes.\n\nDefault Value:\nj_password, authorization\n\nNote that currently the matching of the masks is fuzzy rather than strict.\nFor example, a mask of \"authorization\" will mask both the header called\nauthorization and the parameter called \"custom_authorization\". A future\nrelease may introduce strict masks.",
"product_ids": [
"Red Hat JBoss Data Grid 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0895"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Grid 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XML parser hijack by malicious web application"
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3481",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1105242"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the default context parameters as provided to RESTEasy deployments by JBoss EAP did not explicitly disable external entity expansion for RESTEasy. A remote attacker could use this flaw to perform XML External Entity (XXE) attacks on RESTEasy applications accepting XML input.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JAX-RS: Information disclosure via XML eXternal Entity (XXE)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Grid 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3481"
},
{
"category": "external",
"summary": "RHBZ#1105242",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1105242"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3481",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3481"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3481",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3481"
}
],
"release_date": "2014-06-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-16T17:12:23+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Data Grid installation.\n\nThe provided patch to fix CVE-2014-0058 also allows greater control over\nwhich of the following components of web requests are captured in audit\nlogs:\n\n- parameters\n- cookies\n- headers\n- attributes\n\nIt is also possible to selectively mask some elements of headers,\nparameters, cookies, and attributes using masks. This capability is\nprovided by two system properties, which are introduced by this patch:\n\n1) org.jboss.security.web.audit\n\nDescription:\nThis property controls the granularity of the security auditing of web\nrequests.\n\nPossible values:\noff = Disables auditing of web requests\nheaders = Audits only the headers of web requests\ncookies = Audits only the cookies of web requests\nparameters = Audits only the parameters of web requests\nattributes = Audits only the attributes of web requests\nheaders,cookies,parameters = Audits the headers, cookies, and parameters of\nweb requests\nheaders,cookies = Audits the headers and cookies of web requests\n\nDefault Value:\nheaders, parameters\n\nExamples:\nSetting \"org.jboss.security.web.audit=off\" disables security auditing of\nweb requests entirely.\nSetting \"org.jboss.security.web.audit=headers\" enables security auditing of\nonly headers in web requests.\n\n2) org.jboss.security.web.audit.mask\n\nDescription:\nThis property can be used to specify a list of strings to be matched\nagainst headers, parameters, cookies, and attributes of web requests.\nAny element matching the specified masks will be excluded from security\naudit logging.\n\nPossible values:\nAny comma separated string indicating keys of headers, parameters, cookies,\nand attributes.\n\nDefault Value:\nj_password, authorization\n\nNote that currently the matching of the masks is fuzzy rather than strict.\nFor example, a mask of \"authorization\" will mask both the header called\nauthorization and the parameter called \"custom_authorization\". A future\nrelease may introduce strict masks.",
"product_ids": [
"Red Hat JBoss Data Grid 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0895"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Grid 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "JAX-RS: Information disclosure via XML eXternal Entity (XXE)"
}
]
}
rhsa-2015_0765
Vulnerability from csaf_redhat
Published
2015-03-31 17:00
Modified
2024-11-14 14:33
Summary
Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.0.0 security update
Notes
Topic
Red Hat JBoss Data Virtualization 6.0.0 2015 roll up patch 1, which fixes
multiple security issues and various bugs, is now available from the Red
Hat Customer Portal.
Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Red Hat JBoss Data Virtualization is a lean data integration solution that
provides easy, real-time, and unified data access across disparate sources
to multiple applications and users. JBoss Data Virtualization makes data
spread across physically distinct systems-such as multiple databases, XML
files, and even Hadoop systems-appear as a set of tables in a local
database.
This roll up patch serves as a cumulative upgrade for Red Hat JBoss Data
Virtualization 6.0.0. It includes various bug fixes, which are listed in
the README file included with the patch files.
The following security issues are also fixed with this release,
descriptions of which can be found on the respective CVE pages linked in
the References section.
CVE-2012-6153 Apache HttpComponents client: SSL hostname verification
bypass, incomplete CVE-2012-5783 fix
CVE-2014-3577 Apache HttpComponents client: SSL hostname verification
bypass, incomplete CVE-2012-6153 fix
CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage
CVE-2013-4002 Xerces-J2 OpenJDK: XML parsing Denial of Service (JAXP,
8017298)
CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of
user-supplied content in outputText tags and EL expressions
CVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding
input filter
CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content
length header
CVE-2014-3481 JBoss AS JAX-RS: Information disclosure via XML eXternal
Entity (XXE)
CVE-2014-3490 RESTEasy: XXE via parameter entities
CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs
CVE-2014-0119 Tomcat/JBossWeb: XML parser hijack by malicious web
application
CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation
CVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter
Red Hat would like to thank James Roper of Typesafe for reporting
CVE-2014-0193, and Alexander Papadakis for reporting CVE-2014-3530.
The CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat Product
Security, the CVE-2014-0075 and CVE-2014-3490 issues were discovered by
David Jorm of Red Hat Product Security, and the CVE-2014-3481 issue was
discovered by the Red Hat JBoss Enterprise Application Platform QE team.
All users of Red Hat JBoss Data Virtualization 6.0.0 as provided from the
Red Hat Customer Portal are advised to apply this roll up patch.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Data Virtualization 6.0.0 2015 roll up patch 1, which fixes\nmultiple security issues and various bugs, is now available from the Red\nHat Customer Portal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Data Virtualization is a lean data integration solution that\nprovides easy, real-time, and unified data access across disparate sources\nto multiple applications and users. JBoss Data Virtualization makes data\nspread across physically distinct systems-such as multiple databases, XML\nfiles, and even Hadoop systems-appear as a set of tables in a local\ndatabase.\n\nThis roll up patch serves as a cumulative upgrade for Red Hat JBoss Data\nVirtualization 6.0.0. It includes various bug fixes, which are listed in\nthe README file included with the patch files.\n\nThe following security issues are also fixed with this release,\ndescriptions of which can be found on the respective CVE pages linked in\nthe References section.\n\nCVE-2012-6153 Apache HttpComponents client: SSL hostname verification\nbypass, incomplete CVE-2012-5783 fix\n\nCVE-2014-3577 Apache HttpComponents client: SSL hostname verification\nbypass, incomplete CVE-2012-6153 fix\n\nCVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage\n\nCVE-2013-4002 Xerces-J2 OpenJDK: XML parsing Denial of Service (JAXP,\n8017298)\n\nCVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of\nuser-supplied content in outputText tags and EL expressions\n\nCVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding\ninput filter\n\nCVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content\nlength header\n\nCVE-2014-3481 JBoss AS JAX-RS: Information disclosure via XML eXternal\nEntity (XXE)\n\nCVE-2014-3490 RESTEasy: XXE via parameter entities\n\nCVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs\n\nCVE-2014-0119 Tomcat/JBossWeb: XML parser hijack by malicious web\napplication\n\nCVE-2014-0193 netty: DoS via memory exhaustion during data aggregation\n\nCVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter \n\nRed Hat would like to thank James Roper of Typesafe for reporting\nCVE-2014-0193, and Alexander Papadakis for reporting CVE-2014-3530.\nThe CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat Product\nSecurity, the CVE-2014-0075 and CVE-2014-3490 issues were discovered by\nDavid Jorm of Red Hat Product Security, and the CVE-2014-3481 issue was\ndiscovered by the Red Hat JBoss Enterprise Application Platform QE team.\n\nAll users of Red Hat JBoss Data Virtualization 6.0.0 as provided from the\nRed Hat Customer Portal are advised to apply this roll up patch.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:0765",
"url": "https://access.redhat.com/errata/RHSA-2015:0765"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform\u0026downloadType=securityPatches\u0026version=6.0.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform\u0026downloadType=securityPatches\u0026version=6.0.0"
},
{
"category": "external",
"summary": "1019176",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1019176"
},
{
"category": "external",
"summary": "1065139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
},
{
"category": "external",
"summary": "1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "1105242",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1105242"
},
{
"category": "external",
"summary": "1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "external",
"summary": "1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0765.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.0.0 security update",
"tracking": {
"current_release_date": "2024-11-14T14:33:36+00:00",
"generator": {
"date": "2024-11-14T14:33:36+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2015:0765",
"initial_release_date": "2015-03-31T17:00:43+00:00",
"revision_history": [
{
"date": "2015-03-31T17:00:43+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:35:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T14:33:36+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Data Virtualization 6.0",
"product": {
"name": "Red Hat JBoss Data Virtualization 6.0",
"product_id": "Red Hat JBoss Data Virtualization 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_data_virtualization:6.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Data Virtualization"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Florian Weimer"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2012-6153",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2012-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129916"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-6153"
},
{
"category": "external",
"summary": "RHBZ#1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
}
],
"release_date": "2014-08-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-31T17:00:43+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0765"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
},
{
"cve": "CVE-2013-4002",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2013-10-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1019176"
}
],
"notes": [
{
"category": "description",
"text": "A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: XML parsing Denial of Service (JAXP, 8017298)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Fuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Server 4 and 5; Red Hat JBoss Enterprise Web Platform 5; Red Hat JBoss SOA Platform 4 and 5; and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4002"
},
{
"category": "external",
"summary": "RHBZ#1019176",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1019176"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4002",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html"
}
],
"release_date": "2013-10-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-31T17:00:43+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0765"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: XML parsing Denial of Service (JAXP, 8017298)"
},
{
"cve": "CVE-2013-5855",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2014-02-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1065139"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Mojarra JavaServer Faces did not properly escape user-supplied content in certain circumstances. Contents of outputText tags and raw EL expressions that immediately follow script or style elements were not escaped. A remote attacker could use a specially crafted URL to execute arbitrary web script in the user\u0027s browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-5855"
},
{
"category": "external",
"summary": "RHBZ#1065139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-5855",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5855"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855"
},
{
"category": "external",
"summary": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209",
"url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209"
}
],
"release_date": "2014-02-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-31T17:00:43+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0765"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0075",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1072776"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0075"
},
{
"category": "external",
"summary": "RHBZ#1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-31T17:00:43+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0765"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter"
},
{
"cve": "CVE-2014-0096",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1088342"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0096"
},
{
"category": "external",
"summary": "RHBZ#1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-31T17:00:43+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0765"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs"
},
{
"cve": "CVE-2014-0099",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102030"
}
],
"notes": [
{
"category": "description",
"text": "It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Request smuggling via malicious content length header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0099"
},
{
"category": "external",
"summary": "RHBZ#1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-31T17:00:43+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0765"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Request smuggling via malicious content length header"
},
{
"cve": "CVE-2014-0119",
"cwe": {
"id": "CWE-470",
"name": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102038"
}
],
"notes": [
{
"category": "description",
"text": "It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XML parser hijack by malicious web application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0119"
},
{
"category": "external",
"summary": "RHBZ#1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0119",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0119"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-31T17:00:43+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0765"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XML parser hijack by malicious web application"
},
{
"acknowledgments": [
{
"names": [
"James Roper"
],
"organization": "Typesafe"
}
],
"cve": "CVE-2014-0193",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-04-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1092783"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: DoS via memory exhaustion during data aggregation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0193"
},
{
"category": "external",
"summary": "RHBZ#1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0193",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193"
}
],
"release_date": "2014-05-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-31T17:00:43+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0765"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "netty: DoS via memory exhaustion during data aggregation"
},
{
"cve": "CVE-2014-0227",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109196"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0227"
},
{
"category": "external",
"summary": "RHBZ#1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0227",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43",
"url": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55",
"url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55"
}
],
"release_date": "2015-02-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-31T17:00:43+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0765"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter"
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3481",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1105242"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the default context parameters as provided to RESTEasy deployments by JBoss EAP did not explicitly disable external entity expansion for RESTEasy. A remote attacker could use this flaw to perform XML External Entity (XXE) attacks on RESTEasy applications accepting XML input.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JAX-RS: Information disclosure via XML eXternal Entity (XXE)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3481"
},
{
"category": "external",
"summary": "RHBZ#1105242",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1105242"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3481",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3481"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3481",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3481"
}
],
"release_date": "2014-06-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-31T17:00:43+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0765"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "JAX-RS: Information disclosure via XML eXternal Entity (XXE)"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3490",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1107901"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTEasy: XXE via parameter entities",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3490"
},
{
"category": "external",
"summary": "RHBZ#1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3490",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3490"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490"
}
],
"release_date": "2014-07-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-31T17:00:43+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0765"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTEasy: XXE via parameter entities"
},
{
"acknowledgments": [
{
"names": [
"Alexander Papadakis"
]
}
],
"cve": "CVE-2014-3530",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1112987"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "PicketLink: XXE via insecure DocumentBuilderFactory usage",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw could allow remote, unauthenticated attackers to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. All systems hosting PicketLink applications using SAML Identity Providers and Service Providers may be affected. It is strongly advised that anyone running an affected system applies patches to address this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3530"
},
{
"category": "external",
"summary": "RHBZ#1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3530",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3530"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530"
}
],
"release_date": "2014-07-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-31T17:00:43+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0765"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "PicketLink: XXE via insecure DocumentBuilderFactory usage"
},
{
"cve": "CVE-2014-3577",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2014-08-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129074"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3577"
},
{
"category": "external",
"summary": "RHBZ#1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
}
],
"release_date": "2014-08-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-31T17:00:43+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0765"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
}
]
}
rhsa-2015_0235
Vulnerability from csaf_redhat
Published
2015-02-17 22:27
Modified
2024-11-14 14:33
Summary
Red Hat Security Advisory: Red Hat JBoss BRMS 6.0.3 security update
Notes
Topic
Red Hat JBoss BRMS 6.0.3 roll up patch 2, which fixes multiple security
issues, several bugs, and adds various enhancements, is now available from
the Red Hat Customer Portal.
Red Hat Product Security has rated this update as having Important
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat JBoss BRMS is a business rules management system for the
management, storage, creation, modification, and deployment of JBoss
Rules.
This roll up patch serves as a cumulative upgrade for Red Hat JBoss BRMS
6.0.3, and includes bug fixes and enhancements. It includes various bug
fixes, which are listed in the README file included with the patch files.
The following security issues are also fixed with this release,
descriptions of which can be found on the respective CVE pages linked in
the References section.
CVE-2012-6153 Apache HttpComponents client: SSL hostname verification
bypass, incomplete CVE-2012-5783 fix
CVE-2014-3577 Apache HttpComponents client: SSL hostname verification
bypass, incomplete CVE-2012-6153 fix
CVE-2013-4002 xerces-j2: Xerces-J2 OpenJDK: XML parsing Denial of Service
(JAXP, 8017298)
CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of
user-supplied content in outputText tags and EL expressions
CVE-2014-0005 security: PicketBox/JBossSX: Unauthorized access to and
modification of application server configuration and state by application
CVE-2014-0075 jbossweb: tomcat: Limited DoS in chunked transfer encoding
input filter
CVE-2014-0096 jbossweb: Apache Tomcat: XXE vulnerability via user supplied
XSLTs
CVE-2014-0099 jbossweb: Apache Tomcat: Request smuggling via malicious
content length header
CVE-2014-0119 jbossweb: Apache Tomcat 6: XML parser hijack by malicious web
application
CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation
CVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter
CVE-2014-3472 jboss-as-controller: JBoss AS Security: Invalid EJB caller
role check implementation
CVE-2014-3490 RESTEasy: XXE via parameter entities
CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage
CVE-2014-3558 hibernate-validator: Hibernate Validator: JSM bypass via
ReflectionHelper
CVE-2014-3578 spring: Spring Framework: Directory traversal
CVE-2014-3625 spring: Spring Framework: directory traversal flaw
CVE-2014-3682 jbpm-designer: XXE in BPMN2 import
CVE-2014-8114 UberFire: Information disclosure and RCE via insecure file
upload/download servlets
CVE-2014-8115 KIE Workbench: Insufficient authorization constraints
Red Hat would like to thank James Roper of Typesafe for reporting the
CVE-2014-0193 issue; CA Technologies for reporting the CVE-2014-3472 issue;
Alexander Papadakis for reporting the CVE-2014-3530 issue; and David Jorm
for reporting the CVE-2014-8114 and CVE-2014-8115 issues. The CVE-2012-6153
issue was discovered by Florian Weimer of Red Hat Product Security; the
CVE-2014-0005 issue was discovered by Josef Cacek of the Red Hat JBoss EAP
Quality Engineering team; and the CVE-2014-0075, CVE-2014-3490, and
CVE-2014-3682 issues were discovered by David Jorm of Red Hat Product
Security.
