rhsa-2011_1456
Vulnerability from csaf_redhat
Published
2011-11-16 23:49
Modified
2024-09-15 19:34
Summary
Red Hat Security Advisory: JBoss Enterprise SOA Platform 5.2.0 update

Notes

Topic
JBoss Enterprise SOA Platform 5.2.0, which fixes two security issues, various bugs, and adds enhancements is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
Details
JBoss Enterprise SOA Platform is the next-generation ESB and business process automation infrastructure. JBoss Enterprise SOA Platform allows IT to leverage existing (MoM and EAI), modern (SOA and BPM-Rules), and future (EDA and CEP) integration methodologies to dramatically improve business process execution speed and quality. This release of JBoss Enterprise SOA Platform 5.2.0 serves as a replacement for JBoss Enterprise SOA Platform 5.1.0. It includes various bug fixes and enhancements which are detailed in the JBoss Enterprise SOA Platform 5.2.0 Release Notes. The Release Notes will be available shortly from https://docs.redhat.com/docs/en-US/index.html The following security issues are also fixed with this release: A cross-site scripting (XSS) flaw was found in JRuby (a Java implementation of Ruby), which is included in the scripting_chain sample application. The sample application does not expose this flaw. If the version of JRuby shipped with the scripting_chain sample application was used to build a custom application, a remote attacker could use this flaw to supply specially-crafted input to that application, leading to the execution of arbitrary HTML or web script. (CVE-2010-1330) Note: JBoss Enterprise SOA Platform only provides JRuby as a dependency of the scripting_chain quickstart. The CVE-2010-1330 flaw is not exposed unless the version of JRuby shipped with that quickstart is used by a deployed, custom application. It was found that the invoker servlets, deployed by default via httpha-invoker, only performed access control on the HTTP GET and POST methods, allowing remote attackers to make unauthenticated requests by using different HTTP methods. Due to the second layer of authentication provided by a security interceptor, this issue is not exploitable on default installations unless an administrator has misconfigured the security interceptor or disabled it. (CVE-2011-4085) Warning: Before applying the update, back up your existing JBoss Enterprise SOA Platform installation (including its databases, applications, configuration files, and so on). All users of JBoss Enterprise SOA Platform 5.1.0 as provided from the Red Hat Customer Portal are advised to upgrade to JBoss Enterprise SOA Platform 5.2.0.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "JBoss Enterprise SOA Platform 5.2.0, which fixes two security issues,\nvarious bugs, and adds enhancements is now available from the Red Hat\nCustomer Portal.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "JBoss Enterprise SOA Platform is the next-generation ESB and business\nprocess automation infrastructure. JBoss Enterprise SOA Platform allows IT\nto leverage existing (MoM and EAI), modern (SOA and BPM-Rules), and future\n(EDA and CEP) integration methodologies to dramatically improve business\nprocess execution speed and quality.\n\nThis release of JBoss Enterprise SOA Platform 5.2.0 serves as a replacement\nfor JBoss Enterprise SOA Platform 5.1.0. It includes various bug fixes and\nenhancements which are detailed in the JBoss Enterprise SOA Platform 5.2.0\nRelease Notes. The Release Notes will be available shortly from\nhttps://docs.redhat.com/docs/en-US/index.html\n\nThe following security issues are also fixed with this release:\n\nA cross-site scripting (XSS) flaw was found in JRuby (a Java implementation\nof Ruby), which is included in the scripting_chain sample application. The\nsample application does not expose this flaw. If the version of JRuby\nshipped with the scripting_chain sample application was used to build a\ncustom application, a remote attacker could use this flaw to supply\nspecially-crafted input to that application, leading to the execution of\narbitrary HTML or web script. (CVE-2010-1330)\n\nNote: JBoss Enterprise SOA Platform only provides JRuby as a dependency of\nthe scripting_chain quickstart. The CVE-2010-1330 flaw is not exposed\nunless the version of JRuby shipped with that quickstart is used by a\ndeployed, custom application.\n\nIt was found that the invoker servlets, deployed by default via\nhttpha-invoker, only performed access control on the HTTP GET and POST\nmethods, allowing remote attackers to make unauthenticated requests by\nusing different HTTP methods. Due to the second layer of authentication\nprovided by a security interceptor, this issue is not exploitable on\ndefault installations unless an administrator has misconfigured the\nsecurity interceptor or disabled it. (CVE-2011-4085)\n\nWarning: Before applying the update, back up your existing JBoss Enterprise\nSOA Platform installation (including its databases, applications,\nconfiguration files, and so on).\n\nAll users of JBoss Enterprise SOA Platform 5.1.0 as provided from the Red\nHat Customer Portal are advised to upgrade to JBoss Enterprise SOA Platform\n5.2.0.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2011:1456",
        "url": "https://access.redhat.com/errata/RHSA-2011:1456"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/docs/en-US/index.html",
        "url": "https://docs.redhat.com/docs/en-US/index.html"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=soaplatform\u0026downloadType=distributions",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=soaplatform\u0026downloadType=distributions"
      },
      {
        "category": "external",
        "summary": "750306",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=750306"
      },
      {
        "category": "external",
        "summary": "750422",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=750422"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2011/rhsa-2011_1456.json"
      }
    ],
    "title": "Red Hat Security Advisory: JBoss Enterprise SOA Platform 5.2.0 update",
    "tracking": {
      "current_release_date": "2024-09-15T19:34:02+00:00",
      "generator": {
        "date": "2024-09-15T19:34:02+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "3.33.3"
        }
      },
      "id": "RHSA-2011:1456",
      "initial_release_date": "2011-11-16T23:49:00+00:00",
      "revision_history": [
        {
          "date": "2011-11-16T23:49:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2011-11-16T23:54:04+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-09-15T19:34:02+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss SOA Platform 5.1",
                "product": {
                  "name": "Red Hat JBoss SOA Platform 5.1",
                  "product_id": "Red Hat JBoss SOA Platform 5.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_soa_platform:5.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Middleware"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2010-1330",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2011-10-30T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "750306"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The regular expression engine in JRuby before 1.4.1, when $KCODE is set to \u0027u\u0027, does not properly handle characters immediately after a UTF-8 character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jruby: XSS in the regular expression engine when processing invalid UTF-8 byte sequences",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss SOA Platform 5.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2010-1330"
        },
        {
          "category": "external",
          "summary": "RHBZ#750306",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=750306"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2010-1330",
          "url": "https://www.cve.org/CVERecord?id=CVE-2010-1330"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-1330",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1330"
        }
      ],
      "release_date": "2010-04-26T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss SOA Platform 5.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2011:1456"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss SOA Platform 5.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jruby: XSS in the regular expression engine when processing invalid UTF-8 byte sequences"
    },
    {
      "cve": "CVE-2011-4085",
      "discovery_date": "2011-10-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "750422"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication by sending a request with a different method.  NOTE: this vulnerability exists because of a CVE-2010-0738 regression.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Invoker servlets authentication bypass (HTTP verb tampering)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss SOA Platform 5.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2011-4085"
        },
        {
          "category": "external",
          "summary": "RHBZ#750422",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=750422"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2011-4085",
          "url": "https://www.cve.org/CVERecord?id=CVE-2011-4085"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2011-4085",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4085"
        }
      ],
      "release_date": "2011-11-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss SOA Platform 5.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2011:1456"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 2.6,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss SOA Platform 5.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Invoker servlets authentication bypass (HTTP verb tampering)"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.