All users of Red Hat JBoss BRMS 6.0.3 as provided from the Red Hat Customer
Portal are advised to apply this roll up patch.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss BRMS 6.0.3 roll up patch 2, which fixes multiple security\nissues, several bugs, and adds various enhancements, is now available from\nthe Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss BRMS is a business rules management system for the\nmanagement, storage, creation, modification, and deployment of JBoss\nRules.\n\nThis roll up patch serves as a cumulative upgrade for Red Hat JBoss BRMS\n6.0.3, and includes bug fixes and enhancements. It includes various bug\nfixes, which are listed in the README file included with the patch files.\n\nThe following security issues are also fixed with this release,\ndescriptions of which can be found on the respective CVE pages linked in\nthe References section.\n\nCVE-2012-6153 Apache HttpComponents client: SSL hostname verification\nbypass, incomplete CVE-2012-5783 fix\n\nCVE-2014-3577 Apache HttpComponents client: SSL hostname verification\nbypass, incomplete CVE-2012-6153 fix\n\nCVE-2013-4002 xerces-j2: Xerces-J2 OpenJDK: XML parsing Denial of Service\n(JAXP, 8017298)\n\nCVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of\nuser-supplied content in outputText tags and EL expressions\n\nCVE-2014-0005 security: PicketBox/JBossSX: Unauthorized access to and\nmodification of application server configuration and state by application\n\nCVE-2014-0075 jbossweb: tomcat: Limited DoS in chunked transfer encoding\ninput filter\n\nCVE-2014-0096 jbossweb: Apache Tomcat: XXE vulnerability via user supplied\nXSLTs\n\nCVE-2014-0099 jbossweb: Apache Tomcat: Request smuggling via malicious\ncontent length header\n\nCVE-2014-0119 jbossweb: Apache Tomcat 6: XML parser hijack by malicious web\napplication\n\nCVE-2014-0193 netty: DoS via memory exhaustion during data aggregation\n\nCVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter\n\nCVE-2014-3472 jboss-as-controller: JBoss AS Security: Invalid EJB caller\nrole check implementation\n\nCVE-2014-3490 RESTEasy: XXE via parameter entities\n\nCVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage\n\nCVE-2014-3558 hibernate-validator: Hibernate Validator: JSM bypass via\nReflectionHelper\n\nCVE-2014-3578 spring: Spring Framework: Directory traversal\n\nCVE-2014-3625 spring: Spring Framework: directory traversal flaw\n\nCVE-2014-3682 jbpm-designer: XXE in BPMN2 import\n\nCVE-2014-8114 UberFire: Information disclosure and RCE via insecure file\nupload/download servlets\n\nCVE-2014-8115 KIE Workbench: Insufficient authorization constraints\n\nRed Hat would like to thank James Roper of Typesafe for reporting the\nCVE-2014-0193 issue; CA Technologies for reporting the CVE-2014-3472 issue;\nAlexander Papadakis for reporting the CVE-2014-3530 issue; and David Jorm\nfor reporting the CVE-2014-8114 and CVE-2014-8115 issues. The CVE-2012-6153\nissue was discovered by Florian Weimer of Red Hat Product Security; the\nCVE-2014-0005 issue was discovered by Josef Cacek of the Red Hat JBoss EAP\nQuality Engineering team; and the CVE-2014-0075, CVE-2014-3490, and\nCVE-2014-3682 issues were discovered by David Jorm of Red Hat Product\nSecurity.\n\nAll users of Red Hat JBoss BRMS 6.0.3 as provided from the Red Hat Customer\nPortal are advised to apply this roll up patch.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:0235",
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=distributions\u0026version=6.0.3",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=distributions\u0026version=6.0.3"
},
{
"category": "external",
"summary": "1019176",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1019176"
},
{
"category": "external",
"summary": "1049736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049736"
},
{
"category": "external",
"summary": "1065139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
},
{
"category": "external",
"summary": "1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "1103815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103815"
},
{
"category": "external",
"summary": "1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "external",
"summary": "1120495",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120495"
},
{
"category": "external",
"summary": "1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "1131882",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131882"
},
{
"category": "external",
"summary": "1148260",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1148260"
},
{
"category": "external",
"summary": "1165936",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1165936"
},
{
"category": "external",
"summary": "1169544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1169544"
},
{
"category": "external",
"summary": "1169545",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1169545"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0235.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss BRMS 6.0.3 security update",
"tracking": {
"current_release_date": "2024-11-14T14:33:36+00:00",
"generator": {
"date": "2024-11-14T14:33:36+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2015:0235",
"initial_release_date": "2015-02-17T22:27:36+00:00",
"revision_history": [
{
"date": "2015-02-17T22:27:36+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:35:32+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T14:33:36+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss BRMS 6.0",
"product": {
"name": "Red Hat JBoss BRMS 6.0",
"product_id": "Red Hat JBoss BRMS 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_brms:6.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Decision Manager"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Florian Weimer"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2012-6153",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2012-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129916"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-6153"
},
{
"category": "external",
"summary": "RHBZ#1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
}
],
"release_date": "2014-08-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
},
{
"cve": "CVE-2013-4002",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2013-10-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1019176"
}
],
"notes": [
{
"category": "description",
"text": "A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: XML parsing Denial of Service (JAXP, 8017298)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Fuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Server 4 and 5; Red Hat JBoss Enterprise Web Platform 5; Red Hat JBoss SOA Platform 4 and 5; and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4002"
},
{
"category": "external",
"summary": "RHBZ#1019176",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1019176"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4002",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html"
}
],
"release_date": "2013-10-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: XML parsing Denial of Service (JAXP, 8017298)"
},
{
"cve": "CVE-2013-5855",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2014-02-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1065139"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Mojarra JavaServer Faces did not properly escape user-supplied content in certain circumstances. Contents of outputText tags and raw EL expressions that immediately follow script or style elements were not escaped. A remote attacker could use a specially crafted URL to execute arbitrary web script in the user\u0027s browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-5855"
},
{
"category": "external",
"summary": "RHBZ#1065139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-5855",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5855"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855"
},
{
"category": "external",
"summary": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209",
"url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209"
}
],
"release_date": "2014-02-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions"
},
{
"acknowledgments": [
{
"names": [
"Josef Cacek"
],
"organization": "Red Hat JBoss EAP Quality Engineering team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0005",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2014-01-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049736"
}
],
"notes": [
{
"category": "description",
"text": "It was identified that PicketBox/JBossSX allowed any deployed application to alter or read the underlying application server configuration and state without any authorization checks. An attacker able to deploy applications could use this flaw to circumvent security constraints applied to other applications deployed on the same system, disclose privileged information, and in certain cases allow arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0005"
},
{
"category": "external",
"summary": "RHBZ#1049736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0005",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0005"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0005",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0005"
}
],
"release_date": "2014-03-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 3.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0075",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1072776"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0075"
},
{
"category": "external",
"summary": "RHBZ#1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter"
},
{
"cve": "CVE-2014-0096",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1088342"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0096"
},
{
"category": "external",
"summary": "RHBZ#1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs"
},
{
"cve": "CVE-2014-0099",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102030"
}
],
"notes": [
{
"category": "description",
"text": "It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Request smuggling via malicious content length header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0099"
},
{
"category": "external",
"summary": "RHBZ#1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Request smuggling via malicious content length header"
},
{
"cve": "CVE-2014-0119",
"cwe": {
"id": "CWE-470",
"name": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102038"
}
],
"notes": [
{
"category": "description",
"text": "It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XML parser hijack by malicious web application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0119"
},
{
"category": "external",
"summary": "RHBZ#1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0119",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0119"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XML parser hijack by malicious web application"
},
{
"acknowledgments": [
{
"names": [
"James Roper"
],
"organization": "Typesafe"
}
],
"cve": "CVE-2014-0193",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-04-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1092783"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: DoS via memory exhaustion during data aggregation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0193"
},
{
"category": "external",
"summary": "RHBZ#1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0193",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193"
}
],
"release_date": "2014-05-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "netty: DoS via memory exhaustion during data aggregation"
},
{
"cve": "CVE-2014-0227",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109196"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0227"
},
{
"category": "external",
"summary": "RHBZ#1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0227",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43",
"url": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55",
"url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55"
}
],
"release_date": "2015-02-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter"
},
{
"acknowledgments": [
{
"names": [
"CA Technologies"
]
}
],
"cve": "CVE-2014-3472",
"cwe": {
"id": "CWE-184",
"name": "Incomplete List of Disallowed Inputs"
},
"discovery_date": "2014-05-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1103815"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the isCallerInRole() method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Security: Invalid EJB caller role check implementation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3472"
},
{
"category": "external",
"summary": "RHBZ#1103815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3472",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3472"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3472",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3472"
}
],
"release_date": "2014-08-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Security: Invalid EJB caller role check implementation"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3490",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1107901"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTEasy: XXE via parameter entities",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3490"
},
{
"category": "external",
"summary": "RHBZ#1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3490",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3490"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490"
}
],
"release_date": "2014-07-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTEasy: XXE via parameter entities"
},
{
"acknowledgments": [
{
"names": [
"Alexander Papadakis"
]
}
],
"cve": "CVE-2014-3530",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1112987"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "PicketLink: XXE via insecure DocumentBuilderFactory usage",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw could allow remote, unauthenticated attackers to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. All systems hosting PicketLink applications using SAML Identity Providers and Service Providers may be affected. It is strongly advised that anyone running an affected system applies patches to address this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3530"
},
{
"category": "external",
"summary": "RHBZ#1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3530",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3530"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530"
}
],
"release_date": "2014-07-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "PicketLink: XXE via insecure DocumentBuilderFactory usage"
},
{
"cve": "CVE-2014-3558",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"discovery_date": "2014-07-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1120495"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the implementation of org.hibernate.validator.util.ReflectionHelper together with the permissions required to run Hibernate Validator under the Java Security Manager could allow a malicious application deployed in the same application container to execute several actions with escalated privileges, which might otherwise not be possible. This flaw could be used to perform various attacks, including but not restricted to, arbitrary code execution in systems that are otherwise secured by the Java Security Manager.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Validator: JSM bypass via ReflectionHelper",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3558"
},
{
"category": "external",
"summary": "RHBZ#1120495",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120495"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3558",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3558"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3558",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3558"
}
],
"release_date": "2014-07-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Validator: JSM bypass via ReflectionHelper"
},
{
"cve": "CVE-2014-3577",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2014-08-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129074"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3577"
},
{
"category": "external",
"summary": "RHBZ#1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
}
],
"release_date": "2014-08-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
},
{
"cve": "CVE-2014-3578",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2014-08-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1131882"
}
],
"notes": [
{
"category": "description",
"text": "A directory traversal flaw was found in the Spring Framework. A remote attacker could use this flaw to access arbitrary files on a server, and bypassing security restrictions that are otherwise in place.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Framework: Directory traversal",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3578"
},
{
"category": "external",
"summary": "RHBZ#1131882",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131882"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3578",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3578"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3578",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3578"
},
{
"category": "external",
"summary": "http://www.pivotal.io/security/cve-2014-3578",
"url": "http://www.pivotal.io/security/cve-2014-3578"
},
{
"category": "external",
"summary": "https://jvn.jp/en/jp/JVN49154900/",
"url": "https://jvn.jp/en/jp/JVN49154900/"
}
],
"release_date": "2014-09-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Framework: Directory traversal"
},
{
"cve": "CVE-2014-3625",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2014-11-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1165936"
}
],
"notes": [
{
"category": "description",
"text": "A directory traversal flaw was found in the way the Spring Framework sanitized certain URLs. A remote attacker could use this flaw to obtain any file on the file system that was also accessible to the process in which the Spring web application was running.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Framework: directory traversal flaw",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3625"
},
{
"category": "external",
"summary": "RHBZ#1165936",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1165936"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3625",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3625"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3625",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3625"
}
],
"release_date": "2014-11-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Framework: directory traversal flaw"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3682",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-10-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1148260"
}
],
"notes": [
{
"category": "description",
"text": "An XML External Entity (XXE) flaw was found in the jbpm-designer BPMN2 import function. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jbpm-designer: XXE in BPMN2 import",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3682"
},
{
"category": "external",
"summary": "RHBZ#1148260",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1148260"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3682",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3682"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3682",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3682"
}
],
"release_date": "2015-02-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jbpm-designer: XXE in BPMN2 import"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
]
}
],
"cve": "CVE-2014-8114",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2014-11-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1169544"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the default implementation of FileUploadServlet and FileDownloadServlet provided by the UberFire Framework did not restrict the paths to which a file could be written or read from. In applications using this framework and exposing these servlets, a remote attacker could gain access to information stored in files accessible to the application container process, or execute arbitrary code by uploading malicious content.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "UberFire: Information disclosure and RCE via insecure file upload/download servlets",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-8114"
},
{
"category": "external",
"summary": "RHBZ#1169544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1169544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-8114",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-8114"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-8114",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8114"
}
],
"release_date": "2015-02-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "UberFire: Information disclosure and RCE via insecure file upload/download servlets"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
]
}
],
"cve": "CVE-2014-8115",
"cwe": {
"id": "CWE-285",
"name": "Improper Authorization"
},
"discovery_date": "2014-11-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1169545"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the default authorization constrains applied on servelets deployed in the KIE Workbench application were insufficient. A remote, authenticated user without sufficient privileges could use this flaw to upload or download arbitrary files, perform privileged actions that otherwise cannot be accessed, or perform other more complex attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Workbench: Insufficient authorization constraints",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat JBoss BRMS 5 is now in Phase 3, Extended Life Support, of its life cycle. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-8115"
},
{
"category": "external",
"summary": "RHBZ#1169545",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1169545"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-8115",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-8115"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-8115",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8115"
}
],
"release_date": "2015-02-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-17T22:27:36+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0235"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Workbench: Insufficient authorization constraints"
}
]
}
rhsa-2014_0833
Vulnerability from csaf_redhat
Published
2014-07-03 17:05
Modified
2024-11-10 17:24
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat6 security update
Notes
Topic
An update for the Apache Tomcat 6 component for Red Hat JBoss Web Server
2.0.1 that fixes three security issues is now available from the Red Hat
Customer Portal.
The Red Hat Security Response Team has rated this update as having Moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of
components for hosting Java web applications. It is comprised of the Apache
HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector
(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat
Native library.
It was discovered that Apache Tomcat did not limit the length of chunk
sizes when using chunked transfer encoding. A remote attacker could use
this flaw to perform a denial of service attack against Tomcat by streaming
an unlimited quantity of data, leading to excessive consumption of server
resources. (CVE-2014-0075)
It was found that Apache Tomcat did not check for overflowing values when
parsing request content length headers. A remote attacker could use this
flaw to perform an HTTP request smuggling attack on a Tomcat server located
behind a reverse proxy that processed the content length header correctly.
(CVE-2014-0099)
It was found that the org.apache.catalina.servlets.DefaultServlet
implementation in Apache Tomcat allowed the definition of XML External
Entities (XXEs) in provided XSLTs. A malicious application could use this
to circumvent intended security restrictions to disclose sensitive
information. (CVE-2014-0096)
The CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product
Security.
All users of Red Hat JBoss Web Server 2.0.1 as provided from the Red Hat
Customer Portal are advised to apply this update. The Red Hat JBoss Web
Server process must be restarted for the update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for the Apache Tomcat 6 component for Red Hat JBoss Web Server\n2.0.1 that fixes three security issues is now available from the Red Hat\nCustomer Portal.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of\ncomponents for hosting Java web applications. It is comprised of the Apache\nHTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector\n(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat\nNative library.\n\nIt was discovered that Apache Tomcat did not limit the length of chunk\nsizes when using chunked transfer encoding. A remote attacker could use\nthis flaw to perform a denial of service attack against Tomcat by streaming\nan unlimited quantity of data, leading to excessive consumption of server\nresources. (CVE-2014-0075)\n\nIt was found that Apache Tomcat did not check for overflowing values when\nparsing request content length headers. A remote attacker could use this\nflaw to perform an HTTP request smuggling attack on a Tomcat server located\nbehind a reverse proxy that processed the content length header correctly.\n(CVE-2014-0099)\n\nIt was found that the org.apache.catalina.servlets.DefaultServlet\nimplementation in Apache Tomcat allowed the definition of XML External\nEntities (XXEs) in provided XSLTs. A malicious application could use this\nto circumvent intended security restrictions to disclose sensitive\ninformation. (CVE-2014-0096)\n\nThe CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product\nSecurity.\n\nAll users of Red Hat JBoss Web Server 2.0.1 as provided from the Red Hat\nCustomer Portal are advised to apply this update. The Red Hat JBoss Web\nServer process must be restarted for the update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0833",
"url": "https://access.redhat.com/errata/RHSA-2014:0833"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver\u0026downloadType=securityPatches\u0026version=2.0.1",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver\u0026downloadType=securityPatches\u0026version=2.0.1"
},
{
"category": "external",
"summary": "1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0833.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat6 security update",
"tracking": {
"current_release_date": "2024-11-10T17:24:25+00:00",
"generator": {
"date": "2024-11-10T17:24:25+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2014:0833",
"initial_release_date": "2014-07-03T17:05:59+00:00",
"revision_history": [
{
"date": "2014-07-03T17:05:59+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:35:28+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-10T17:24:25+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 2.0",
"product": {
"name": "Red Hat JBoss Web Server 2.0",
"product_id": "Red Hat JBoss Web Server 2.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0075",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1072776"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0075"
},
{
"category": "external",
"summary": "RHBZ#1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-03T17:05:59+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files).",
"product_ids": [
"Red Hat JBoss Web Server 2.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0833"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 2.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter"
},
{
"cve": "CVE-2014-0096",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1088342"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0096"
},
{
"category": "external",
"summary": "RHBZ#1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-03T17:05:59+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files).",
"product_ids": [
"Red Hat JBoss Web Server 2.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0833"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 2.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs"
},
{
"cve": "CVE-2014-0099",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102030"
}
],
"notes": [
{
"category": "description",
"text": "It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Request smuggling via malicious content length header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0099"
},
{
"category": "external",
"summary": "RHBZ#1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-03T17:05:59+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files).",
"product_ids": [
"Red Hat JBoss Web Server 2.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0833"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 2.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Request smuggling via malicious content length header"
}
]
}
rhsa-2014_0836
Vulnerability from csaf_redhat
Published
2014-07-03 17:00
Modified
2024-11-10 17:24
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat7 security update
Notes
Topic
An update for the Apache Tomcat 7 component for Red Hat JBoss Web Server
2.0.1 that fixes three security issues is now available from the Red Hat
Customer Portal.
The Red Hat Security Response Team has rated this update as having Moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of
components for hosting Java web applications. It is comprised of the Apache
HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector
(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat
Native library.
It was discovered that Apache Tomcat did not limit the length of chunk
sizes when using chunked transfer encoding. A remote attacker could use
this flaw to perform a denial of service attack against Tomcat by streaming
an unlimited quantity of data, leading to excessive consumption of server
resources. (CVE-2014-0075)
It was found that Apache Tomcat did not check for overflowing values when
parsing request content length headers. A remote attacker could use this
flaw to perform an HTTP request smuggling attack on a Tomcat server located
behind a reverse proxy that processed the content length header correctly.
(CVE-2014-0099)
It was found that the org.apache.catalina.servlets.DefaultServlet
implementation in Apache Tomcat allowed the definition of XML External
Entities (XXEs) in provided XSLTs. A malicious application could use this
to circumvent intended security restrictions to disclose sensitive
information. (CVE-2014-0096)
The CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product
Security.
All users of Red Hat JBoss Web Server 2.0.1 as provided from the Red Hat
Customer Portal are advised to apply this update. The Red Hat JBoss Web
Server process must be restarted for the update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for the Apache Tomcat 7 component for Red Hat JBoss Web Server\n2.0.1 that fixes three security issues is now available from the Red Hat\nCustomer Portal.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of\ncomponents for hosting Java web applications. It is comprised of the Apache\nHTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector\n(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat\nNative library.\n\nIt was discovered that Apache Tomcat did not limit the length of chunk\nsizes when using chunked transfer encoding. A remote attacker could use\nthis flaw to perform a denial of service attack against Tomcat by streaming\nan unlimited quantity of data, leading to excessive consumption of server\nresources. (CVE-2014-0075)\n\nIt was found that Apache Tomcat did not check for overflowing values when\nparsing request content length headers. A remote attacker could use this\nflaw to perform an HTTP request smuggling attack on a Tomcat server located\nbehind a reverse proxy that processed the content length header correctly.\n(CVE-2014-0099)\n\nIt was found that the org.apache.catalina.servlets.DefaultServlet\nimplementation in Apache Tomcat allowed the definition of XML External\nEntities (XXEs) in provided XSLTs. A malicious application could use this\nto circumvent intended security restrictions to disclose sensitive\ninformation. (CVE-2014-0096)\n\nThe CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product\nSecurity.\n\nAll users of Red Hat JBoss Web Server 2.0.1 as provided from the Red Hat\nCustomer Portal are advised to apply this update. The Red Hat JBoss Web\nServer process must be restarted for the update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0836",
"url": "https://access.redhat.com/errata/RHSA-2014:0836"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver\u0026downloadType=securityPatches\u0026version=2.0.1",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver\u0026downloadType=securityPatches\u0026version=2.0.1"
},
{
"category": "external",
"summary": "1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0836.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat7 security update",
"tracking": {
"current_release_date": "2024-11-10T17:24:40+00:00",
"generator": {
"date": "2024-11-10T17:24:40+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2014:0836",
"initial_release_date": "2014-07-03T17:00:57+00:00",
"revision_history": [
{
"date": "2014-07-03T17:00:57+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:33:29+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-10T17:24:40+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 2.0",
"product": {
"name": "Red Hat JBoss Web Server 2.0",
"product_id": "Red Hat JBoss Web Server 2.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0075",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1072776"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0075"
},
{
"category": "external",
"summary": "RHBZ#1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-03T17:00:57+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files).",
"product_ids": [
"Red Hat JBoss Web Server 2.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0836"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 2.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter"
},
{
"cve": "CVE-2014-0096",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1088342"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0096"
},
{
"category": "external",
"summary": "RHBZ#1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-03T17:00:57+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files).",
"product_ids": [
"Red Hat JBoss Web Server 2.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0836"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 2.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs"
},
{
"cve": "CVE-2014-0099",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102030"
}
],
"notes": [
{
"category": "description",
"text": "It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Request smuggling via malicious content length header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0099"
},
{
"category": "external",
"summary": "RHBZ#1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-03T17:00:57+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files).",
"product_ids": [
"Red Hat JBoss Web Server 2.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0836"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 2.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Request smuggling via malicious content length header"
}
]
}
rhsa-2015_0675
Vulnerability from csaf_redhat
Published
2015-03-11 16:51
Modified
2024-11-22 07:09
Summary
Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.1.0 update
Notes
Topic
Red Hat JBoss Data Virtualization 6.1.0, which fixes multiple security
issues and various bugs, is now available from the Red Hat Customer Portal.
Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Red Hat JBoss Data Virtualization is a lean data integration solution that
provides easy, real-time, and unified data access across disparate sources
to multiple applications and users. JBoss Data Virtualization makes data
spread across physically distinct systems—such as multiple databases, XML
files, and even Hadoop systems—appear as a set of tables in a local
database.
The release of Red Hat JBoss Data Virtualization 6.1.0 serves as a
replacement for Red Hat JBoss Data Virtualization 6.0.0. It includes
various bug fixes, which are listed in the README file included with the
patch files.
The following security issues are also fixed with this release,
descriptions of which can be found on the respective CVE pages linked in
the References section.
CVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname
verification bypass, incomplete CVE-2012-5783 fix
CVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname
verification bypass, incomplete CVE-2012-6153 fix
CVE-2013-4002 Xerces-J2 OpenJDK: XML parsing Denial of Service (JAXP,
8017298)
CVE-2013-4517 Apache Santuario XML Security for Java: Java XML Signature
DoS Attack
CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of
user-supplied content in outputText tags and EL expressions
CVE-2014-0059 JBossSX/PicketBox: World readable audit.log file
CVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding
input filter
CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs
CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content
length header
CVE-2014-0119 Tomcat/JBossWeb: XML parser hijack by malicious web
application
CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation
CVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding
input filter
CVE-2014-3481 JBoss AS JAX-RS: Information disclosure via XML eXternal
Entity (XXE)
CVE-2014-3490 RESTEasy: XXE via parameter entities
CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage
CVE-2014-3623 Apache WSS4J / Apache CXF: Improper security semantics
enforcement of SAML SubjectConfirmation methods
CVE-2014-7839 RESTeasy: External entities expanded by DocumentProvider
CVE-2014-8122 JBoss Weld: Limited information disclosure via stale thread
state
Red Hat would like to thank James Roper of Typesafe for reporting
CVE-2014-0193, Alexander Papadakis for reporting CVE-2014-3530, and Rune
Steinseth of JProfessionals for reporting CVE-2014-8122. The CVE-2012-6153
issue was discovered by Florian Weimer of Red Hat Product Security, the
CVE-2014-0075 and CVE-2014-3490 issues were discovered by David Jorm of Red
Hat Product Security, and the CVE-2014-3481 issue was discovered by the Red
Hat JBoss Enterprise Application Platform QE team.
All users of Red Hat JBoss Data Virtualization 6.0.0 as provided from the
Red Hat Customer Portal are advised to apply this roll up patch.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Data Virtualization 6.1.0, which fixes multiple security\nissues and various bugs, is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Data Virtualization is a lean data integration solution that\nprovides easy, real-time, and unified data access across disparate sources\nto multiple applications and users. JBoss Data Virtualization makes data\nspread across physically distinct systems\u2014such as multiple databases, XML\nfiles, and even Hadoop systems\u2014appear as a set of tables in a local\ndatabase.\n\nThe release of Red Hat JBoss Data Virtualization 6.1.0 serves as a\nreplacement for Red Hat JBoss Data Virtualization 6.0.0. It includes\nvarious bug fixes, which are listed in the README file included with the\npatch files.\n\nThe following security issues are also fixed with this release,\ndescriptions of which can be found on the respective CVE pages linked in\nthe References section.\n\nCVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname\nverification bypass, incomplete CVE-2012-5783 fix\n\nCVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname\nverification bypass, incomplete CVE-2012-6153 fix\n\nCVE-2013-4002 Xerces-J2 OpenJDK: XML parsing Denial of Service (JAXP,\n8017298)\n\nCVE-2013-4517 Apache Santuario XML Security for Java: Java XML Signature\nDoS Attack\n\nCVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of\nuser-supplied content in outputText tags and EL expressions\n\nCVE-2014-0059 JBossSX/PicketBox: World readable audit.log file\n\nCVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding\ninput filter\n\nCVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs\n\nCVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content\nlength header\n\nCVE-2014-0119 Tomcat/JBossWeb: XML parser hijack by malicious web\napplication\n\nCVE-2014-0193 netty: DoS via memory exhaustion during data aggregation\n\nCVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding\ninput filter\n\nCVE-2014-3481 JBoss AS JAX-RS: Information disclosure via XML eXternal\nEntity (XXE)\n\nCVE-2014-3490 RESTEasy: XXE via parameter entities\n\nCVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage\n\nCVE-2014-3623 Apache WSS4J / Apache CXF: Improper security semantics\nenforcement of SAML SubjectConfirmation methods\n\nCVE-2014-7839 RESTeasy: External entities expanded by DocumentProvider\n\nCVE-2014-8122 JBoss Weld: Limited information disclosure via stale thread\nstate\n\nRed Hat would like to thank James Roper of Typesafe for reporting\nCVE-2014-0193, Alexander Papadakis for reporting CVE-2014-3530, and Rune\nSteinseth of JProfessionals for reporting CVE-2014-8122. The CVE-2012-6153\nissue was discovered by Florian Weimer of Red Hat Product Security, the\nCVE-2014-0075 and CVE-2014-3490 issues were discovered by David Jorm of Red\nHat Product Security, and the CVE-2014-3481 issue was discovered by the Red\nHat JBoss Enterprise Application Platform QE team.\n\nAll users of Red Hat JBoss Data Virtualization 6.0.0 as provided from the\nRed Hat Customer Portal are advised to apply this roll up patch.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:0675",
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform\u0026downloadType=distributions\u0026version=6.1.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform\u0026downloadType=distributions\u0026version=6.1.0"
},
{
"category": "external",
"summary": "1019176",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1019176"
},
{
"category": "external",
"summary": "1045257",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1045257"
},
{
"category": "external",
"summary": "1063642",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063642"
},
{
"category": "external",
"summary": "1065139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
},
{
"category": "external",
"summary": "1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "1105242",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1105242"
},
{
"category": "external",
"summary": "1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "external",
"summary": "1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "1157304",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1157304"
},
{
"category": "external",
"summary": "1165328",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1165328"
},
{
"category": "external",
"summary": "1169237",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1169237"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0675.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.1.0 update",
"tracking": {
"current_release_date": "2024-11-22T07:09:28+00:00",
"generator": {
"date": "2024-11-22T07:09:28+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2015:0675",
"initial_release_date": "2015-03-11T16:51:20+00:00",
"revision_history": [
{
"date": "2015-03-11T16:51:20+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:35:38+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T07:09:28+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Data Virtualization 6.1",
"product": {
"name": "Red Hat JBoss Data Virtualization 6.1",
"product_id": "Red Hat JBoss Data Virtualization 6.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_data_virtualization:6.1"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Data Virtualization"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Florian Weimer"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2012-6153",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2012-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129916"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-6153"
},
{
"category": "external",
"summary": "RHBZ#1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
}
],
"release_date": "2014-08-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
},
{
"cve": "CVE-2013-4002",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2013-10-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1019176"
}
],
"notes": [
{
"category": "description",
"text": "A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: XML parsing Denial of Service (JAXP, 8017298)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Fuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Server 4 and 5; Red Hat JBoss Enterprise Web Platform 5; Red Hat JBoss SOA Platform 4 and 5; and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4002"
},
{
"category": "external",
"summary": "RHBZ#1019176",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1019176"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4002",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002"
},
{
"category": "external",
"summary": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html"
}
],
"release_date": "2013-10-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "OpenJDK: XML parsing Denial of Service (JAXP, 8017298)"
},
{
"cve": "CVE-2013-4517",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2013-12-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1045257"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the Apache Santuario XML Security for Java project allowed Document Type Definitions (DTDs) to be processed when applying Transforms even when secure validation was enabled. A remote attacker could use this flaw to exhaust all available memory on the system, causing a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Java: Java XML Signature DoS Attack",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Fuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4, Fuse Mediation Router 2.7, 2.8 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nFuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 4; Red Hat JBoss Enterprise Data Services Platform 5; Red Hat JBoss Enterprise Portal Platform 4 and 5; and Red Hat JBoss Enterprise SOA Platform 4 and 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4517"
},
{
"category": "external",
"summary": "RHBZ#1045257",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1045257"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4517",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4517"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4517",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4517"
}
],
"release_date": "2013-11-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Java: Java XML Signature DoS Attack"
},
{
"cve": "CVE-2013-5855",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2014-02-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1065139"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Mojarra JavaServer Faces did not properly escape user-supplied content in certain circumstances. Contents of outputText tags and raw EL expressions that immediately follow script or style elements were not escaped. A remote attacker could use a specially crafted URL to execute arbitrary web script in the user\u0027s browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-5855"
},
{
"category": "external",
"summary": "RHBZ#1065139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-5855",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5855"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855"
},
{
"category": "external",
"summary": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209",
"url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209"
}
],
"release_date": "2014-02-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions"
},
{
"cve": "CVE-2014-0059",
"cwe": {
"id": "CWE-532",
"name": "Insertion of Sensitive Information into Log File"
},
"discovery_date": "2014-02-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1063642"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the security auditing functionality provided by PicketBox and JBossSX, both security frameworks for Java applications, used a world-readable audit.log file to record sensitive information. A local user could possibly use this flaw to gain access to the sensitive information in the audit.log file.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JBossSX/PicketBox: World readable audit.log file",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0059"
},
{
"category": "external",
"summary": "RHBZ#1063642",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063642"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0059",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0059"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0059",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0059"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "JBossSX/PicketBox: World readable audit.log file"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0075",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1072776"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0075"
},
{
"category": "external",
"summary": "RHBZ#1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter"
},
{
"cve": "CVE-2014-0096",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1088342"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0096"
},
{
"category": "external",
"summary": "RHBZ#1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs"
},
{
"cve": "CVE-2014-0099",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102030"
}
],
"notes": [
{
"category": "description",
"text": "It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Request smuggling via malicious content length header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0099"
},
{
"category": "external",
"summary": "RHBZ#1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Request smuggling via malicious content length header"
},
{
"cve": "CVE-2014-0119",
"cwe": {
"id": "CWE-470",
"name": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102038"
}
],
"notes": [
{
"category": "description",
"text": "It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XML parser hijack by malicious web application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0119"
},
{
"category": "external",
"summary": "RHBZ#1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0119",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0119"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XML parser hijack by malicious web application"
},
{
"acknowledgments": [
{
"names": [
"James Roper"
],
"organization": "Typesafe"
}
],
"cve": "CVE-2014-0193",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-04-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1092783"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: DoS via memory exhaustion during data aggregation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0193"
},
{
"category": "external",
"summary": "RHBZ#1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0193",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193"
}
],
"release_date": "2014-05-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "netty: DoS via memory exhaustion during data aggregation"
},
{
"cve": "CVE-2014-0227",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109196"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0227"
},
{
"category": "external",
"summary": "RHBZ#1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0227",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43",
"url": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55",
"url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55"
}
],
"release_date": "2015-02-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter"
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3481",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1105242"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the default context parameters as provided to RESTEasy deployments by JBoss EAP did not explicitly disable external entity expansion for RESTEasy. A remote attacker could use this flaw to perform XML External Entity (XXE) attacks on RESTEasy applications accepting XML input.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JAX-RS: Information disclosure via XML eXternal Entity (XXE)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3481"
},
{
"category": "external",
"summary": "RHBZ#1105242",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1105242"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3481",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3481"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3481",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3481"
}
],
"release_date": "2014-06-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "JAX-RS: Information disclosure via XML eXternal Entity (XXE)"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3490",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1107901"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTEasy: XXE via parameter entities",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3490"
},
{
"category": "external",
"summary": "RHBZ#1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3490",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3490"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490"
}
],
"release_date": "2014-07-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTEasy: XXE via parameter entities"
},
{
"acknowledgments": [
{
"names": [
"Alexander Papadakis"
]
}
],
"cve": "CVE-2014-3530",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1112987"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "PicketLink: XXE via insecure DocumentBuilderFactory usage",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw could allow remote, unauthenticated attackers to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. All systems hosting PicketLink applications using SAML Identity Providers and Service Providers may be affected. It is strongly advised that anyone running an affected system applies patches to address this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3530"
},
{
"category": "external",
"summary": "RHBZ#1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3530",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3530"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530"
}
],
"release_date": "2014-07-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "PicketLink: XXE via insecure DocumentBuilderFactory usage"
},
{
"cve": "CVE-2014-3577",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2014-08-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129074"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3577"
},
{
"category": "external",
"summary": "RHBZ#1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
}
],
"release_date": "2014-08-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
},
{
"cve": "CVE-2014-3578",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2014-08-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1131882"
}
],
"notes": [
{
"category": "description",
"text": "A directory traversal flaw was found in the Spring Framework. A remote attacker could use this flaw to access arbitrary files on a server, and bypassing security restrictions that are otherwise in place.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Framework: Directory traversal",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3578"
},
{
"category": "external",
"summary": "RHBZ#1131882",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131882"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3578",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3578"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3578",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3578"
},
{
"category": "external",
"summary": "http://www.pivotal.io/security/cve-2014-3578",
"url": "http://www.pivotal.io/security/cve-2014-3578"
},
{
"category": "external",
"summary": "https://jvn.jp/en/jp/JVN49154900/",
"url": "https://jvn.jp/en/jp/JVN49154900/"
}
],
"release_date": "2014-09-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Framework: Directory traversal"
},
{
"cve": "CVE-2014-3623",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2014-10-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1157304"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Apache WSS4J (Web Services Security for Java), as used by Apache CXF with the TransportBinding, did not, by default, properly enforce all security requirements associated with SAML SubjectConfirmation methods. A remote attacker could use this flaw to perform various types of spoofing attacks on web service endpoints secured by WSS4J that rely on SAML for authentication.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Fuse ESB Enterprise 7 is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss SOA Platform 5 and Red Hat JBoss BRMS 5 are now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware Product Life Cycle: https://access.redhat.com/support/policy/updates/jboss_notes/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3623"
},
{
"category": "external",
"summary": "RHBZ#1157304",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1157304"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3623",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3623"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3623",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3623"
}
],
"release_date": "2014-10-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods"
},
{
"cve": "CVE-2014-7839",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-11-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1165328"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the RESTEasy DocumentProvider did not set the external-parameter-entities and external-general-entities features appropriately, thus allowing external entity expansion. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XML eXternal Entity (XXE) attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTeasy: External entities expanded by DocumentProvider",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Web Framework Kit has moved out of maintenance phase and is no longer supported by Red Hat Product Security. This issue is not currently planned to be addressed in any future updates. For additional information, refer to the Red Hat JBoss Middleware Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-7839"
},
{
"category": "external",
"summary": "RHBZ#1165328",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1165328"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-7839",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-7839"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-7839",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7839"
}
],
"release_date": "2014-11-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTeasy: External entities expanded by DocumentProvider"
},
{
"acknowledgments": [
{
"names": [
"Rune Steinseth"
],
"organization": "JProfessionals"
}
],
"cve": "CVE-2014-8122",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2014-11-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1169237"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that under specific conditions the conversation state information stored in a thread-local variable in JBoss Weld was not sanitized correctly when the conversation ended. This could lead to a race condition that could potentially expose sensitive information from a previous conversation to the current conversation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Weld: Limited information disclosure via stale thread state",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Data Virtualization 6.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-8122"
},
{
"category": "external",
"summary": "RHBZ#1169237",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1169237"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-8122",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-8122"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-8122",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8122"
}
],
"release_date": "2014-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-03-11T16:51:20+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Data Virtualization installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Data Virtualization\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Data Virtualization server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Data Virtualization 6.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0675"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Data Virtualization 6.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Weld: Limited information disclosure via stale thread state"
}
]
}
rhsa-2014_0834
Vulnerability from csaf_redhat
Published
2014-07-03 17:01
Modified
2024-11-10 17:24
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat6 security and bug fix update
Notes
Topic
Updated tomcat6 packages that fix three security issues and one bug are now
available for Red Hat JBoss Web Server 2.0.1 on Red Hat Enterprise Linux 5
and 6.
The Red Hat Security Response Team has rated this update as having Moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of
components for hosting Java web applications. It is comprised of the Apache
HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector
(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat
Native library.
It was discovered that Apache Tomcat did not limit the length of chunk
sizes when using chunked transfer encoding. A remote attacker could use
this flaw to perform a denial of service attack against Tomcat by streaming
an unlimited quantity of data, leading to excessive consumption of server
resources. (CVE-2014-0075)
It was found that Apache Tomcat did not check for overflowing values when
parsing request content length headers. A remote attacker could use this
flaw to perform an HTTP request smuggling attack on a Tomcat server located
behind a reverse proxy that processed the content length header correctly.
(CVE-2014-0099)
It was found that the org.apache.catalina.servlets.DefaultServlet
implementation in Apache Tomcat allowed the definition of XML External
Entities (XXEs) in provided XSLTs. A malicious application could use this
to circumvent intended security restrictions to disclose sensitive
information. (CVE-2014-0096)
The CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product
Security.
This update also fixes the following bug:
The tomcat6-lib-6.0.37-19_patch_04.ep6.el5 package, provided as a
dependency of Red Hat JBoss Web Server 2.0.1, included a build of
commons-dbcp.jar that used an incorrect java package name, causing
applications using this dependency to not function properly. With this
update, the java package name has been corrected. (BZ#1101287)
All users of Red Hat JBoss Web Server 2.0.1 are advised to upgrade to these
updated tomcat6 packages, which contain backported patches to correct these
issues. The Red Hat JBoss Web Server process must be restarted for the
update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated tomcat6 packages that fix three security issues and one bug are now\navailable for Red Hat JBoss Web Server 2.0.1 on Red Hat Enterprise Linux 5\nand 6.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of\ncomponents for hosting Java web applications. It is comprised of the Apache\nHTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector\n(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat\nNative library.\n\nIt was discovered that Apache Tomcat did not limit the length of chunk\nsizes when using chunked transfer encoding. A remote attacker could use\nthis flaw to perform a denial of service attack against Tomcat by streaming\nan unlimited quantity of data, leading to excessive consumption of server\nresources. (CVE-2014-0075)\n\nIt was found that Apache Tomcat did not check for overflowing values when\nparsing request content length headers. A remote attacker could use this\nflaw to perform an HTTP request smuggling attack on a Tomcat server located\nbehind a reverse proxy that processed the content length header correctly.\n(CVE-2014-0099)\n\nIt was found that the org.apache.catalina.servlets.DefaultServlet\nimplementation in Apache Tomcat allowed the definition of XML External\nEntities (XXEs) in provided XSLTs. A malicious application could use this\nto circumvent intended security restrictions to disclose sensitive\ninformation. (CVE-2014-0096)\n\nThe CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product\nSecurity.\n\nThis update also fixes the following bug:\n\nThe tomcat6-lib-6.0.37-19_patch_04.ep6.el5 package, provided as a\ndependency of Red Hat JBoss Web Server 2.0.1, included a build of\ncommons-dbcp.jar that used an incorrect java package name, causing\napplications using this dependency to not function properly. With this\nupdate, the java package name has been corrected. (BZ#1101287)\n\nAll users of Red Hat JBoss Web Server 2.0.1 are advised to upgrade to these\nupdated tomcat6 packages, which contain backported patches to correct these\nissues. The Red Hat JBoss Web Server process must be restarted for the\nupdate to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0834",
"url": "https://access.redhat.com/errata/RHSA-2014:0834"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0834.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat6 security and bug fix update",
"tracking": {
"current_release_date": "2024-11-10T17:24:30+00:00",
"generator": {
"date": "2024-11-10T17:24:30+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2014:0834",
"initial_release_date": "2014-07-03T17:01:15+00:00",
"revision_history": [
{
"date": "2014-07-03T17:01:15+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2014-07-03T17:01:15+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-10T17:24:30+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product": {
"name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el5"
}
}
},
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product": {
"name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat6-lib-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product": {
"name": "tomcat6-lib-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product_id": "tomcat6-lib-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-lib@6.0.37-20_patch_04.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-docs-webapp-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product": {
"name": "tomcat6-docs-webapp-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product_id": "tomcat6-docs-webapp-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-docs-webapp@6.0.37-20_patch_04.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product": {
"name": "tomcat6-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product_id": "tomcat6-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-webapps@6.0.37-20_patch_04.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-servlet-2.5-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product": {
"name": "tomcat6-servlet-2.5-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product_id": "tomcat6-servlet-2.5-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-servlet-2.5-api@6.0.37-20_patch_04.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-admin-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product": {
"name": "tomcat6-admin-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product_id": "tomcat6-admin-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-admin-webapps@6.0.37-20_patch_04.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-jsp-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product": {
"name": "tomcat6-jsp-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product_id": "tomcat6-jsp-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-jsp-2.1-api@6.0.37-20_patch_04.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-el-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product": {
"name": "tomcat6-el-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product_id": "tomcat6-el-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-el-2.1-api@6.0.37-20_patch_04.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-log4j-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product": {
"name": "tomcat6-log4j-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product_id": "tomcat6-log4j-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-log4j@6.0.37-20_patch_04.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-javadoc-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product": {
"name": "tomcat6-javadoc-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product_id": "tomcat6-javadoc-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-javadoc@6.0.37-20_patch_04.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product": {
"name": "tomcat6-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product_id": "tomcat6-0:6.0.37-20_patch_04.ep6.el5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6@6.0.37-20_patch_04.ep6.el5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat6-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product_id": "tomcat6-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6@6.0.37-29_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-log4j-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat6-log4j-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product_id": "tomcat6-log4j-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-log4j@6.0.37-29_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-lib-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat6-lib-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product_id": "tomcat6-lib-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-lib@6.0.37-29_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-jsp-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat6-jsp-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product_id": "tomcat6-jsp-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-jsp-2.1-api@6.0.37-29_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat6-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product_id": "tomcat6-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-webapps@6.0.37-29_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-el-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat6-el-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product_id": "tomcat6-el-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-el-2.1-api@6.0.37-29_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-docs-webapp-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat6-docs-webapp-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product_id": "tomcat6-docs-webapp-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-docs-webapp@6.0.37-29_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-admin-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat6-admin-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product_id": "tomcat6-admin-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-admin-webapps@6.0.37-29_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-javadoc-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat6-javadoc-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product_id": "tomcat6-javadoc-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-javadoc@6.0.37-29_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-servlet-2.5-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat6-servlet-2.5-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product_id": "tomcat6-servlet-2.5-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-servlet-2.5-api@6.0.37-29_patch_05.ep6.el6?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat6-0:6.0.37-20_patch_04.ep6.el5.src",
"product": {
"name": "tomcat6-0:6.0.37-20_patch_04.ep6.el5.src",
"product_id": "tomcat6-0:6.0.37-20_patch_04.ep6.el5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6@6.0.37-20_patch_04.ep6.el5?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat6-0:6.0.37-29_patch_05.ep6.el6.src",
"product": {
"name": "tomcat6-0:6.0.37-29_patch_05.ep6.el6.src",
"product_id": "tomcat6-0:6.0.37-29_patch_05.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6@6.0.37-29_patch_05.ep6.el6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.37-20_patch_04.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-0:6.0.37-20_patch_04.ep6.el5.noarch"
},
"product_reference": "tomcat6-0:6.0.37-20_patch_04.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.37-20_patch_04.ep6.el5.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-0:6.0.37-20_patch_04.ep6.el5.src"
},
"product_reference": "tomcat6-0:6.0.37-20_patch_04.ep6.el5.src",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-admin-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch"
},
"product_reference": "tomcat6-admin-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-docs-webapp-0:6.0.37-20_patch_04.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-20_patch_04.ep6.el5.noarch"
},
"product_reference": "tomcat6-docs-webapp-0:6.0.37-20_patch_04.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-el-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch"
},
"product_reference": "tomcat6-el-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-javadoc-0:6.0.37-20_patch_04.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-20_patch_04.ep6.el5.noarch"
},
"product_reference": "tomcat6-javadoc-0:6.0.37-20_patch_04.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-jsp-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch"
},
"product_reference": "tomcat6-jsp-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-lib-0:6.0.37-20_patch_04.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-lib-0:6.0.37-20_patch_04.ep6.el5.noarch"
},
"product_reference": "tomcat6-lib-0:6.0.37-20_patch_04.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-log4j-0:6.0.37-20_patch_04.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-20_patch_04.ep6.el5.noarch"
},
"product_reference": "tomcat6-log4j-0:6.0.37-20_patch_04.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-servlet-2.5-api-0:6.0.37-20_patch_04.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-20_patch_04.ep6.el5.noarch"
},
"product_reference": "tomcat6-servlet-2.5-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server",
"product_id": "5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch"
},
"product_reference": "tomcat6-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"relates_to_product_reference": "5Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.37-29_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-0:6.0.37-29_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat6-0:6.0.37-29_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.37-29_patch_05.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-0:6.0.37-29_patch_05.ep6.el6.src"
},
"product_reference": "tomcat6-0:6.0.37-29_patch_05.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-admin-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat6-admin-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-docs-webapp-0:6.0.37-29_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-29_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat6-docs-webapp-0:6.0.37-29_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-el-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat6-el-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-javadoc-0:6.0.37-29_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-29_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat6-javadoc-0:6.0.37-29_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-jsp-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat6-jsp-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-lib-0:6.0.37-29_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-lib-0:6.0.37-29_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat6-lib-0:6.0.37-29_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-log4j-0:6.0.37-29_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-29_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat6-log4j-0:6.0.37-29_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-servlet-2.5-api-0:6.0.37-29_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-29_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat6-servlet-2.5-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat6-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0075",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1072776"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Server-JBEWS-2:tomcat6-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.37-20_patch_04.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.37-29_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0075"
},
{
"category": "external",
"summary": "RHBZ#1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-03T17:01:15+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"5Server-JBEWS-2:tomcat6-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.37-20_patch_04.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.37-29_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0834"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"5Server-JBEWS-2:tomcat6-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.37-20_patch_04.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.37-29_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter"
},
{
"cve": "CVE-2014-0096",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1088342"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Server-JBEWS-2:tomcat6-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.37-20_patch_04.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.37-29_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0096"
},
{
"category": "external",
"summary": "RHBZ#1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-03T17:01:15+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"5Server-JBEWS-2:tomcat6-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.37-20_patch_04.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.37-29_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0834"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"5Server-JBEWS-2:tomcat6-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.37-20_patch_04.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.37-29_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs"
},
{
"cve": "CVE-2014-0099",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102030"
}
],
"notes": [
{
"category": "description",
"text": "It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Request smuggling via malicious content length header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Server-JBEWS-2:tomcat6-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.37-20_patch_04.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.37-29_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0099"
},
{
"category": "external",
"summary": "RHBZ#1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-07-03T17:01:15+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"5Server-JBEWS-2:tomcat6-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.37-20_patch_04.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.37-29_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0834"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"5Server-JBEWS-2:tomcat6-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-0:6.0.37-20_patch_04.ep6.el5.src",
"5Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-lib-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-log4j-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-20_patch_04.ep6.el5.noarch",
"5Server-JBEWS-2:tomcat6-webapps-0:6.0.37-20_patch_04.ep6.el5.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-0:6.0.37-29_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat6-admin-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-docs-webapp-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-el-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-javadoc-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-jsp-2.1-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-lib-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-log4j-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-servlet-2.5-api-0:6.0.37-29_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat6-webapps-0:6.0.37-29_patch_05.ep6.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Request smuggling via malicious content length header"
}
]
}
rhsa-2015_1009
Vulnerability from csaf_redhat
Published
2015-05-14 15:14
Modified
2024-11-22 07:09
Summary
Red Hat Security Advisory: Red Hat JBoss Portal 6.2.0 update
Notes
Topic
Red Hat JBoss Portal 6.2.0, which fixes multiple security issues and
various bugs, is now available from the Red Hat Customer Portal.
Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Red Hat JBoss Portal is the open source implementation of the Java EE suite
of services and Portal services running atop Red Hat JBoss Enterprise
Application Platform.
Details
This release of Red Hat JBoss Portal 6.2.0 serves as a replacement for
Red Hat JBoss BPM Suite 6.1.1, and includes bug fixes and enhancements.
Refer to the Red Hat JBoss BPM Suite 6.2.0 Release Notes for information on
the most significant of these changes. The Release Notes are available at
https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Portal/
The following security issues are also fixed with this release,
descriptions of which can be found on the respective CVE pages linked in
the References section.
CVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass
CVE-2013-1624 bouncycastle: TLS CBC padding timing attack
CVE-2013-2133 JBoss WS: EJB3 role restrictions are not applied to jaxws
handlers
CVE-2013-4286 JBossWeb: multiple content-length header poisoning flaws
CVE-2013-5855 Mojarra JSF2: XSS due to insufficient escaping of
user-supplied content in outputText tags and EL expressions
CVE-2013-7285 XStream: remote code execution due to insecure XML
deserialization
CVE-2014-0005 PicketBox/JBossSX: Security domain authentication
configuration modifiable by application
CVE-2014-0018 JBoss AS Server: Unchecked access to MSC Service Registry
under JSM
CVE-2014-0034 Apache CXF: The SecurityTokenService accepts certain invalid
SAML Tokens as valid
CVE-2014-0035 Apache CXF: UsernameTokens are sent in plaintext with a
Symmetric EncryptBeforeSigning policy
CVE-2014-0050 JBossWeb: denial of service due to too-small buffer size used
bt MultipartStream
CVE-2014-0058 Red Hat JBoss EAP 6: Plain text password logging
CVE-2014-0059 PicketBox/JBossSX: World readable audit.log file
CVE-2014-0075 JBossWeb: Limited DoS in chunked transfer encoding input
filter
CVE-2014-0086 JBoss RichFaces: remote denial of service via memory
exhaustion
CVE-2014-0093 Red Hat JBoss EAP 6: JSM policy not respected by deployed
applications
CVE-2014-0096 JBossWeb: XXE vulnerability via user supplied XSLTs
CVE-2014-0099 JBossWeb: Request smuggling via malicious content length
header
CVE-2014-0107 Xalan-Java: insufficient constraints in secure processing
feature (oCERT-2014-002)
CVE-2014-0109 Apache CXF: HTML content posted to SOAP endpoint could cause
OOM errors
CVE-2014-0110 Apache CXF: Large invalid content fills temporary space
CVE-2014-0119 JBossWeb: XML parser hijack by malicious web application
CVE-2014-0193 Netty: DoS via memory exhaustion during data aggregation
CVE-2014-0227 JBossWeb: Limited DoS in chunked transfer encoding input
filter
CVE-2014-0245 GateIn WSRP: Information disclosure via unsafe concurrency
handling in interceptor
CVE-2014-3472 JBoss AS Controller: Invalid EJB caller role check
CVE-2014-3481 JBoss AS JAX RS Integration: Information disclosure via XML
XXE
CVE-2014-3490 RESTEasy: XXE via parameter entities
CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage
CVE-2014-3574 Apache POI: entity expansion (billion laughs) flaw
CVE-2014-3529 Apache POI: XXE flaw
CVE-2014-3577 Apache HttpComponents incomplete fix for CVE-2012-6153
CVE-2014-3586 JBoss AS CLI: Insecure default permissions on history file
CVE-2014-4172 Cas-client: Bypass of security constraints via URL parameter
injection
Red Hat would like to thank James Roper of Typesafe for reporting
CVE-2014-0193, CA Technologies for reporting CVE-2014-3472, and Alexander
Papadakis for reporting CVE-2014-3530. The CVE-2013-2133 issue was
discovered by Richard Opalka and Arun Neelicattu of Red Hat, the
CVE-2014-0005 issue was discovered by Josef Cacek of the Red Hat JBoss EAP
Quality Engineering team, the CVE-2014-0018 issue was discovered by Stuart
Douglas of Red Hat, the CVE-2014-3481 issue was discovered by the Red Hat
JBoss Enterprise Application Platform QE team, the CVE-2014-0075 and
CVE-2014-3490 issues were discovered by David Jorm of Red Hat Product
Security, and the CVE-2014-0093 issue was discovered by Josef Cacek of the
Red Hat JBoss EAP Quality Engineering team.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Portal 6.2.0, which fixes multiple security issues and\nvarious bugs, is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.\n\nRed Hat JBoss Portal is the open source implementation of the Java EE suite\nof services and Portal services running atop Red Hat JBoss Enterprise\nApplication Platform.",
"title": "Topic"
},
{
"category": "general",
"text": "This release of Red Hat JBoss Portal 6.2.0 serves as a replacement for\nRed Hat JBoss BPM Suite 6.1.1, and includes bug fixes and enhancements.\nRefer to the Red Hat JBoss BPM Suite 6.2.0 Release Notes for information on\nthe most significant of these changes. The Release Notes are available at\nhttps://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Portal/\n\nThe following security issues are also fixed with this release,\ndescriptions of which can be found on the respective CVE pages linked in\nthe References section.\n\nCVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass\n\nCVE-2013-1624 bouncycastle: TLS CBC padding timing attack\n\nCVE-2013-2133 JBoss WS: EJB3 role restrictions are not applied to jaxws\nhandlers\n\nCVE-2013-4286 JBossWeb: multiple content-length header poisoning flaws\n\nCVE-2013-5855 Mojarra JSF2: XSS due to insufficient escaping of\nuser-supplied content in outputText tags and EL expressions\n\nCVE-2013-7285 XStream: remote code execution due to insecure XML\ndeserialization\n\nCVE-2014-0005 PicketBox/JBossSX: Security domain authentication\nconfiguration modifiable by application\n\nCVE-2014-0018 JBoss AS Server: Unchecked access to MSC Service Registry\nunder JSM\n\nCVE-2014-0034 Apache CXF: The SecurityTokenService accepts certain invalid\nSAML Tokens as valid\n\nCVE-2014-0035 Apache CXF: UsernameTokens are sent in plaintext with a\nSymmetric EncryptBeforeSigning policy\n\nCVE-2014-0050 JBossWeb: denial of service due to too-small buffer size used\nbt MultipartStream\n\nCVE-2014-0058 Red Hat JBoss EAP 6: Plain text password logging\n\nCVE-2014-0059 PicketBox/JBossSX: World readable audit.log file\n\nCVE-2014-0075 JBossWeb: Limited DoS in chunked transfer encoding input\nfilter\n\nCVE-2014-0086 JBoss RichFaces: remote denial of service via memory\nexhaustion\n\nCVE-2014-0093 Red Hat JBoss EAP 6: JSM policy not respected by deployed\napplications\n\nCVE-2014-0096 JBossWeb: XXE vulnerability via user supplied XSLTs\n\nCVE-2014-0099 JBossWeb: Request smuggling via malicious content length\nheader\n\nCVE-2014-0107 Xalan-Java: insufficient constraints in secure processing\nfeature (oCERT-2014-002)\n\nCVE-2014-0109 Apache CXF: HTML content posted to SOAP endpoint could cause\nOOM errors\n\nCVE-2014-0110 Apache CXF: Large invalid content fills temporary space\n\nCVE-2014-0119 JBossWeb: XML parser hijack by malicious web application\n\nCVE-2014-0193 Netty: DoS via memory exhaustion during data aggregation\n\nCVE-2014-0227 JBossWeb: Limited DoS in chunked transfer encoding input\nfilter\n\nCVE-2014-0245 GateIn WSRP: Information disclosure via unsafe concurrency\nhandling in interceptor\n\nCVE-2014-3472 JBoss AS Controller: Invalid EJB caller role check\n\nCVE-2014-3481 JBoss AS JAX RS Integration: Information disclosure via XML\nXXE\n\nCVE-2014-3490 RESTEasy: XXE via parameter entities\n\nCVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage\n\nCVE-2014-3574 Apache POI: entity expansion (billion laughs) flaw\n\nCVE-2014-3529 Apache POI: XXE flaw\n\nCVE-2014-3577 Apache HttpComponents incomplete fix for CVE-2012-6153\n\nCVE-2014-3586 JBoss AS CLI: Insecure default permissions on history file\n\nCVE-2014-4172 Cas-client: Bypass of security constraints via URL parameter\ninjection\n\nRed Hat would like to thank James Roper of Typesafe for reporting\nCVE-2014-0193, CA Technologies for reporting CVE-2014-3472, and Alexander\nPapadakis for reporting CVE-2014-3530. The CVE-2013-2133 issue was\ndiscovered by Richard Opalka and Arun Neelicattu of Red Hat, the\nCVE-2014-0005 issue was discovered by Josef Cacek of the Red Hat JBoss EAP\nQuality Engineering team, the CVE-2014-0018 issue was discovered by Stuart\nDouglas of Red Hat, the CVE-2014-3481 issue was discovered by the Red Hat\nJBoss Enterprise Application Platform QE team, the CVE-2014-0075 and\nCVE-2014-3490 issues were discovered by David Jorm of Red Hat Product\nSecurity, and the CVE-2014-0093 issue was discovered by Josef Cacek of the\nRed Hat JBoss EAP Quality Engineering team.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:1009",
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal\u0026downloadType=distributions",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal\u0026downloadType=distributions"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Portal/",
"url": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Portal/"
},
{
"category": "external",
"summary": "908428",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=908428"
},
{
"category": "external",
"summary": "969924",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=969924"
},
{
"category": "external",
"summary": "1049736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049736"
},
{
"category": "external",
"summary": "1051277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
},
{
"category": "external",
"summary": "1052783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1052783"
},
{
"category": "external",
"summary": "1058454",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1058454"
},
{
"category": "external",
"summary": "1062337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
},
{
"category": "external",
"summary": "1063641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063641"
},
{
"category": "external",
"summary": "1063642",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063642"
},
{
"category": "external",
"summary": "1065139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
},
{
"category": "external",
"summary": "1067268",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1067268"
},
{
"category": "external",
"summary": "1069921",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
},
{
"category": "external",
"summary": "1070046",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1070046"
},
{
"category": "external",
"summary": "1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "1080248",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1080248"
},
{
"category": "external",
"summary": "1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "1093526",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093526"
},
{
"category": "external",
"summary": "1093527",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093527"
},
{
"category": "external",
"summary": "1093529",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093529"
},
{
"category": "external",
"summary": "1093530",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093530"
},
{
"category": "external",
"summary": "1101303",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1101303"
},
{
"category": "external",
"summary": "1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "1103815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103815"
},
{
"category": "external",
"summary": "1105242",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1105242"
},
{
"category": "external",
"summary": "1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "external",
"summary": "1126687",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1126687"
},
{
"category": "external",
"summary": "1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "1131350",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131350"
},
{
"category": "external",
"summary": "1138135",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1138135"
},
{
"category": "external",
"summary": "1138140",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1138140"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1009.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Portal 6.2.0 update",
"tracking": {
"current_release_date": "2024-11-22T07:09:13+00:00",
"generator": {
"date": "2024-11-22T07:09:13+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2015:1009",
"initial_release_date": "2015-05-14T15:14:47+00:00",
"revision_history": [
{
"date": "2015-05-14T15:14:47+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:35:39+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T07:09:13+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Portal 6.2",
"product": {
"name": "Red Hat JBoss Portal 6.2",
"product_id": "Red Hat JBoss Portal 6.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_portal_platform:6.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Portal"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Florian Weimer"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2012-6153",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2012-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129916"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-6153"
},
{
"category": "external",
"summary": "RHBZ#1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
}
],
"release_date": "2014-08-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
},
{
"cve": "CVE-2013-1624",
"cwe": {
"id": "CWE-385",
"name": "Covert Timing Channel"
},
"discovery_date": "2013-02-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "908428"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that bouncycastle leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: TLS CBC padding timing attack",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-1624"
},
{
"category": "external",
"summary": "RHBZ#908428",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=908428"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-1624",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-1624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1624"
},
{
"category": "external",
"summary": "http://www.isg.rhul.ac.uk/tls/",
"url": "http://www.isg.rhul.ac.uk/tls/"
},
{
"category": "external",
"summary": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf",
"url": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf"
}
],
"release_date": "2013-02-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "bouncycastle: TLS CBC padding timing attack"
},
{
"acknowledgments": [
{
"names": [
"Richard Opalka"
]
},
{
"names": [
"Arun Neelicattu"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2013-2133",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2013-06-03T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "969924"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the way method-level authorization for JAX-WS Service endpoints was performed by the EJB invocation handler implementation. Any restrictions declared on EJB methods were ignored when executing the JAX-WS handlers, and only class-level restrictions were applied. A remote attacker who is authorized to access the EJB class, could invoke a JAX-WS handler which they were not authorized to invoke.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "WS: EJB3 role restrictions are not applied to jaxws handlers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 4 and 5; Red Hat JBoss Enterprise Portal Platform 5; and Red Hat JBoss Enterprise SOA Platform 4 and 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-2133"
},
{
"category": "external",
"summary": "RHBZ#969924",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=969924"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-2133",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-2133"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-2133",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2133"
}
],
"release_date": "2013-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "WS: EJB3 role restrictions are not applied to jaxws handlers"
},
{
"cve": "CVE-2013-4286",
"discovery_date": "2014-02-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1069921"
}
],
"notes": [
{
"category": "description",
"text": "It was found that when Tomcat / JBoss Web processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encoding header, Tomcat / JBoss Web would incorrectly handle the request. A remote attacker could use this flaw to poison a web cache, perform cross-site scripting (XSS) attacks, or obtain sensitive information from other requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: multiple content-length header poisoning flaws",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4286"
},
{
"category": "external",
"summary": "RHBZ#1069921",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4286",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4286"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286"
}
],
"release_date": "2014-02-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: multiple content-length header poisoning flaws"
},
{
"cve": "CVE-2013-5855",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2014-02-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1065139"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Mojarra JavaServer Faces did not properly escape user-supplied content in certain circumstances. Contents of outputText tags and raw EL expressions that immediately follow script or style elements were not escaped. A remote attacker could use a specially crafted URL to execute arbitrary web script in the user\u0027s browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-5855"
},
{
"category": "external",
"summary": "RHBZ#1065139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065139"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-5855",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5855"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5855"
},
{
"category": "external",
"summary": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209",
"url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209"
}
],
"release_date": "2014-02-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions"
},
{
"cve": "CVE-2013-7285",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2013-12-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1051277"
}
],
"notes": [
{
"category": "description",
"text": "It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "XStream: remote code execution due to insecure XML deserialization",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-7285"
},
{
"category": "external",
"summary": "RHBZ#1051277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-7285",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-7285"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285"
},
{
"category": "external",
"summary": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html",
"url": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html"
},
{
"category": "external",
"summary": "http://xstream.codehaus.org/security.html",
"url": "http://xstream.codehaus.org/security.html"
},
{
"category": "external",
"summary": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/",
"url": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/"
}
],
"release_date": "2013-12-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "XStream: remote code execution due to insecure XML deserialization"
},
{
"acknowledgments": [
{
"names": [
"Josef Cacek"
],
"organization": "Red Hat JBoss EAP Quality Engineering team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0005",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2014-01-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049736"
}
],
"notes": [
{
"category": "description",
"text": "It was identified that PicketBox/JBossSX allowed any deployed application to alter or read the underlying application server configuration and state without any authorization checks. An attacker able to deploy applications could use this flaw to circumvent security constraints applied to other applications deployed on the same system, disclose privileged information, and in certain cases allow arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0005"
},
{
"category": "external",
"summary": "RHBZ#1049736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0005",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0005"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0005",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0005"
}
],
"release_date": "2014-03-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 3.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application"
},
{
"acknowledgments": [
{
"names": [
"Stuart Douglas"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0018",
"discovery_date": "2014-01-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1052783"
}
],
"notes": [
{
"category": "description",
"text": "In Red Hat JBoss Enterprise Application Platform, when running under a security manager, it was possible for deployed code to get access to the Modular Service Container (MSC) service registry without any permission checks. This could allow malicious deployments to modify the internal state of the server in various ways.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jboss-as-server: Unchecked access to MSC Service Registry under JSM",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0018"
},
{
"category": "external",
"summary": "RHBZ#1052783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1052783"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0018",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0018"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0018",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0018"
}
],
"release_date": "2014-01-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 1.9,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "jboss-as-server: Unchecked access to MSC Service Registry under JSM"
},
{
"cve": "CVE-2014-0034",
"cwe": {
"id": "CWE-345",
"name": "Insufficient Verification of Data Authenticity"
},
"discovery_date": "2014-05-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1093529"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the SecurityTokenService (STS), provided as a part of Apache CXF, could under certain circumstances accept invalid SAML tokens as valid. A remote attacker could use a specially crafted SAML token to gain access to an application that uses STS for validation of SAML tokens.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0034"
},
{
"category": "external",
"summary": "RHBZ#1093529",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093529"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0034",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0034"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0034",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0034"
}
],
"release_date": "2014-05-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid"
},
{
"cve": "CVE-2014-0035",
"cwe": {
"id": "CWE-522",
"name": "Insufficiently Protected Credentials"
},
"discovery_date": "2014-05-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1093530"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that UsernameTokens were sent in plain text by an Apache CXF client that used a Symmetric EncryptBeforeSigning password policy. A man-in-the-middle attacker could use this flaw to obtain the user name and password used by the client application using Apache CXF.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0035"
},
{
"category": "external",
"summary": "RHBZ#1093530",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093530"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0035",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0035"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0035",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0035"
}
],
"release_date": "2014-05-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy"
},
{
"cve": "CVE-2014-0050",
"discovery_date": "2014-02-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1062337"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in the way Apache Commons FileUpload, which is embedded in Tomcat and JBoss Web, handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing Tomcat to enter an infinite loop when processing such an incoming request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0050"
},
{
"category": "external",
"summary": "RHBZ#1062337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0050",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0050"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050"
}
],
"release_date": "2014-02-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream"
},
{
"cve": "CVE-2014-0058",
"discovery_date": "2014-02-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1063641"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain application or server authentication credentials.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "EAP6: Plain text password logging during security audit",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0058"
},
{
"category": "external",
"summary": "RHBZ#1063641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0058",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0058"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0058",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0058"
}
],
"release_date": "2014-02-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 1.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "EAP6: Plain text password logging during security audit"
},
{
"cve": "CVE-2014-0059",
"cwe": {
"id": "CWE-532",
"name": "Insertion of Sensitive Information into Log File"
},
"discovery_date": "2014-02-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1063642"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the security auditing functionality provided by PicketBox and JBossSX, both security frameworks for Java applications, used a world-readable audit.log file to record sensitive information. A local user could possibly use this flaw to gain access to the sensitive information in the audit.log file.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JBossSX/PicketBox: World readable audit.log file",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0059"
},
{
"category": "external",
"summary": "RHBZ#1063642",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063642"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0059",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0059"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0059",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0059"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "JBossSX/PicketBox: World readable audit.log file"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0075",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1072776"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0075"
},
{
"category": "external",
"summary": "RHBZ#1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter"
},
{
"cve": "CVE-2014-0086",
"discovery_date": "2014-02-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1067268"
}
],
"notes": [
{
"category": "description",
"text": "It was found that certain malformed requests caused RichFaces to leak memory. A remote, unauthenticated attacker could use this flaw to send a large number of malformed requests to a RichFaces application that uses the Atmosphere framework, leading to a denial of service (excessive memory consumption) on the application server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RichFaces: remote denial of service via memory exhaustion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0086"
},
{
"category": "external",
"summary": "RHBZ#1067268",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1067268"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0086",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0086"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0086",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0086"
}
],
"release_date": "2014-02-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RichFaces: remote denial of service via memory exhaustion"
},
{
"acknowledgments": [
{
"names": [
"Josef Cacek"
],
"organization": "Red Hat JBoss EAP Quality Engineering team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0093",
"discovery_date": "2014-02-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1070046"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Java Security Manager permissions configured via a policy file were not properly applied, causing all deployed applications to be granted the java.security.AllPermission permission. In certain cases, an attacker could use this flaw to circumvent expected security measures to perform actions which would otherwise be restricted.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "6: JSM policy not respected by deployed applications",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0093"
},
{
"category": "external",
"summary": "RHBZ#1070046",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1070046"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0093",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0093"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0093",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0093"
}
],
"release_date": "2014-02-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "6: JSM policy not respected by deployed applications"
},
{
"cve": "CVE-2014-0096",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1088342"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0096"
},
{
"category": "external",
"summary": "RHBZ#1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs"
},
{
"cve": "CVE-2014-0099",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102030"
}
],
"notes": [
{
"category": "description",
"text": "It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Request smuggling via malicious content length header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0099"
},
{
"category": "external",
"summary": "RHBZ#1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Request smuggling via malicious content length header"
},
{
"cve": "CVE-2014-0107",
"cwe": {
"id": "CWE-358",
"name": "Improperly Implemented Security Check for Standard"
},
"discovery_date": "2014-03-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1080248"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the secure processing feature of Xalan-Java had insufficient restrictions defined for certain properties and features. A remote attacker able to provide Extensible Stylesheet Language Transformations (XSLT) content to be processed by an application using Xalan-Java could use this flaw to bypass the intended constraints of the secure processing feature. Depending on the components available in the classpath, this could lead to arbitrary remote code execution in the context of the application server running the application that uses Xalan-Java.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Xalan-Java: insufficient constraints in secure processing feature",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0107"
},
{
"category": "external",
"summary": "RHBZ#1080248",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1080248"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0107",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0107"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0107",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0107"
},
{
"category": "external",
"summary": "http://www.ocert.org/advisories/ocert-2014-002.html",
"url": "http://www.ocert.org/advisories/ocert-2014-002.html"
}
],
"release_date": "2014-03-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Xalan-Java: insufficient constraints in secure processing feature"
},
{
"cve": "CVE-2014-0109",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2014-05-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1093526"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in the way Apache CXF created error messages for certain POST requests. A remote attacker could send a specially crafted request which, when processed by an application using Apache CXF, could consume an excessive amount of memory on the system, possibly triggering an Out Of Memory (OOM) error.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: HTML content posted to SOAP endpoint could cause OOM errors",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0109"
},
{
"category": "external",
"summary": "RHBZ#1093526",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093526"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0109",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0109"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0109",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0109"
}
],
"release_date": "2014-05-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "CXF: HTML content posted to SOAP endpoint could cause OOM errors"
},
{
"cve": "CVE-2014-0110",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-05-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1093527"
}
],
"notes": [
{
"category": "description",
"text": "It was found that when a large invalid SOAP message was processed by Apache CXF, it could be saved to a temporary file in the /tmp directory. A remote attacker could send a specially crafted SOAP message that, when processed by an application using Apache CXF, would use an excessive amount of disk space, possibly causing a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: Large invalid content could cause temporary space to fill",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0110"
},
{
"category": "external",
"summary": "RHBZ#1093527",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093527"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0110",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0110"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0110",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0110"
}
],
"release_date": "2014-05-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "CXF: Large invalid content could cause temporary space to fill"
},
{
"cve": "CVE-2014-0119",
"cwe": {
"id": "CWE-470",
"name": "Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102038"
}
],
"notes": [
{
"category": "description",
"text": "It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XML parser hijack by malicious web application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0119"
},
{
"category": "external",
"summary": "RHBZ#1102038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102038"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0119",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0119"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0119"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XML parser hijack by malicious web application"
},
{
"acknowledgments": [
{
"names": [
"James Roper"
],
"organization": "Typesafe"
}
],
"cve": "CVE-2014-0193",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-04-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1092783"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: DoS via memory exhaustion during data aggregation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0193"
},
{
"category": "external",
"summary": "RHBZ#1092783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092783"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0193",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0193"
}
],
"release_date": "2014-05-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "netty: DoS via memory exhaustion during data aggregation"
},
{
"cve": "CVE-2014-0227",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1109196"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0227"
},
{
"category": "external",
"summary": "RHBZ#1109196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109196"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0227",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0227"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43",
"url": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55",
"url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55"
}
],
"release_date": "2015-02-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter"
},
{
"cve": "CVE-2014-0245",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"discovery_date": "2014-05-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1101303"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe. For a specific WSRP endpoint, under high-concurrency scenarios or scenarios where SOAP messages take long to execute, it was possible for an unauthenticated remote attacker to gain privileged information if WS-Security is enabled for the WSRP Consumer, and the endpoint in question is being used by a privileged user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "WSRP: Information disclosure via unsafe concurrency handling in interceptor",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0245"
},
{
"category": "external",
"summary": "RHBZ#1101303",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1101303"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0245",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0245"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0245",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0245"
}
],
"release_date": "2015-03-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "WSRP: Information disclosure via unsafe concurrency handling in interceptor"
},
{
"acknowledgments": [
{
"names": [
"CA Technologies"
]
}
],
"cve": "CVE-2014-3472",
"cwe": {
"id": "CWE-184",
"name": "Incomplete List of Disallowed Inputs"
},
"discovery_date": "2014-05-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1103815"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the isCallerInRole() method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Security: Invalid EJB caller role check implementation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3472"
},
{
"category": "external",
"summary": "RHBZ#1103815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3472",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3472"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3472",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3472"
}
],
"release_date": "2014-08-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Security: Invalid EJB caller role check implementation"
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3481",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1105242"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the default context parameters as provided to RESTEasy deployments by JBoss EAP did not explicitly disable external entity expansion for RESTEasy. A remote attacker could use this flaw to perform XML External Entity (XXE) attacks on RESTEasy applications accepting XML input.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "JAX-RS: Information disclosure via XML eXternal Entity (XXE)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3481"
},
{
"category": "external",
"summary": "RHBZ#1105242",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1105242"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3481",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3481"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3481",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3481"
}
],
"release_date": "2014-06-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "JAX-RS: Information disclosure via XML eXternal Entity (XXE)"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-3490",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1107901"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTEasy: XXE via parameter entities",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3490"
},
{
"category": "external",
"summary": "RHBZ#1107901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107901"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3490",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3490"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3490"
}
],
"release_date": "2014-07-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTEasy: XXE via parameter entities"
},
{
"cve": "CVE-2014-3529",
"discovery_date": "2014-09-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1138135"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Apache POI would resolve entities in OOXML documents. A remote attacker able to supply OOXML documents that are parsed by Apache POI could use this flaw to read files accessible to the user running the application server, and potentially perform more advanced XML External Entity (XXE) attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "apache-poi: XML eXternal Entity (XXE) flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has determined that CVE-2014-3529 is not exploitable by default in JBoss Portal Platform as provided by Red Hat. This flaw would only be exploitable if the Apache POI library provided by JBoss Portal Platform were used by a custom application to process user-supplied XML documents.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3529"
},
{
"category": "external",
"summary": "RHBZ#1138135",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1138135"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3529",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3529"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3529",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3529"
}
],
"release_date": "2014-08-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "apache-poi: XML eXternal Entity (XXE) flaw"
},
{
"acknowledgments": [
{
"names": [
"Alexander Papadakis"
]
}
],
"cve": "CVE-2014-3530",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-06-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1112987"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "PicketLink: XXE via insecure DocumentBuilderFactory usage",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw could allow remote, unauthenticated attackers to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. All systems hosting PicketLink applications using SAML Identity Providers and Service Providers may be affected. It is strongly advised that anyone running an affected system applies patches to address this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3530"
},
{
"category": "external",
"summary": "RHBZ#1112987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112987"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3530",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3530"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530"
}
],
"release_date": "2014-07-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "PicketLink: XXE via insecure DocumentBuilderFactory usage"
},
{
"cve": "CVE-2014-3574",
"discovery_date": "2014-09-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1138140"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Apache POI would expand an unlimited number of entities in OOXML documents. A remote attacker able to supply OOXML documents that are parsed by Apache POI could use this flaw to trigger a denial of service attack via excessive CPU and memory consumption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "apache-poi: entity expansion (billion laughs) flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has determined that CVE-2014-3574 is not exploitable by default in JBoss Portal Platform as provided by Red Hat. This flaw would only be exploitable if the Apache POI library provided by JBoss Portal Platform were used by a custom application to process user-supplied XML documents.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3574"
},
{
"category": "external",
"summary": "RHBZ#1138140",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1138140"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3574",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3574"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3574",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3574"
}
],
"release_date": "2014-08-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "apache-poi: entity expansion (billion laughs) flaw"
},
{
"cve": "CVE-2014-3577",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2014-08-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129074"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3577"
},
{
"category": "external",
"summary": "RHBZ#1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
}
],
"release_date": "2014-08-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
},
{
"cve": "CVE-2014-3586",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"discovery_date": "2014-07-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1126687"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the Command Line Interface, as provided by Red Hat Enterprise Application Platform, created a history file named .jboss-cli-history in the user\u0027s home directory with insecure default file permissions. This could allow a malicious local user to gain information otherwise not accessible to them.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CLI: Insecure default permissions on history file",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3586"
},
{
"category": "external",
"summary": "RHBZ#1126687",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1126687"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3586",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3586"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3586",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3586"
}
],
"release_date": "2015-03-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "CLI: Insecure default permissions on history file"
},
{
"cve": "CVE-2014-4172",
"discovery_date": "2014-08-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1131350"
}
],
"notes": [
{
"category": "description",
"text": "A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cas-client: Bypass of security constraints via URL parameter injection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-4172"
},
{
"category": "external",
"summary": "RHBZ#1131350",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131350"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-4172",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4172"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-4172",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4172"
},
{
"category": "external",
"summary": "https://www.mail-archive.com/cas-user@lists.jasig.org/msg17338.html",
"url": "https://www.mail-archive.com/cas-user@lists.jasig.org/msg17338.html"
}
],
"release_date": "2014-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "cas-client: Bypass of security constraints via URL parameter injection"
},
{
"cve": "CVE-2014-7839",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-11-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1165328"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the RESTEasy DocumentProvider did not set the external-parameter-entities and external-general-entities features appropriately, thus allowing external entity expansion. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XML eXternal Entity (XXE) attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTeasy: External entities expanded by DocumentProvider",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Web Framework Kit has moved out of maintenance phase and is no longer supported by Red Hat Product Security. This issue is not currently planned to be addressed in any future updates. For additional information, refer to the Red Hat JBoss Middleware Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-7839"
},
{
"category": "external",
"summary": "RHBZ#1165328",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1165328"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-7839",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-7839"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-7839",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7839"
}
],
"release_date": "2014-11-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTeasy: External entities expanded by DocumentProvider"
},
{
"cve": "CVE-2015-0226",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2015-02-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1191446"
}
],
"notes": [
{
"category": "description",
"text": "It was found that a prior countermeasure in Apache WSS4J for Bleichenbacher\u0027s attack on XML Encryption (CVE-2011-2487) threw an exception that permitted an attacker to determine the failure of the attempted attack, thereby leaving WSS4J vulnerable to the attack. The original flaw allowed a remote attacker to recover the entire plain text form of a symmetric key.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "wss4j: Apache WSS4J is vulnerable to Bleichenbacher\u0027s attack (incomplete fix for CVE-2011-2487)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-0226"
},
{
"category": "external",
"summary": "RHBZ#1191446",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1191446"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-0226",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-0226"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-0226",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0226"
}
],
"release_date": "2015-02-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 7.8,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "wss4j: Apache WSS4J is vulnerable to Bleichenbacher\u0027s attack (incomplete fix for CVE-2011-2487)"
},
{
"cve": "CVE-2015-0227",
"cwe": {
"id": "CWE-358",
"name": "Improperly Implemented Security Check for Standard"
},
"discovery_date": "2015-02-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1191451"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Apache WSS4J permitted bypass of the requireSignedEncryptedDataElements configuration property via XML Signature wrapping attacks. A remote attacker could use this flaw to modify the contents of a signed request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "wss4j: Apache WSS4J doesn\u0027t correctly enforce the requireSignedEncryptedDataElements property",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 6.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-0227"
},
{
"category": "external",
"summary": "RHBZ#1191451",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1191451"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-0227",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-0227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-0227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0227"
}
],
"release_date": "2015-02-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-05-14T15:14:47+00:00",
"details": "All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.",
"product_ids": [
"Red Hat JBoss Portal 6.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:1009"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 6.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "wss4j: Apache WSS4J doesn\u0027t correctly enforce the requireSignedEncryptedDataElements property"
}
]
}
gsd-2014-0096
Vulnerability from gsd
Modified
2023-12-13 01:22
Details
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2014-0096",
"description": "java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"id": "GSD-2014-0096",
"references": [
"https://www.suse.com/security/cve/CVE-2014-0096.html",
"https://www.debian.org/security/2016/dsa-3530",
"https://access.redhat.com/errata/RHSA-2015:1009",
"https://access.redhat.com/errata/RHSA-2015:0765",
"https://access.redhat.com/errata/RHSA-2015:0720",
"https://access.redhat.com/errata/RHSA-2015:0675",
"https://access.redhat.com/errata/RHSA-2015:0235",
"https://access.redhat.com/errata/RHSA-2015:0234",
"https://access.redhat.com/errata/RHSA-2014:0895",
"https://access.redhat.com/errata/RHSA-2014:0865",
"https://access.redhat.com/errata/RHSA-2014:0843",
"https://access.redhat.com/errata/RHSA-2014:0842",
"https://access.redhat.com/errata/RHSA-2014:0836",
"https://access.redhat.com/errata/RHSA-2014:0835",
"https://access.redhat.com/errata/RHSA-2014:0834",
"https://access.redhat.com/errata/RHSA-2014:0833",
"https://access.redhat.com/errata/RHSA-2014:0827",
"https://ubuntu.com/security/CVE-2014-0096",
"https://advisories.mageia.org/CVE-2014-0096.html",
"https://alas.aws.amazon.com/cve/html/CVE-2014-0096.html",
"https://linux.oracle.com/cve/CVE-2014-0096.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2014-0096"
],
"details": "java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"id": "GSD-2014-0096",
"modified": "2023-12-13T01:22:44.963971Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2014-0096",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://advisories.mageia.org/MGASA-2014-0268.html",
"refsource": "CONFIRM",
"url": "http://advisories.mageia.org/MGASA-2014-0268.html"
},
{
"name": "http://www.novell.com/support/kb/doc.php?id=7010166",
"refsource": "CONFIRM",
"url": "http://www.novell.com/support/kb/doc.php?id=7010166"
},
{
"name": "67667",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/67667"
},
{
"name": "59121",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59121"
},
{
"name": "RHSA-2015:0765",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0765.html"
},
{
"name": "59732",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59732"
},
{
"name": "59835",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59835"
},
{
"name": "RHSA-2015:0675",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0675.html"
},
{
"name": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html",
"refsource": "CONFIRM",
"url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"
},
{
"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21681528",
"refsource": "CONFIRM",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681528"
},
{
"name": "MDVSA-2015:052",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:052"
},
{
"name": "RHSA-2015:0720",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0720.html"
},
{
"name": "59849",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59849"
},
{
"name": "http://linux.oracle.com/errata/ELSA-2014-0865.html",
"refsource": "CONFIRM",
"url": "http://linux.oracle.com/errata/ELSA-2014-0865.html"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578637",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578637"
},
{
"name": "MDVSA-2015:084",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:084"
},
{
"name": "1030301",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1030301"
},
{
"name": "DSA-3530",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"name": "59678",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59678"
},
{
"name": "HPSBUX03102",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=141017844705317\u0026w=2"
},
{
"name": "http://tomcat.apache.org/security-7.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-7.html"
},
{
"name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"
},
{
"name": "MDVSA-2015:053",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:053"
},
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"name": "FEDORA-2015-2109",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html"
},
{
"name": "http://tomcat.apache.org/security-8.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-8.html"
},
{
"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21678231",
"refsource": "CONFIRM",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678231"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1585853",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1585853"
},
{
"name": "59616",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59616"
},
{
"name": "20140527 [SECURITY] CVE-2014-0096 Apache Tomcat information disclosure",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2014/May/135"
},
{
"name": "http://tomcat.apache.org/security-6.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-6.html"
},
{
"name": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013",
"refsource": "CONFIRM",
"url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578655",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578655"
},
{
"name": "59873",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59873"
},
{
"name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2014/Dec/23"
},
{
"name": "HPSBOV03503",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=144498216801440\u0026w=2"
},
{
"name": "SSRT101681",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=141017844705317\u0026w=2"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578610",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578610"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578611",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578611"
},
{
"name": "DSA-3552",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3552"
},
{
"name": "60729",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/60729"
},
{
"name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "(,6.0.40),[7.0.0,7.0.54),[8.0.0,8.0.6)",
"affected_versions": "All versions before 6.0.40, all versions starting from 7.0.0 before 7.0.54, all versions starting from 8.0.0 before 8.0.6",
"cvss_v2": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-264",
"CWE-937"
],
"date": "2022-07-07",
"description": "java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"fixed_versions": [
"6.0.40",
"7.0.54",
"8.0.6"
],
"identifier": "CVE-2014-0096",
"identifiers": [
"GHSA-qprx-q2r7-3rx6",
"CVE-2014-0096"
],
"not_impacted": "All versions starting from 6.0.40 before 7.0.0, all versions starting from 7.0.54 before 8.0.0, all versions starting from 8.0.6",
"package_slug": "maven/org.apache.tomcat/tomcat",
"pubdate": "2022-05-14",
"solution": "Upgrade to versions 6.0.40, 7.0.54, 8.0.6 or above.",
"title": "Improper Input Validation in Apache Tomcat",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
"https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013",
"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E",
"http://advisories.mageia.org/MGASA-2014-0268.html",
"http://linux.oracle.com/errata/ELSA-2014-0865.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html",
"http://marc.info/?l=bugtraq\u0026m=141017844705317\u0026w=2",
"http://marc.info/?l=bugtraq\u0026m=144498216801440\u0026w=2",
"http://rhn.redhat.com/errata/RHSA-2015-0675.html",
"http://rhn.redhat.com/errata/RHSA-2015-0720.html",
"http://rhn.redhat.com/errata/RHSA-2015-0765.html",
"http://seclists.org/fulldisclosure/2014/Dec/23",
"http://seclists.org/fulldisclosure/2014/May/135",
"http://svn.apache.org/viewvc?view=revision\u0026revision=1578610",
"http://svn.apache.org/viewvc?view=revision\u0026revision=1578611",
"http://svn.apache.org/viewvc?view=revision\u0026revision=1578637",
"http://svn.apache.org/viewvc?view=revision\u0026revision=1578655",
"http://svn.apache.org/viewvc?view=revision\u0026revision=1585853",
"http://tomcat.apache.org/security-6.html",
"http://tomcat.apache.org/security-7.html",
"http://tomcat.apache.org/security-8.html",
"http://www-01.ibm.com/support/docview.wss?uid=swg21678231",
"http://www-01.ibm.com/support/docview.wss?uid=swg21681528",
"http://www.debian.org/security/2016/dsa-3530",
"http://www.debian.org/security/2016/dsa-3552",
"http://www.novell.com/support/kb/doc.php?id=7010166",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
"http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html",
"http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html",
"http://www.vmware.com/security/advisories/VMSA-2014-0012.html",
"https://github.com/advisories/GHSA-qprx-q2r7-3rx6"
],
"uuid": "e7bbe770-9941-46f4-ae96-88e7c4d8e3ce"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.6:alpha:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.9:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.33:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.35:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.7:alpha:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.4:alpha:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.8:alpha:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.0.39",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.36:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.37:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.7:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2014-0096"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578655",
"refsource": "CONFIRM",
"tags": [],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578655"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578637",
"refsource": "CONFIRM",
"tags": [],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578637"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578610",
"refsource": "CONFIRM",
"tags": [],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578610"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1585853",
"refsource": "CONFIRM",
"tags": [],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1585853"
},
{
"name": "http://tomcat.apache.org/security-8.html",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "http://tomcat.apache.org/security-8.html"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578611",
"refsource": "CONFIRM",
"tags": [],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578611"
},
{
"name": "http://tomcat.apache.org/security-7.html",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "http://tomcat.apache.org/security-7.html"
},
{
"name": "http://tomcat.apache.org/security-6.html",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "http://tomcat.apache.org/security-6.html"
},
{
"name": "59835",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/59835"
},
{
"name": "59873",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/59873"
},
{
"name": "59616",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/59616"
},
{
"name": "67667",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/67667"
},
{
"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21678231",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678231"
},
{
"name": "http://www.novell.com/support/kb/doc.php?id=7010166",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www.novell.com/support/kb/doc.php?id=7010166"
},
{
"name": "59678",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/59678"
},
{
"name": "59849",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/59849"
},
{
"name": "http://linux.oracle.com/errata/ELSA-2014-0865.html",
"refsource": "CONFIRM",
"tags": [],
"url": "http://linux.oracle.com/errata/ELSA-2014-0865.html"
},
{
"name": "59732",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/59732"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"
},
{
"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21681528",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681528"
},
{
"name": "60729",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/60729"
},
{
"name": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"
},
{
"name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
"refsource": "FULLDISC",
"tags": [],
"url": "http://seclists.org/fulldisclosure/2014/Dec/23"
},
{
"name": "FEDORA-2015-2109",
"refsource": "FEDORA",
"tags": [],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html"
},
{
"name": "http://advisories.mageia.org/MGASA-2014-0268.html",
"refsource": "CONFIRM",
"tags": [],
"url": "http://advisories.mageia.org/MGASA-2014-0268.html"
},
{
"name": "MDVSA-2015:052",
"refsource": "MANDRIVA",
"tags": [],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:052"
},
{
"name": "RHSA-2015:0675",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0675.html"
},
{
"name": "MDVSA-2015:053",
"refsource": "MANDRIVA",
"tags": [],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:053"
},
{
"name": "RHSA-2015:0720",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0720.html"
},
{
"name": "MDVSA-2015:084",
"refsource": "MANDRIVA",
"tags": [],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:084"
},
{
"name": "RHSA-2015:0765",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2015-0765.html"
},
{
"name": "DSA-3530",
"refsource": "DEBIAN",
"tags": [],
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"name": "DSA-3552",
"refsource": "DEBIAN",
"tags": [],
"url": "http://www.debian.org/security/2016/dsa-3552"
},
{
"name": "HPSBUX03102",
"refsource": "HP",
"tags": [],
"url": "http://marc.info/?l=bugtraq\u0026m=141017844705317\u0026w=2"
},
{
"name": "HPSBOV03503",
"refsource": "HP",
"tags": [],
"url": "http://marc.info/?l=bugtraq\u0026m=144498216801440\u0026w=2"
},
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"name": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013",
"refsource": "CONFIRM",
"tags": [],
"url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013"
},
{
"name": "1030301",
"refsource": "SECTRACK",
"tags": [],
"url": "http://www.securitytracker.com/id/1030301"
},
{
"name": "59121",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/59121"
},
{
"name": "20140527 [SECURITY] CVE-2014-0096 Apache Tomcat information disclosure",
"refsource": "FULLDISC",
"tags": [],
"url": "http://seclists.org/fulldisclosure/2014/May/135"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"
},
{
"name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
"refsource": "BUGTRAQ",
"tags": [],
"url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"
},
{
"name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"refsource": "MLIST",
"tags": [],
"url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
"refsource": "MLIST",
"tags": [],
"url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"refsource": "MLIST",
"tags": [],
"url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"refsource": "MLIST",
"tags": [],
"url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"tags": [],
"url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"tags": [],
"url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
}
},
"lastModifiedDate": "2019-04-15T16:29Z",
"publishedDate": "2014-05-31T11:17Z"
}
}
}
ghsa-qprx-q2r7-3rx6
Vulnerability from github
Published
2022-05-14 01:10
Modified
2024-02-22 16:36
Summary
Improper Input Validation in Apache Tomcat
Details
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.40"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.54"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-0096"
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-07T22:54:11Z",
"nvd_published_at": "2014-05-31T11:17:00Z",
"severity": "MODERATE"
},
"details": "java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"id": "GHSA-qprx-q2r7-3rx6",
"modified": "2024-02-22T16:36:38Z",
"published": "2022-05-14T01:10:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/3c53c4da7bcf300f519eaed5ad1751d24dd59f6b"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/5c545da226b3c71ed9603c38ad2de88057778c1b"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/913d94b289e056107e521dbab8e79cc72a62a331"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/970c23bfd24dfa1dcb86ed917e6c8b47dcfb4433"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat80/commit/65ed69d96a101dfa99eea2cfe17e9e87b310084c"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat80/commit/f3f2979df693a9c84c6742fcb162f3671b0a50d3"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/tomcat"
},
{
"type": "WEB",
"url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "http://advisories.mageia.org/MGASA-2014-0268.html"
},
{
"type": "WEB",
"url": "http://linux.oracle.com/errata/ELSA-2014-0865.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=141017844705317\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=144498216801440\u0026w=2"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0675.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0720.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0765.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2014/Dec/23"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2014/May/135"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578610"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578611"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578637"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578655"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1585853"
},
{
"type": "WEB",
"url": "http://tomcat.apache.org/security-6.html"
},
{
"type": "WEB",
"url": "http://tomcat.apache.org/security-7.html"
},
{
"type": "WEB",
"url": "http://tomcat.apache.org/security-8.html"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678231"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681528"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3552"
},
{
"type": "WEB",
"url": "http://www.novell.com/support/kb/doc.php?id=7010166"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"
},
{
"type": "WEB",
"url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Improper Input Validation in Apache Tomcat"
}
var-201405-0542
Vulnerability from variot
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Apache Tomcat is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information that may lead to further attacks. The following versions are vulnerable: Apache Tomcat 8.0.0-RC1 to 8.0.3 Apache Tomcat 7.0.0 to 7.0.52 Apache Tomcat 6.0.0 to 6.0.39. Description:
Red Hat JBoss Fuse Service Works is the next-generation ESB and business process automation infrastructure. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
===================================================================== Red Hat Security Advisory
Synopsis: Moderate: tomcat security update Advisory ID: RHSA-2014:0827-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0827.html Issue date: 2014-07-02 CVE Names: CVE-2014-0075 CVE-2014-0096 CVE-2014-0099 =====================================================================
- Summary:
Updated tomcat packages that fix three security issues are now available for Red Hat Enterprise Linux 7.
The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux Client (v. 7) - noarch Red Hat Enterprise Linux Client Optional (v. 7) - noarch Red Hat Enterprise Linux ComputeNode (v. 7) - noarch Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch Red Hat Enterprise Linux Server (v. 7) - noarch Red Hat Enterprise Linux Server Optional (v. 7) - noarch Red Hat Enterprise Linux Workstation (v. 7) - noarch Red Hat Enterprise Linux Workstation Optional (v. 7) - noarch
- Description:
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
It was discovered that Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources. (CVE-2014-0075)
It was found that Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a Tomcat server located behind a reverse proxy that processed the content length header correctly. (CVE-2014-0099)
It was found that the org.apache.catalina.servlets.DefaultServlet implementation in Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information. (CVE-2014-0096)
The CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product Security.
All Tomcat 7 users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Tomcat must be restarted for this update to take effect.
- Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
1072776 - CVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter 1088342 - CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs 1102030 - CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content length header
- Package List:
Red Hat Enterprise Linux Client (v. 7):
Source: tomcat-7.0.42-6.el7_0.src.rpm
noarch: tomcat-servlet-3.0-api-7.0.42-6.el7_0.noarch.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
noarch: tomcat-7.0.42-6.el7_0.noarch.rpm tomcat-admin-webapps-7.0.42-6.el7_0.noarch.rpm tomcat-docs-webapp-7.0.42-6.el7_0.noarch.rpm tomcat-el-2.2-api-7.0.42-6.el7_0.noarch.rpm tomcat-javadoc-7.0.42-6.el7_0.noarch.rpm tomcat-jsp-2.2-api-7.0.42-6.el7_0.noarch.rpm tomcat-jsvc-7.0.42-6.el7_0.noarch.rpm tomcat-lib-7.0.42-6.el7_0.noarch.rpm tomcat-webapps-7.0.42-6.el7_0.noarch.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source: tomcat-7.0.42-6.el7_0.src.rpm
noarch: tomcat-servlet-3.0-api-7.0.42-6.el7_0.noarch.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
noarch: tomcat-7.0.42-6.el7_0.noarch.rpm tomcat-admin-webapps-7.0.42-6.el7_0.noarch.rpm tomcat-docs-webapp-7.0.42-6.el7_0.noarch.rpm tomcat-el-2.2-api-7.0.42-6.el7_0.noarch.rpm tomcat-javadoc-7.0.42-6.el7_0.noarch.rpm tomcat-jsp-2.2-api-7.0.42-6.el7_0.noarch.rpm tomcat-jsvc-7.0.42-6.el7_0.noarch.rpm tomcat-lib-7.0.42-6.el7_0.noarch.rpm tomcat-webapps-7.0.42-6.el7_0.noarch.rpm
Red Hat Enterprise Linux Server (v. 7):
Source: tomcat-7.0.42-6.el7_0.src.rpm
noarch: tomcat-7.0.42-6.el7_0.noarch.rpm tomcat-admin-webapps-7.0.42-6.el7_0.noarch.rpm tomcat-el-2.2-api-7.0.42-6.el7_0.noarch.rpm tomcat-jsp-2.2-api-7.0.42-6.el7_0.noarch.rpm tomcat-lib-7.0.42-6.el7_0.noarch.rpm tomcat-servlet-3.0-api-7.0.42-6.el7_0.noarch.rpm tomcat-webapps-7.0.42-6.el7_0.noarch.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
noarch: tomcat-7.0.42-6.el7_0.noarch.rpm tomcat-admin-webapps-7.0.42-6.el7_0.noarch.rpm tomcat-docs-webapp-7.0.42-6.el7_0.noarch.rpm tomcat-el-2.2-api-7.0.42-6.el7_0.noarch.rpm tomcat-javadoc-7.0.42-6.el7_0.noarch.rpm tomcat-jsp-2.2-api-7.0.42-6.el7_0.noarch.rpm tomcat-jsvc-7.0.42-6.el7_0.noarch.rpm tomcat-lib-7.0.42-6.el7_0.noarch.rpm tomcat-webapps-7.0.42-6.el7_0.noarch.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source: tomcat-7.0.42-6.el7_0.src.rpm
noarch: tomcat-7.0.42-6.el7_0.noarch.rpm tomcat-admin-webapps-7.0.42-6.el7_0.noarch.rpm tomcat-el-2.2-api-7.0.42-6.el7_0.noarch.rpm tomcat-jsp-2.2-api-7.0.42-6.el7_0.noarch.rpm tomcat-lib-7.0.42-6.el7_0.noarch.rpm tomcat-servlet-3.0-api-7.0.42-6.el7_0.noarch.rpm tomcat-webapps-7.0.42-6.el7_0.noarch.rpm
Red Hat Enterprise Linux Workstation Optional (v. 7):
noarch: tomcat-docs-webapp-7.0.42-6.el7_0.noarch.rpm tomcat-javadoc-7.0.42-6.el7_0.noarch.rpm tomcat-jsvc-7.0.42-6.el7_0.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package
- References:
https://www.redhat.com/security/data/cve/CVE-2014-0075.html https://www.redhat.com/security/data/cve/CVE-2014-0096.html https://www.redhat.com/security/data/cve/CVE-2014-0099.html https://access.redhat.com/security/updates/classification/#moderate http://tomcat.apache.org/security-7.html
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFTs8+9XlSAg2UNWIIRAglqAJ4sw3DT+V4pFReZSRvkoW+f90gxdgCdFn5e bVOeybWcY1fm+xgpnE7T2ZM= =O2as -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce .
Release Date: 2015-10-15 Last Updated: 2015-10-15
Potential Security Impact: Remote multiple vulnerabilities
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY Potential security vulnerabilities have been identified in HP OpenVMS CSWS_JAVA running Tomcat. These vulnerabilities could be exploited remotely to create a Denial of Service (DoS) and other impacts.
References:
CVE-2013-4286 CVE-2013-4322 CVE-2013-4444 CVE-2013-4590 CVE-2014-0075 CVE-2014-0096 CVE-2014-0099 CVE-2014-0119 CVE-2014-0230 CVE-2014-0277 SSRT101975
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP OpenVMS CSWS_JAVA v7.0.29 Tomcat
BACKGROUND
CVSS 2.0 Base Metrics
Reference Base Vector Base Score CVE-2013-4286 (AV:N/AC:M/Au:N/C:P/I:P/A:N) 5.8 CVE-2013-4322 (AV:N/AC:M/Au:N/C:N/I:N/A:P) 4.3 CVE-2013-4444 (AV:N/AC:M/Au:N/C:P/I:P/A:P) 6.8 CVE-2013-4590 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 CVE-2014-0075 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2014-0096 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 CVE-2014-0099 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3 CVE-2014-0119 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 CVE-2014-0230 (AV:N/AC:L/Au:N/C:N/I:N/A:C) 7.8 CVE-2014-0277 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002
RESOLUTION
HP has provided the following software update to resolve the vulnerabilities in HP OpenVMS CSWS_Java.
"Cumulative security patch for vulnerabilities addressed on CSWS_JAVA v7.0.29"
http://auth-h71000-pro-sitebuilder.houston.hp.com/openvms/products/ips/apac he/csws_java.html
HISTORY Version:1 (rev.1) - 15 October 2015 Initial release
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins
Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/
Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.
3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX
Copyright 2015 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. Description:
Red Hat JBoss Data Virtualization is a lean data integration solution that provides easy, real-time, and unified data access across disparate sources to multiple applications and users. JBoss Data Virtualization makes data spread across physically distinct systems—such as multiple databases, XML files, and even Hadoop systems—appear as a set of tables in a local database. It includes various bug fixes, which are listed in the README file included with the patch files.
The following security issues are also fixed with this release, descriptions of which can be found on the respective CVE pages linked in the References section.
CVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix
CVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix
CVE-2013-4002 Xerces-J2 OpenJDK: XML parsing Denial of Service (JAXP, 8017298)
CVE-2013-4517 Apache Santuario XML Security for Java: Java XML Signature DoS Attack
CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions
CVE-2014-0059 JBossSX/PicketBox: World readable audit.log file
CVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter
CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs
CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content length header
CVE-2014-0119 Tomcat/JBossWeb: XML parser hijack by malicious web application
CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation
CVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter
CVE-2014-3481 JBoss AS JAX-RS: Information disclosure via XML eXternal Entity (XXE)
CVE-2014-3490 RESTEasy: XXE via parameter entities
CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage
CVE-2014-3623 Apache WSS4J / Apache CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods
CVE-2014-7839 RESTeasy: External entities expanded by DocumentProvider
CVE-2014-8122 JBoss Weld: Limited information disclosure via stale thread state
Red Hat would like to thank James Roper of Typesafe for reporting CVE-2014-0193, Alexander Papadakis for reporting CVE-2014-3530, and Rune Steinseth of JProfessionals for reporting CVE-2014-8122. Bugs fixed (https://bugzilla.redhat.com/):
1019176 - CVE-2013-4002 Xerces-J2 OpenJDK: XML parsing Denial of Service (JAXP, 8017298) 1045257 - CVE-2013-4517 Apache Santuario XML Security for Java: Java XML Signature DoS Attack 1063642 - CVE-2014-0059 JBossSX/PicketBox: World readable audit.log file 1065139 - CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions 1072776 - CVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter 1088342 - CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs 1092783 - CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation 1102030 - CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content length header 1102038 - CVE-2014-0119 Tomcat/JBossWeb: XML parser hijack by malicious web application 1105242 - CVE-2014-3481 JBoss AS JAX-RS: Information disclosure via XML eXternal Entity (XXE) 1107901 - CVE-2014-3490 RESTEasy: XXE via parameter entities 1109196 - CVE-2014-0227 Tomcat/JBossWeb: request smuggling andl imited DoS in ChunkedInputFilter 1112987 - CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage 1129074 - CVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix 1129916 - CVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix 1157304 - CVE-2014-3623 Apache WSS4J / Apache CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods 1165328 - CVE-2014-7839 RESTeasy: External entities expanded by DocumentProvider 1169237 - CVE-2014-8122 JBoss Weld: Limited information disclosure via stale thread state
- Solution:
The References section of this erratum contains a download link (you must log in to download the update). Description:
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications.
For the oldstable distribution (wheezy), these problems have been fixed in version 6.0.45+dfsg-1~deb7u1.
We recommend that you upgrade your tomcat6 packages.
This update also fixes the following bugs:
-
The patch that resolved the CVE-2014-0050 issue contained redundant code. This update removes the redundant code. (BZ#1094528)
-
The patch that resolved the CVE-2013-4322 issue contained an invalid check that triggered a java.io.EOFException while reading trailer headers for chunked requests. This update fixes the check and the aforementioned exception is no longer triggered in the described scenario
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201405-0542",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.35"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.14"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.3"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.4"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.36"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.7"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.24"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.11"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.7"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.45"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.17"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.48"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.10"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.9"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.23"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.5"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.31"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.25"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.32"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.10"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.37"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.18"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.27"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.43"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.3"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "8.0.3"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.15"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.44"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.28"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.24"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.36"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.40"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.6"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.9"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.39"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.22"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.5"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.35"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.12"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.16"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.2"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "8.0.1"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.47"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.1"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.49"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.42"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.50"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.21"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.26"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.28"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.38"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.4"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.12"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.34"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.19"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.30"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.16"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.31"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.32"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.13"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.20"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.14"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.8"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.33"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.33"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.19"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.13"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.29"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.30"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.6"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.20"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.27"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.46"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.1"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.26"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.18"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.8"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.29"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.11"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.2"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "6.0.15"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.41"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.3,
"vendor": "apache",
"version": "7.0.37"
},
{
"model": "tomcat",
"scope": "lte",
"trust": 1.0,
"vendor": "apache",
"version": "6.0.39"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.0,
"vendor": "apache",
"version": "6"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.0,
"vendor": "apache",
"version": "6.0.0"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.0,
"vendor": "apache",
"version": "7.0.17"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.0,
"vendor": "apache",
"version": "8.0.0"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.0,
"vendor": "apache",
"version": "7.0.0"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 1.0,
"vendor": "apache",
"version": "7.0.52"
},
{
"model": "openpages grc platform",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": "6.1.0.1.4"
},
{
"model": "big-ip wom hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "scale out network attached storage",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.3.21-21"
},
{
"model": "rational sap connector",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "4.0.0.4"
},
{
"model": "rational doors web access",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.5.21"
},
{
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "urbancode release",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.0.1"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "6.0.39"
},
{
"model": "algo audit and compliance",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "2.1.0.2"
},
{
"model": "big-ip psm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.1"
},
{
"model": "big-ip aam",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5"
},
{
"model": "enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "big-ip afm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5.1"
},
{
"model": "big-ip gtm hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip psm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.0"
},
{
"model": "big-ip apm hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip psm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.4"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3"
},
{
"model": "big-ip webaccelerator hf7",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "big-ip gtm hf4",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "secure analytics",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "2014.1"
},
{
"model": "tivoli application dependency discovery manager",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.1.2"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "big-ip wom",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.0"
},
{
"model": "big-ip link controller hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "meeting exchange sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1"
},
{
"model": "rational test workbench",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.12"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "aura presence services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "big-ip psm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.0"
},
{
"model": "rational sap connector",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "4.0.0.2"
},
{
"model": "rational directory server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "5.1.1.1"
},
{
"model": "cognos business intelligence server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "10.1.1"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5.0"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.1"
},
{
"model": "big-ip asm hf7",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "big-ip edge gateway hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "aura system platform",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "communications policy management",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "9.9.1"
},
{
"model": "big-ip apm hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "big-ip afm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5"
},
{
"model": "smartcloud provisioning",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "2.1"
},
{
"model": "communication server 1000m signaling server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.5"
},
{
"model": "aura system platform sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "openpages grc platform",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.2.1"
},
{
"model": "urbancode release",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.0.1.2"
},
{
"model": "big-ip ltm hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "scale out network attached storage",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.4.1.0"
},
{
"model": "rational test workbench",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.52"
},
{
"model": "big-ip psm hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "big-ip edge gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "rational test virtualization server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5.0.0"
},
{
"model": "rational test workbench",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.11"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "business server",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "1"
},
{
"model": "rational test workbench",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.01"
},
{
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "rational test virtualization server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0"
},
{
"model": "aura system platform",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.3"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "meeting exchange sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "big-ip apm hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "aura application server sip core",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "53002.0"
},
{
"model": "big-ip ltm hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "meeting exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0.0.52"
},
{
"model": "rational sap connector",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": "4.0.0.5"
},
{
"model": "big-ip webaccelerator hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "tomcat beta",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "7.0.4"
},
{
"model": "secure analytics 2014.3r1",
"scope": "ne",
"trust": 0.3,
"vendor": "juniper",
"version": null
},
{
"model": "cognos business intelligence server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "10.2.1"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5.1"
},
{
"model": "big-ip webaccelerator",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.0"
},
{
"model": "meeting exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "rational test workbench",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.5"
},
{
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "8.0"
},
{
"model": "aura system platform",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.3.0.3"
},
{
"model": "aura system platform",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.2"
},
{
"model": "big-ip analytics",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "big-ip psm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3"
},
{
"model": "arx",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "6.0"
},
{
"model": "enterprise manager",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "2.1"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2.4"
},
{
"model": "tomcat",
"scope": "ne",
"trust": 0.3,
"vendor": "apache",
"version": "6.0.41"
},
{
"model": "aura messaging",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "security threat response manager",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "2012.1"
},
{
"model": "websphere application server community edition",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "3.0.0.4"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.1"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.2"
},
{
"model": "openvms csws java",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.0.29"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.40"
},
{
"model": "jboss enterprise application platform el5",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "cognos business intelligence server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "10.1"
},
{
"model": "arx",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "6.4"
},
{
"model": "big-ip analytics",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip edge gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1"
},
{
"model": "urbancode release",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.0"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "big-ip ltm hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip analytics hf4",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "big-ip link controller hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "rational test workbench",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.02"
},
{
"model": "urbancode deploy",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.1"
},
{
"model": "cognos metrics manager",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "10.1"
},
{
"model": "rational doors web access",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.5.1"
},
{
"model": "big-ip link controller hf4",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "arx",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "6.3"
},
{
"model": "cognos metrics manager",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "10.2"
},
{
"model": "aura application server sip core pb23",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "53002.0"
},
{
"model": "aura messaging",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.3"
},
{
"model": "guardium database activity monitor",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.1"
},
{
"model": "big-ip asm hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "meeting exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.2"
},
{
"model": "big-ip ltm hf7",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "cognos business viewpoint fp1",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "10.1.1"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.1"
},
{
"model": "big-ip edge gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.4"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5.1"
},
{
"model": "big-ip wom",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.2"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.0"
},
{
"model": "proactive contact",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "4.2.2"
},
{
"model": "rational doors web access",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.44"
},
{
"model": "arx",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "6.2"
},
{
"model": "big-ip wom",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "meeting exchange sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "aura messaging",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.2"
},
{
"model": "rational doors web access",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.5"
},
{
"model": "big-ip afm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3"
},
{
"model": "enterprise manager",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "3.0"
},
{
"model": "tomcat",
"scope": "ne",
"trust": 0.3,
"vendor": "apache",
"version": "8.0.5"
},
{
"model": "big-ip psm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip aam",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5.1"
},
{
"model": "rational test workbench",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.14"
},
{
"model": "big-ip gtm hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "linux ia-64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "6.2"
},
{
"model": "big-ip pem",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5"
},
{
"model": "big-ip ltm hf4",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "big-ip edge gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.0"
},
{
"model": "big-ip analytics hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip wom",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip gtm hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "tomcat beta",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "7.0.2"
},
{
"model": "cognos business intelligence server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "10.2.11"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "power hmc",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.7.8.0"
},
{
"model": "urbancode deploy",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.1.0.2"
},
{
"model": "jboss web server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "2.0.1"
},
{
"model": "enterprise linux workstation",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "urbancode release",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.0.1.1"
},
{
"model": "rational directory server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "5.2.0.2"
},
{
"model": "aura system platform",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.2.2"
},
{
"model": "rational doors web access",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.51"
},
{
"model": "meeting exchange sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "urbancode deploy",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.0.12"
},
{
"model": "big-ip link controller hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "aura messaging",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.1"
},
{
"model": "guardium database activity monitor",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.0"
},
{
"model": "big-ip edge gateway hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.1"
},
{
"model": "rational directory server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.0"
},
{
"model": "big-ip aam",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.0"
},
{
"model": "iq",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "aura presence services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.4"
},
{
"model": "big-ip ltm hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "rational sap connector",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "4.0.0.3"
},
{
"model": "rational test workbench",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.03"
},
{
"model": "aura presence services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1.2"
},
{
"model": "ip office server edition",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "9.0"
},
{
"model": "urbancode release",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.0.0.1"
},
{
"model": "big-ip aam",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.1"
},
{
"model": "scale out network attached storage",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.3.2.2"
},
{
"model": "big-ip webaccelerator",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.00"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5"
},
{
"model": "scale out network attached storage",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.4.2.1"
},
{
"model": "big-ip asm hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "cognos business viewpoint fp1",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "10.1"
},
{
"model": "big-ip analytics",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.0.0"
},
{
"model": "communication server 1000e signaling server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.5"
},
{
"model": "big-ip psm hf4",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "big-ip gtm hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "secure analytics",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "2013.2"
},
{
"model": "big-ip apm hf7",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "big-ip edge gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "big-ip psm hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip wom hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.0"
},
{
"model": "algo audit and compliance",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "2.1"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1.2"
},
{
"model": "tomcat 8.0.0-rc6",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "tomcat 8.0.0-rc3",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "openpages grc platform",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.1.0.1"
},
{
"model": "big-ip asm hf4",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "communications policy management",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "9.7.3"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "secure analytics 2013.2r9",
"scope": "ne",
"trust": 0.3,
"vendor": "juniper",
"version": null
},
{
"model": "security threat response manager",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "2013.1"
},
{
"model": "meeting exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "big-ip webaccelerator",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "scale out network attached storage",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.3.2"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "7"
},
{
"model": "rational test workbench",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0"
},
{
"model": "aura application server sip core pb28",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "53002.0"
},
{
"model": "communication server 1000m",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.5"
},
{
"model": "big-ip link controller hf7",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.00"
},
{
"model": "scale out network attached storage",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.4.3.1"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.2"
},
{
"model": "big-ip edge gateway hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip edge gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.1"
},
{
"model": "cognos metrics manager",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "10.1.1"
},
{
"model": "big-ip webaccelerator hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "meeting exchange sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "linux lts amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "12.04"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.3"
},
{
"model": "big-ip afm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.1"
},
{
"model": "tomcat 8.0.0-rc10",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "big-ip wom hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "tivoli application dependency discovery manager",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.2.2"
},
{
"model": "linux mips",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "messaging application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0.1"
},
{
"model": "scale out network attached storage",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.3.0.5"
},
{
"model": "big-ip link controller hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "communication server 1000e",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.5"
},
{
"model": "secure analytics",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "2014.2"
},
{
"model": "big-ip edge gateway hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.2"
},
{
"model": "urbancode deploy",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.0.14"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.2"
},
{
"model": "big-ip psm hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "communication server 1000e signaling server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.6"
},
{
"model": "big-ip webaccelerator hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "rational directory server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.0.0.1"
},
{
"model": "big-ip wom hf7",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "big-ip analytics 11.0.0-hf2",
"scope": null,
"trust": 0.3,
"vendor": "f5",
"version": null
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip afm hf4",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "rational doors web access",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.6"
},
{
"model": "cognos metrics manager",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "10.2.1"
},
{
"model": "ip office server edition",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "8.1"
},
{
"model": "power hmc",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.7.3.0"
},
{
"model": "big-ip asm hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "communication server 1000m",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.6"
},
{
"model": "big-ip analytics hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "messaging application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "scale out network attached storage",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.4.3.3"
},
{
"model": "big-ip analytics hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "proactive contact",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "4.2"
},
{
"model": "meeting exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1"
},
{
"model": "rational doors web access",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.5.11"
},
{
"model": "enterprise linux hpc node optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "big-ip pem",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5.1"
},
{
"model": "big-ip edge gateway hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "scale out network attached storage",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.3.0.4"
},
{
"model": "big-ip apm hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "jboss enterprise web server el6",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "2.0"
},
{
"model": "communication server 1000m signaling server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.6"
},
{
"model": "aura system platform",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.3.8.3"
},
{
"model": "iq",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1.1"
},
{
"model": "communication server 1000e",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.6"
},
{
"model": "big-ip analytics",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "scale out network attached storage",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.3.2.3"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2.3"
},
{
"model": "big-ip psm hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip ltm hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "aura system platform",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.3.9.3"
},
{
"model": "rational doors web access",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.45"
},
{
"model": "urbancode deploy",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.0"
},
{
"model": "smartcloud provisioning",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "2.1.0.1"
},
{
"model": "iq",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "4.0"
},
{
"model": "aura application server sip core pb19",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "53002.0"
},
{
"model": "meeting exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "tomcat rc5",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "8.0.0"
},
{
"model": "business server",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "1x8664"
},
{
"model": "big-ip analytics",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5.1"
},
{
"model": "big-ip apm hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "ip office application server sp",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "9.01"
},
{
"model": "communication server 1000m",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "security threat response manager 2013.2r9",
"scope": "ne",
"trust": 0.3,
"vendor": "juniper",
"version": null
},
{
"model": "enterprise linux workstation optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "big-ip asm hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "aura conferencing",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.2"
},
{
"model": "iq",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "4.2"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "6.0.25"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5.1"
},
{
"model": "tivoli application dependency discovery manager",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": "7.2.1.6"
},
{
"model": "communication server 1000m signaling server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "arx",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "6.1.1"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.00"
},
{
"model": "big-ip psm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "big-ip link controller hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip ltm hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.2"
},
{
"model": "aura messaging",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1.1"
},
{
"model": "communication server 1000e",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "rational test workbench",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.13"
},
{
"model": "rational doors web access",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.5.2"
},
{
"model": "rational doors web access",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.5"
},
{
"model": "smartcloud provisioning fix pack",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "2.11"
},
{
"model": "power hmc",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.2.0.0"
},
{
"model": "rational directory server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "5.1.1.2"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "big-ip apm hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "rational lifecycle adapter for hp alm",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.0"
},
{
"model": "big-ip gtm hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip wom",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.0"
},
{
"model": "scale out network attached storage",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.4.3.2"
},
{
"model": "big-ip link controller hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "iq",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "4.1"
},
{
"model": "ip office application server sp",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "9.02"
},
{
"model": "aura system platform",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.2.1"
},
{
"model": "smartcloud provisioning fixpack",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "2.35"
},
{
"model": "aura experience portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.2"
},
{
"model": "big-ip analytics",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "6"
},
{
"model": "aura application server sip core pb3",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "53003.0"
},
{
"model": "big-ip wom hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "rational test workbench",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.0.1"
},
{
"model": "smartcloud provisioning fix pack",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "2.15"
},
{
"model": "rational sap connector",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "4.0.0.1"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "power hmc",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.7.9.0"
},
{
"model": "aura application server sip core pb26",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "53002.0"
},
{
"model": "linux lts",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "14.04"
},
{
"model": "tivoli application dependency discovery manager",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": "7.2.0.10"
},
{
"model": "linux lts i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "12.04"
},
{
"model": "proactive contact",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "4.2.1"
},
{
"model": "aura system platform",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "1.1"
},
{
"model": "urbancode release",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.0.1.3"
},
{
"model": "scale out network attached storage",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.4.2.0"
},
{
"model": "urbancode deploy",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.1.0.1"
},
{
"model": "rational test workbench",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.51"
},
{
"model": "messaging application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "big-ip asm hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.00"
},
{
"model": "scale out network attached storage",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": "1.4.3.4"
},
{
"model": "big-ip analytics hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "aura presence services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.1"
},
{
"model": "aura experience portal sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "big-ip gtm hf7",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "big-ip webaccelerator hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "urbancode deploy",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.0.1"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.0"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.4"
},
{
"model": "big-ip gtm hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "scale out network attached storage",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.3.0.0"
},
{
"model": "aura presence services sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "big-ip edge gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3"
},
{
"model": "aura presence services sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "openpages grc platform",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.0"
},
{
"model": "big-ip wom",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "big-ip link controller hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "hp-ux b.11.31",
"scope": null,
"trust": 0.3,
"vendor": "hp",
"version": null
},
{
"model": "aura system platform",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.2"
},
{
"model": "linux s/390",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "big-ip asm hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "communication server 1000m signaling server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.0"
},
{
"model": "aura experience portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "websphere application server community edition",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "2.1.1.6"
},
{
"model": "tivoli application dependency discovery manager",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.2.0"
},
{
"model": "rational directory server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "5.2"
},
{
"model": "communication server 1000e",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.0"
},
{
"model": "urbancode deploy",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.0.11"
},
{
"model": "tivoli application dependency discovery manager",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": "7.2.2.1"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.0"
},
{
"model": "urbancode deploy",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.0.1.5"
},
{
"model": "big-ip psm hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip wom",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.4"
},
{
"model": "aura presence services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.2"
},
{
"model": "big-ip pem",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3"
},
{
"model": "big-ip edge gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.2"
},
{
"model": "aura application server sip core pb5",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "53003.0"
},
{
"model": "big-ip apm hf4",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "openpages grc platform",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.0.1.5"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5"
},
{
"model": "tomcat rc10",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "8.0.0"
},
{
"model": "rational lifecycle adapter for hp alm",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.1"
},
{
"model": "qradar security information and event manager",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.1"
},
{
"model": "smartcloud provisioning",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "2.13"
},
{
"model": "big-ip analytics hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "scale out network attached storage",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.3.1"
},
{
"model": "big-ip psm hf7",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "aura presence services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1.1"
},
{
"model": "urbancode release",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.0.1.4"
},
{
"model": "big-ip wom",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.0"
},
{
"model": "proactive contact",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "8.1"
},
{
"model": "messaging application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2.1"
},
{
"model": "big-ip asm hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "enterprise linux server optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "big-ip edge gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "smartcloud provisioning",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "2.3"
},
{
"model": "big-ip analytics",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3"
},
{
"model": "aura conferencing sp1 standard",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "power hmc",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "8.1.0.0"
},
{
"model": "qradar security information and event manager",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.2"
},
{
"model": "big-ip webaccelerator hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "tomcat",
"scope": "ne",
"trust": 0.3,
"vendor": "apache",
"version": "7.0.53"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1.1"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5.1"
},
{
"model": "big-ip webaccelerator",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1"
},
{
"model": "tomcat 8.0.0-rc5",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "aura system platform",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.2.1.0.9"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3"
},
{
"model": "big-ip apm hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "aura application server sip core",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "53003.0"
},
{
"model": "aura application server sip core pb25",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "53002.0"
},
{
"model": "rational directory server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "5.2.1"
},
{
"model": "tomcat rc2",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "8.0.0"
},
{
"model": "jboss enterprise application platform el5",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6.2"
},
{
"model": "aura experience portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.1"
},
{
"model": "aura experience portal sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "arx",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "6.1"
},
{
"model": "big-ip analytics hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.2"
},
{
"model": "big-ip webaccelerator",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.4"
},
{
"model": "communication server 1000e signaling server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "big-ip psm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "security threat response manager",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "2013.2"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.0.00"
},
{
"model": "aura messaging",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "big-ip asm hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip ltm hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "urbancode deploy",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "6.0.13"
},
{
"model": "aura system platform sp3",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "big-ip analytics hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1"
},
{
"model": "rational doors web access",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.51"
},
{
"model": "big-ip wom",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2.2"
},
{
"model": "enterprise manager",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "2.3"
},
{
"model": "scale out network attached storage",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.4.3.0"
},
{
"model": "smartcloud provisioning",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "2.12"
},
{
"model": "aura conferencing",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.0"
},
{
"model": "big-ip psm hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "aura system platform sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.2"
},
{
"model": "centos",
"scope": "eq",
"trust": 0.3,
"vendor": "centos",
"version": "6"
},
{
"model": "big-ip gtm hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "scale out network attached storage",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "1.3.21-20"
},
{
"model": "ip office server edition",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "8.0"
},
{
"model": "big-ip webaccelerator",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.0"
},
{
"model": "big-ip ltm hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "aura utility services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.3"
},
{
"model": "big-ip apm hf2",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.0"
},
{
"model": "cognos business intelligence server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "10.2"
},
{
"model": "big-ip wom hf1",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.1"
},
{
"model": "aura application enablement services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2.1"
},
{
"model": "enterprise linux desktop optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "7"
},
{
"model": "communications policy management",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "12.1.1"
},
{
"model": "proactive contact",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.0"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "7.0"
},
{
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.0"
},
{
"model": "linux",
"scope": null,
"trust": 0.3,
"vendor": "gentoo",
"version": null
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.4"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "big-ip analytics hf7",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "big-ip apm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "jboss enterprise application platform el6",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6.2"
},
{
"model": "aura system platform",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0.1"
},
{
"model": "tomcat rc1",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "8.0.0"
},
{
"model": "big-ip pem",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.1"
},
{
"model": "communication server 1000e signaling server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.5"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5"
},
{
"model": "aura utility services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.2"
},
{
"model": "big-ip gtm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "rational directory server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "5.1.1"
},
{
"model": "rational directory server",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "5.2.0.1"
},
{
"model": "aura application server sip core pb16",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "53002.0"
},
{
"model": "linux ia-32",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.4"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.0.00"
},
{
"model": "big-ip link controller",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.0"
},
{
"model": "big-ip link controller hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2"
},
{
"model": "cognos business viewpoint fp2",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "10.1.1"
},
{
"model": "big-ip gtm hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "9.0"
},
{
"model": "ip office application server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0.1"
},
{
"model": "iq",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5"
},
{
"model": "tomcat beta",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "7.0"
},
{
"model": "tivoli application dependency discovery manager",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "7.2.1"
},
{
"model": "big-ip psm hf5",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "jboss enterprise application platform el6",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "tomcat 8.0.0-rc1",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "communication server 1000m",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.5"
},
{
"model": "communications policy management",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "10.4.1"
},
{
"model": "enterprise manager",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "3.1.1"
},
{
"model": "big-ip analytics",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.4.1"
},
{
"model": "communication server 1000e signaling server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.0"
},
{
"model": "enterprise manager",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "3.1"
},
{
"model": "aura messaging sp4",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.2"
},
{
"model": "big-ip pem hf4",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3.0"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "big-ip edge gateway hf7",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1.0"
},
{
"model": "iq",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1"
},
{
"model": "big-ip ltm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.0"
},
{
"model": "aura conferencing standard",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "big-ip webaccelerator",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "10.2.1"
},
{
"model": "communication server 1000m signaling server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.5"
},
{
"model": "big-ip webaccelerator",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.3"
},
{
"model": "jboss enterprise web server el5",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "2.0"
},
{
"model": "big-ip edge gateway hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "aura application server sip core",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "53002.1"
},
{
"model": "communication server 1000e",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.5"
},
{
"model": "smartcloud provisioning fixpack",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "2.31"
},
{
"model": "big-ip psm hf3",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.2.1"
},
{
"model": "big-ip psm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.1"
},
{
"model": "big-ip asm",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "11.5.1"
},
{
"model": "communication server 1000m",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.0"
}
],
"sources": [
{
"db": "BID",
"id": "67667"
},
{
"db": "NVD",
"id": "CVE-2014-0096"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.33:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.4:alpha:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.0.39",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.9:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.7:alpha:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.37:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.6:alpha:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.7:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.8:alpha:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.35:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.36:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2014-0096"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Red Hat",
"sources": [
{
"db": "PACKETSTORM",
"id": "131007"
},
{
"db": "PACKETSTORM",
"id": "127325"
},
{
"db": "PACKETSTORM",
"id": "130781"
},
{
"db": "PACKETSTORM",
"id": "127336"
},
{
"db": "PACKETSTORM",
"id": "127338"
},
{
"db": "PACKETSTORM",
"id": "127413"
}
],
"trust": 0.6
},
"cve": "CVE-2014-0096",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2014-0096",
"trust": 1.0,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2014-0096"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Apache Tomcat is prone to an information-disclosure vulnerability. \nAn attacker can exploit this issue to gain access to sensitive information that may lead to further attacks. \nThe following versions are vulnerable:\nApache Tomcat 8.0.0-RC1 to 8.0.3\nApache Tomcat 7.0.0 to 7.0.52\nApache Tomcat 6.0.0 to 6.0.39. Description:\n\nRed Hat JBoss Fuse Service Works is the next-generation ESB and business\nprocess automation infrastructure. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Moderate: tomcat security update\nAdvisory ID: RHSA-2014:0827-01\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://rhn.redhat.com/errata/RHSA-2014-0827.html\nIssue date: 2014-07-02\nCVE Names: CVE-2014-0075 CVE-2014-0096 CVE-2014-0099 \n=====================================================================\n\n1. Summary:\n\nUpdated tomcat packages that fix three security issues are now available\nfor Red Hat Enterprise Linux 7. \n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Client (v. 7) - noarch\nRed Hat Enterprise Linux Client Optional (v. 7) - noarch\nRed Hat Enterprise Linux ComputeNode (v. 7) - noarch\nRed Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch\nRed Hat Enterprise Linux Server (v. 7) - noarch\nRed Hat Enterprise Linux Server Optional (v. 7) - noarch\nRed Hat Enterprise Linux Workstation (v. 7) - noarch\nRed Hat Enterprise Linux Workstation Optional (v. 7) - noarch\n\n3. Description:\n\nApache Tomcat is a servlet container for the Java Servlet and JavaServer\nPages (JSP) technologies. \n\nIt was discovered that Apache Tomcat did not limit the length of chunk\nsizes when using chunked transfer encoding. A remote attacker could use\nthis flaw to perform a denial of service attack against Tomcat by streaming\nan unlimited quantity of data, leading to excessive consumption of server\nresources. (CVE-2014-0075)\n\nIt was found that Apache Tomcat did not check for overflowing values when\nparsing request content length headers. A remote attacker could use this\nflaw to perform an HTTP request smuggling attack on a Tomcat server located\nbehind a reverse proxy that processed the content length header correctly. \n(CVE-2014-0099)\n\nIt was found that the org.apache.catalina.servlets.DefaultServlet\nimplementation in Apache Tomcat allowed the definition of XML External\nEntities (XXEs) in provided XSLTs. A malicious application could use this\nto circumvent intended security restrictions to disclose sensitive\ninformation. (CVE-2014-0096)\n\nThe CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product\nSecurity. \n\nAll Tomcat 7 users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues. Tomcat must be\nrestarted for this update to take effect. \n\n4. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. \n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1072776 - CVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter\n1088342 - CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs\n1102030 - CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content length header\n\n6. Package List:\n\nRed Hat Enterprise Linux Client (v. 7):\n\nSource:\ntomcat-7.0.42-6.el7_0.src.rpm\n\nnoarch:\ntomcat-servlet-3.0-api-7.0.42-6.el7_0.noarch.rpm\n\nRed Hat Enterprise Linux Client Optional (v. 7):\n\nnoarch:\ntomcat-7.0.42-6.el7_0.noarch.rpm\ntomcat-admin-webapps-7.0.42-6.el7_0.noarch.rpm\ntomcat-docs-webapp-7.0.42-6.el7_0.noarch.rpm\ntomcat-el-2.2-api-7.0.42-6.el7_0.noarch.rpm\ntomcat-javadoc-7.0.42-6.el7_0.noarch.rpm\ntomcat-jsp-2.2-api-7.0.42-6.el7_0.noarch.rpm\ntomcat-jsvc-7.0.42-6.el7_0.noarch.rpm\ntomcat-lib-7.0.42-6.el7_0.noarch.rpm\ntomcat-webapps-7.0.42-6.el7_0.noarch.rpm\n\nRed Hat Enterprise Linux ComputeNode (v. 7):\n\nSource:\ntomcat-7.0.42-6.el7_0.src.rpm\n\nnoarch:\ntomcat-servlet-3.0-api-7.0.42-6.el7_0.noarch.rpm\n\nRed Hat Enterprise Linux ComputeNode Optional (v. 7):\n\nnoarch:\ntomcat-7.0.42-6.el7_0.noarch.rpm\ntomcat-admin-webapps-7.0.42-6.el7_0.noarch.rpm\ntomcat-docs-webapp-7.0.42-6.el7_0.noarch.rpm\ntomcat-el-2.2-api-7.0.42-6.el7_0.noarch.rpm\ntomcat-javadoc-7.0.42-6.el7_0.noarch.rpm\ntomcat-jsp-2.2-api-7.0.42-6.el7_0.noarch.rpm\ntomcat-jsvc-7.0.42-6.el7_0.noarch.rpm\ntomcat-lib-7.0.42-6.el7_0.noarch.rpm\ntomcat-webapps-7.0.42-6.el7_0.noarch.rpm\n\nRed Hat Enterprise Linux Server (v. 7):\n\nSource:\ntomcat-7.0.42-6.el7_0.src.rpm\n\nnoarch:\ntomcat-7.0.42-6.el7_0.noarch.rpm\ntomcat-admin-webapps-7.0.42-6.el7_0.noarch.rpm\ntomcat-el-2.2-api-7.0.42-6.el7_0.noarch.rpm\ntomcat-jsp-2.2-api-7.0.42-6.el7_0.noarch.rpm\ntomcat-lib-7.0.42-6.el7_0.noarch.rpm\ntomcat-servlet-3.0-api-7.0.42-6.el7_0.noarch.rpm\ntomcat-webapps-7.0.42-6.el7_0.noarch.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 7):\n\nnoarch:\ntomcat-7.0.42-6.el7_0.noarch.rpm\ntomcat-admin-webapps-7.0.42-6.el7_0.noarch.rpm\ntomcat-docs-webapp-7.0.42-6.el7_0.noarch.rpm\ntomcat-el-2.2-api-7.0.42-6.el7_0.noarch.rpm\ntomcat-javadoc-7.0.42-6.el7_0.noarch.rpm\ntomcat-jsp-2.2-api-7.0.42-6.el7_0.noarch.rpm\ntomcat-jsvc-7.0.42-6.el7_0.noarch.rpm\ntomcat-lib-7.0.42-6.el7_0.noarch.rpm\ntomcat-webapps-7.0.42-6.el7_0.noarch.rpm\n\nRed Hat Enterprise Linux Workstation (v. 7):\n\nSource:\ntomcat-7.0.42-6.el7_0.src.rpm\n\nnoarch:\ntomcat-7.0.42-6.el7_0.noarch.rpm\ntomcat-admin-webapps-7.0.42-6.el7_0.noarch.rpm\ntomcat-el-2.2-api-7.0.42-6.el7_0.noarch.rpm\ntomcat-jsp-2.2-api-7.0.42-6.el7_0.noarch.rpm\ntomcat-lib-7.0.42-6.el7_0.noarch.rpm\ntomcat-servlet-3.0-api-7.0.42-6.el7_0.noarch.rpm\ntomcat-webapps-7.0.42-6.el7_0.noarch.rpm\n\nRed Hat Enterprise Linux Workstation Optional (v. 7):\n\nnoarch:\ntomcat-docs-webapp-7.0.42-6.el7_0.noarch.rpm\ntomcat-javadoc-7.0.42-6.el7_0.noarch.rpm\ntomcat-jsvc-7.0.42-6.el7_0.noarch.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/#package\n\n7. References:\n\nhttps://www.redhat.com/security/data/cve/CVE-2014-0075.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-0096.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-0099.html\nhttps://access.redhat.com/security/updates/classification/#moderate\nhttp://tomcat.apache.org/security-7.html\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2014 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.4 (GNU/Linux)\n\niD8DBQFTs8+9XlSAg2UNWIIRAglqAJ4sw3DT+V4pFReZSRvkoW+f90gxdgCdFn5e\nbVOeybWcY1fm+xgpnE7T2ZM=\n=O2as\n-----END PGP SIGNATURE-----\n\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. \n\nRelease Date: 2015-10-15\nLast Updated: 2015-10-15\n\nPotential Security Impact: Remote multiple vulnerabilities\n\nSource: Hewlett-Packard Company, HP Software Security Response Team\n\nVULNERABILITY SUMMARY\nPotential security vulnerabilities have been identified in HP OpenVMS\nCSWS_JAVA running Tomcat. These vulnerabilities could be exploited remotely\nto create a Denial of Service (DoS) and other impacts. \n\nReferences:\n\nCVE-2013-4286\nCVE-2013-4322\nCVE-2013-4444\nCVE-2013-4590\nCVE-2014-0075\nCVE-2014-0096\nCVE-2014-0099\nCVE-2014-0119\nCVE-2014-0230\nCVE-2014-0277\nSSRT101975\n\nSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. \nHP OpenVMS CSWS_JAVA v7.0.29 Tomcat\n\nBACKGROUND\n\nCVSS 2.0 Base Metrics\n===========================================================\n Reference Base Vector Base Score\nCVE-2013-4286 (AV:N/AC:M/Au:N/C:P/I:P/A:N) 5.8\nCVE-2013-4322 (AV:N/AC:M/Au:N/C:N/I:N/A:P) 4.3\nCVE-2013-4444 (AV:N/AC:M/Au:N/C:P/I:P/A:P) 6.8\nCVE-2013-4590 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3\nCVE-2014-0075 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0\nCVE-2014-0096 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3\nCVE-2014-0099 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3\nCVE-2014-0119 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3\nCVE-2014-0230 (AV:N/AC:L/Au:N/C:N/I:N/A:C) 7.8\nCVE-2014-0277 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\n===========================================================\n Information on CVSS is documented\n in HP Customer Notice: HPSN-2008-002\n\nRESOLUTION\n\nHP has provided the following software update to resolve the vulnerabilities\nin HP OpenVMS CSWS_Java. \n\n \"Cumulative security patch for vulnerabilities addressed on CSWS_JAVA\nv7.0.29\"\n\n http://auth-h71000-pro-sitebuilder.houston.hp.com/openvms/products/ips/apac\nhe/csws_java.html\n\nHISTORY\nVersion:1 (rev.1) - 15 October 2015 Initial release\n\nThird Party Security Patches: Third party security patches that are to be\ninstalled on systems running HP software products should be applied in\naccordance with the customer\u0027s patch management policy. \n\nSupport: For issues about implementing the recommendations of this Security\nBulletin, contact normal HP Services support channel. For other issues about\nthe content of this Security Bulletin, send e-mail to security-alert@hp.com. \n\nReport: To report a potential security vulnerability with any HP supported\nproduct, send Email to: security-alert@hp.com\n\nSubscribe: To initiate a subscription to receive future HP Security Bulletin\nalerts via Email:\nhttp://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins\n\nSecurity Bulletin Archive: A list of recently released Security Bulletins is\navailable here:\nhttps://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/\n\nSoftware Product Category: The Software Product Category is represented in\nthe title by the two characters following HPSB. \n\n3C = 3COM\n3P = 3rd Party Software\nGN = HP General Software\nHF = HP Hardware and Firmware\nMP = MPE/iX\nMU = Multi-Platform Software\nNS = NonStop Servers\nOV = OpenVMS\nPI = Printing and Imaging\nPV = ProCurve\nST = Storage Software\nTU = Tru64 UNIX\nUX = HP-UX\n\nCopyright 2015 Hewlett-Packard Development Company, L.P. \nHewlett-Packard Company shall not be liable for technical or editorial errors\nor omissions contained herein. The information provided is provided \"as is\"\nwithout warranty of any kind. To the extent permitted by law, neither HP or\nits affiliates, subcontractors or suppliers will be liable for\nincidental,special or consequential damages including downtime cost; lost\nprofits; damages relating to the procurement of substitute products or\nservices; or damages for loss of data, or software restoration. The\ninformation in this document is subject to change without notice. \nHewlett-Packard Company and the names of Hewlett-Packard products referenced\nherein are trademarks of Hewlett-Packard Company in the United States and\nother countries. Other product and company names mentioned herein may be\ntrademarks of their respective owners. Description:\n\nRed Hat JBoss Data Virtualization is a lean data integration solution that\nprovides easy, real-time, and unified data access across disparate sources\nto multiple applications and users. JBoss Data Virtualization makes data\nspread across physically distinct systems\u2014such as multiple databases, XML\nfiles, and even Hadoop systems\u2014appear as a set of tables in a local\ndatabase. It includes\nvarious bug fixes, which are listed in the README file included with the\npatch files. \n\nThe following security issues are also fixed with this release,\ndescriptions of which can be found on the respective CVE pages linked in\nthe References section. \n\nCVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname\nverification bypass, incomplete CVE-2012-5783 fix\n\nCVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname\nverification bypass, incomplete CVE-2012-6153 fix\n\nCVE-2013-4002 Xerces-J2 OpenJDK: XML parsing Denial of Service (JAXP,\n8017298)\n\nCVE-2013-4517 Apache Santuario XML Security for Java: Java XML Signature\nDoS Attack\n\nCVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of\nuser-supplied content in outputText tags and EL expressions\n\nCVE-2014-0059 JBossSX/PicketBox: World readable audit.log file\n\nCVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding\ninput filter\n\nCVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs\n\nCVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content\nlength header\n\nCVE-2014-0119 Tomcat/JBossWeb: XML parser hijack by malicious web\napplication\n\nCVE-2014-0193 netty: DoS via memory exhaustion during data aggregation\n\nCVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding\ninput filter\n\nCVE-2014-3481 JBoss AS JAX-RS: Information disclosure via XML eXternal\nEntity (XXE)\n\nCVE-2014-3490 RESTEasy: XXE via parameter entities\n\nCVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage\n\nCVE-2014-3623 Apache WSS4J / Apache CXF: Improper security semantics\nenforcement of SAML SubjectConfirmation methods\n\nCVE-2014-7839 RESTeasy: External entities expanded by DocumentProvider\n\nCVE-2014-8122 JBoss Weld: Limited information disclosure via stale thread\nstate\n\nRed Hat would like to thank James Roper of Typesafe for reporting\nCVE-2014-0193, Alexander Papadakis for reporting CVE-2014-3530, and Rune\nSteinseth of JProfessionals for reporting CVE-2014-8122. Bugs fixed (https://bugzilla.redhat.com/):\n\n1019176 - CVE-2013-4002 Xerces-J2 OpenJDK: XML parsing Denial of Service (JAXP, 8017298)\n1045257 - CVE-2013-4517 Apache Santuario XML Security for Java: Java XML Signature DoS Attack\n1063642 - CVE-2014-0059 JBossSX/PicketBox: World readable audit.log file\n1065139 - CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions\n1072776 - CVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter\n1088342 - CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs\n1092783 - CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation\n1102030 - CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content length header\n1102038 - CVE-2014-0119 Tomcat/JBossWeb: XML parser hijack by malicious web application\n1105242 - CVE-2014-3481 JBoss AS JAX-RS: Information disclosure via XML eXternal Entity (XXE)\n1107901 - CVE-2014-3490 RESTEasy: XXE via parameter entities\n1109196 - CVE-2014-0227 Tomcat/JBossWeb: request smuggling andl imited DoS in ChunkedInputFilter\n1112987 - CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage\n1129074 - CVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix\n1129916 - CVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix\n1157304 - CVE-2014-3623 Apache WSS4J / Apache CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods\n1165328 - CVE-2014-7839 RESTeasy: External entities expanded by DocumentProvider\n1169237 - CVE-2014-8122 JBoss Weld: Limited information disclosure via stale thread state\n\n5. Solution:\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Description:\n\nRed Hat JBoss Web Server is a fully integrated and certified set of\ncomponents for hosting Java web applications. \n\nFor the oldstable distribution (wheezy), these problems have been fixed\nin version 6.0.45+dfsg-1~deb7u1. \n\nWe recommend that you upgrade your tomcat6 packages. \n\nThis update also fixes the following bugs:\n\n* The patch that resolved the CVE-2014-0050 issue contained redundant code. \nThis update removes the redundant code. (BZ#1094528)\n\n* The patch that resolved the CVE-2013-4322 issue contained an invalid\ncheck that triggered a java.io.EOFException while reading trailer headers\nfor chunked requests. This update fixes the check and the aforementioned\nexception is no longer triggered in the described scenario",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-0096"
},
{
"db": "BID",
"id": "67667"
},
{
"db": "PACKETSTORM",
"id": "131007"
},
{
"db": "PACKETSTORM",
"id": "127325"
},
{
"db": "PACKETSTORM",
"id": "133997"
},
{
"db": "PACKETSTORM",
"id": "130781"
},
{
"db": "PACKETSTORM",
"id": "127336"
},
{
"db": "PACKETSTORM",
"id": "127338"
},
{
"db": "PACKETSTORM",
"id": "136437"
},
{
"db": "PACKETSTORM",
"id": "127413"
}
],
"trust": 1.89
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-0096",
"trust": 2.1
},
{
"db": "BID",
"id": "67667",
"trust": 1.3
},
{
"db": "SECUNIA",
"id": "59873",
"trust": 1.0
},
{
"db": "SECUNIA",
"id": "59678",
"trust": 1.0
},
{
"db": "SECUNIA",
"id": "59616",
"trust": 1.0
},
{
"db": "SECUNIA",
"id": "59835",
"trust": 1.0
},
{
"db": "SECUNIA",
"id": "59732",
"trust": 1.0
},
{
"db": "SECUNIA",
"id": "60729",
"trust": 1.0
},
{
"db": "SECUNIA",
"id": "59121",
"trust": 1.0
},
{
"db": "SECUNIA",
"id": "59849",
"trust": 1.0
},
{
"db": "SECTRACK",
"id": "1030301",
"trust": 1.0
},
{
"db": "JUNIPER",
"id": "JSA10657",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "131007",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "127325",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "133997",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "130781",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "127336",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "127338",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "136437",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "127413",
"trust": 0.1
}
],
"sources": [
{
"db": "BID",
"id": "67667"
},
{
"db": "PACKETSTORM",
"id": "131007"
},
{
"db": "PACKETSTORM",
"id": "127325"
},
{
"db": "PACKETSTORM",
"id": "133997"
},
{
"db": "PACKETSTORM",
"id": "130781"
},
{
"db": "PACKETSTORM",
"id": "127336"
},
{
"db": "PACKETSTORM",
"id": "127338"
},
{
"db": "PACKETSTORM",
"id": "136437"
},
{
"db": "PACKETSTORM",
"id": "127413"
},
{
"db": "NVD",
"id": "CVE-2014-0096"
}
]
},
"id": "VAR-201405-0542",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.44401007833333334
},
"last_update_date": "2024-07-23T20:06:39.885000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-264",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2014-0096"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.4,
"url": "http://tomcat.apache.org/security-6.html"
},
{
"trust": 1.4,
"url": "http://tomcat.apache.org/security-7.html"
},
{
"trust": 1.3,
"url": "http://tomcat.apache.org/security-8.html"
},
{
"trust": 1.3,
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"trust": 1.1,
"url": "http://rhn.redhat.com/errata/rhsa-2015-0720.html"
},
{
"trust": 1.1,
"url": "http://rhn.redhat.com/errata/rhsa-2015-0675.html"
},
{
"trust": 1.0,
"url": "http://advisories.mageia.org/mgasa-2014-0268.html"
},
{
"trust": 1.0,
"url": "http://linux.oracle.com/errata/elsa-2014-0865.html"
},
{
"trust": 1.0,
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-february/150282.html"
},
{
"trust": 1.0,
"url": "http://marc.info/?l=bugtraq\u0026m=141017844705317\u0026w=2"
},
{
"trust": 1.0,
"url": "http://marc.info/?l=bugtraq\u0026m=144498216801440\u0026w=2"
},
{
"trust": 1.0,
"url": "http://rhn.redhat.com/errata/rhsa-2015-0765.html"
},
{
"trust": 1.0,
"url": "http://seclists.org/fulldisclosure/2014/dec/23"
},
{
"trust": 1.0,
"url": "http://seclists.org/fulldisclosure/2014/may/135"
},
{
"trust": 1.0,
"url": "http://secunia.com/advisories/59121"
},
{
"trust": 1.0,
"url": "http://secunia.com/advisories/59616"
},
{
"trust": 1.0,
"url": "http://secunia.com/advisories/59678"
},
{
"trust": 1.0,
"url": "http://secunia.com/advisories/59732"
},
{
"trust": 1.0,
"url": "http://secunia.com/advisories/59835"
},
{
"trust": 1.0,
"url": "http://secunia.com/advisories/59849"
},
{
"trust": 1.0,
"url": "http://secunia.com/advisories/59873"
},
{
"trust": 1.0,
"url": "http://secunia.com/advisories/60729"
},
{
"trust": 1.0,
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578610"
},
{
"trust": 1.0,
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578611"
},
{
"trust": 1.0,
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578637"
},
{
"trust": 1.0,
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1578655"
},
{
"trust": 1.0,
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1585853"
},
{
"trust": 1.0,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678231"
},
{
"trust": 1.0,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681528"
},
{
"trust": 1.0,
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"trust": 1.0,
"url": "http://www.debian.org/security/2016/dsa-3552"
},
{
"trust": 1.0,
"url": "http://www.mandriva.com/security/advisories?name=mdvsa-2015:052"
},
{
"trust": 1.0,
"url": "http://www.mandriva.com/security/advisories?name=mdvsa-2015:053"
},
{
"trust": 1.0,
"url": "http://www.mandriva.com/security/advisories?name=mdvsa-2015:084"
},
{
"trust": 1.0,
"url": "http://www.novell.com/support/kb/doc.php?id=7010166"
},
{
"trust": 1.0,
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"
},
{
"trust": 1.0,
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/bid/67667"
},
{
"trust": 1.0,
"url": "http://www.securitytracker.com/id/1030301"
},
{
"trust": 1.0,
"url": "http://www.vmware.com/security/advisories/vmsa-2014-0012.html"
},
{
"trust": 1.0,
"url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04851013"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3cdev.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3cdev.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3cdev.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3cdev.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3cdev.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3cdev.tomcat.apache.org%3e"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-0099"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-0096"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-0075"
},
{
"trust": 0.6,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.6,
"url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.6,
"url": "https://bugzilla.redhat.com/):"
},
{
"trust": 0.4,
"url": "https://rhn.redhat.com/errata/rhsa-2014-0827.html"
},
{
"trust": 0.4,
"url": "https://rhn.redhat.com/errata/rhsa-2014-0833.html"
},
{
"trust": 0.4,
"url": "https://rhn.redhat.com/errata/rhsa-2014-0835.html"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-0119"
},
{
"trust": 0.4,
"url": "https://www.redhat.com/security/data/cve/cve-2014-0075.html"
},
{
"trust": 0.4,
"url": "https://www.redhat.com/security/data/cve/cve-2014-0096.html"
},
{
"trust": 0.4,
"url": "https://www.redhat.com/security/data/cve/cve-2014-0099.html"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"trust": 0.3,
"url": "http://www.apache.org/"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21682740"
},
{
"trust": 0.3,
"url": "http://www.ibm.com/support/docview.wss?uid=swg21686477"
},
{
"trust": 0.3,
"url": "https://www-304.ibm.com/support/docview.wss?uid=swg21678231"
},
{
"trust": 0.3,
"url": "https://rhn.redhat.com/errata/rhsa-2014-0843.html"
},
{
"trust": 0.3,
"url": "http://kb.juniper.net/infocenter/index?page=content\u0026id=jsa10657\u0026cat=sirt_1\u0026actp=list"
},
{
"trust": 0.3,
"url": "https://www-304.ibm.com/support/docview.wss?uid=swg21681528"
},
{
"trust": 0.3,
"url": "https://downloads.avaya.com/css/p8/documents/100182185"
},
{
"trust": 0.3,
"url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c04851013"
},
{
"trust": 0.3,
"url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04223376"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21684910"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677448"
},
{
"trust": 0.3,
"url": "https://rhn.redhat.com/errata/rhsa-2014-0842.html"
},
{
"trust": 0.3,
"url": "https://rhn.redhat.com/errata/rhsa-2014-0834.html"
},
{
"trust": 0.3,
"url": "https://rhn.redhat.com/errata/rhsa-2014-0836.html"
},
{
"trust": 0.3,
"url": "https://www-304.ibm.com/support/docview.wss?uid=swg21683334"
},
{
"trust": 0.3,
"url": "https://www-304.ibm.com/support/docview.wss?uid=ssg1s1004849"
},
{
"trust": 0.3,
"url": "https://www-304.ibm.com/support/docview.wss?uid=swg21682393"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21683430"
},
{
"trust": 0.3,
"url": "https://www-304.ibm.com/support/docview.wss?uid=swg21683445"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677222"
},
{
"trust": 0.3,
"url": "https://www-304.ibm.com/support/docview.wss?uid=swg21684768"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21679568"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21691579"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=nas8n1020714"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21691580"
},
{
"trust": 0.3,
"url": "https://www-304.ibm.com/support/docview.wss?uid=swg21688095"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676983"
},
{
"trust": 0.3,
"url": "http://support.f5.com/kb/en-us/solutions/public/15000/400/sol15428.html?ref=rss"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678892"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-0227"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/team/key/#package"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2013-4002"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-6153"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-3481"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2014-3490"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-3530"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2013-5855"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2014-0099"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2014-3481"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-5855"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2014-0096"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-0193"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-3490"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2014-3577"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-3577"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-4002"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2014-0193"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2014-0227"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2014-0075"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2012-6153"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2014-0119"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2014-3530"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-4590"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-4322"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-0230"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-4286"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2014-3625"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=jboss.fuse.serviceworks\u0026downloadtype=securitypatches\u0026version=6.0.0"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-3558"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2014-0005"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2014-3558"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2014-3472"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-0005"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-3625"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-3472"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2014-3578"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-3578"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/site/articles/11258"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-0277"
},
{
"trust": 0.1,
"url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secbullarchive/"
},
{
"trust": 0.1,
"url": "http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins"
},
{
"trust": 0.1,
"url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-4444"
},
{
"trust": 0.1,
"url": "http://auth-h71000-pro-sitebuilder.houston.hp.com/openvms/products/ips/apac"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-4517"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=data.services.platform\u0026downloadtype=distributions\u0026version=6.1.0"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2014-0059"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2014-3623"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2014-8122"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-7839"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-3623"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-0059"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-8122"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2013-4517"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2014-7839"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=webserver\u0026downloadtype=securitypatches\u0026version=2.0.1"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/knowledge/articles/11258"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-0763"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-7810"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-0706"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-5345"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-0714"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-5346"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-5174"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-5351"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-0033"
},
{
"trust": 0.1,
"url": "https://rhn.redhat.com/errata/rhsa-2014-0865.html"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/articles/11258"
}
],
"sources": [
{
"db": "BID",
"id": "67667"
},
{
"db": "PACKETSTORM",
"id": "131007"
},
{
"db": "PACKETSTORM",
"id": "127325"
},
{
"db": "PACKETSTORM",
"id": "133997"
},
{
"db": "PACKETSTORM",
"id": "130781"
},
{
"db": "PACKETSTORM",
"id": "127336"
},
{
"db": "PACKETSTORM",
"id": "127338"
},
{
"db": "PACKETSTORM",
"id": "136437"
},
{
"db": "PACKETSTORM",
"id": "127413"
},
{
"db": "NVD",
"id": "CVE-2014-0096"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "BID",
"id": "67667"
},
{
"db": "PACKETSTORM",
"id": "131007"
},
{
"db": "PACKETSTORM",
"id": "127325"
},
{
"db": "PACKETSTORM",
"id": "133997"
},
{
"db": "PACKETSTORM",
"id": "130781"
},
{
"db": "PACKETSTORM",
"id": "127336"
},
{
"db": "PACKETSTORM",
"id": "127338"
},
{
"db": "PACKETSTORM",
"id": "136437"
},
{
"db": "PACKETSTORM",
"id": "127413"
},
{
"db": "NVD",
"id": "CVE-2014-0096"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-05-27T00:00:00",
"db": "BID",
"id": "67667"
},
{
"date": "2015-03-25T00:39:51",
"db": "PACKETSTORM",
"id": "131007"
},
{
"date": "2014-07-02T21:43:13",
"db": "PACKETSTORM",
"id": "127325"
},
{
"date": "2015-10-16T23:23:00",
"db": "PACKETSTORM",
"id": "133997"
},
{
"date": "2015-03-12T00:59:47",
"db": "PACKETSTORM",
"id": "130781"
},
{
"date": "2014-07-03T23:00:39",
"db": "PACKETSTORM",
"id": "127336"
},
{
"date": "2014-07-03T23:00:52",
"db": "PACKETSTORM",
"id": "127338"
},
{
"date": "2016-03-26T13:13:00",
"db": "PACKETSTORM",
"id": "136437"
},
{
"date": "2014-07-09T18:51:14",
"db": "PACKETSTORM",
"id": "127413"
},
{
"date": "2014-05-31T11:17:13.233000",
"db": "NVD",
"id": "CVE-2014-0096"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-05-23T16:27:00",
"db": "BID",
"id": "67667"
},
{
"date": "2023-11-07T02:18:07.997000",
"db": "NVD",
"id": "CVE-2014-0096"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "127325"
},
{
"db": "PACKETSTORM",
"id": "127336"
},
{
"db": "PACKETSTORM",
"id": "127338"
},
{
"db": "PACKETSTORM",
"id": "127413"
}
],
"trust": 0.4
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apache Tomcat CVE-2014-0096 XML External Entity Information Disclosure Vulnerability",
"sources": [
{
"db": "BID",
"id": "67667"
}
],
"trust": 0.3
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design Error",
"sources": [
{
"db": "BID",
"id": "67667"
}
],
"trust": 0.3
}
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.