rhsa-2012_0345
Vulnerability from csaf_redhat
Published
2012-03-01 06:45
Modified
2024-09-15 19:28
Summary
Red Hat Security Advisory: jbossweb security and bug fix update
Notes
Topic
An update for JBoss Enterprise Portal Platform 4.3 CP07 that fixes one
security issue and one bug is now available from the Red Hat Customer
Portal.
The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.
Details
JBoss Enterprise Portal Platform is the open source implementation of the
Java EE suite of services and Portal services running atop JBoss Enterprise
Application Platform. It comprises a set of offerings for enterprise
customers who are looking for pre-configured profiles of JBoss Enterprise
Middleware components that have been tested and certified together to
provide an integrated experience.
It was found that JBoss Web did not handle large numbers of parameters and
large parameter values efficiently. A remote attacker could make JBoss Web
use an excessive amount of CPU time by sending an HTTP request containing a
large number of parameters or large parameter values. This update
introduces limits on the number of parameters and headers processed per
request to address this issue. The default limit is 512 for parameters
and 128 for headers. These defaults can be changed by setting the
org.apache.tomcat.util.http.Parameters.MAX_COUNT and
org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties in
"jboss-as/server/[PROFILE]/deploy/properties-service.xml". (CVE-2012-0022)
This update also fixes a bug that occurred when using certain forms with a
custom encoding. (BZ#794470)
Warning: Before applying this update, back up all applications deployed on
JBoss Enterprise Portal Platform, along with all customized configuration
files.
All users of JBoss Enterprise Portal Platform 4.3 CP07 as provided from the
Red Hat Customer Portal are advised to install this update.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for JBoss Enterprise Portal Platform 4.3 CP07 that fixes one\nsecurity issue and one bug is now available from the Red Hat Customer\nPortal.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
"title": "Topic"
},
{
"category": "general",
"text": "JBoss Enterprise Portal Platform is the open source implementation of the\nJava EE suite of services and Portal services running atop JBoss Enterprise\nApplication Platform. It comprises a set of offerings for enterprise\ncustomers who are looking for pre-configured profiles of JBoss Enterprise\nMiddleware components that have been tested and certified together to\nprovide an integrated experience.\n\nIt was found that JBoss Web did not handle large numbers of parameters and\nlarge parameter values efficiently. A remote attacker could make JBoss Web\nuse an excessive amount of CPU time by sending an HTTP request containing a\nlarge number of parameters or large parameter values. This update\nintroduces limits on the number of parameters and headers processed per\nrequest to address this issue. The default limit is 512 for parameters\nand 128 for headers. These defaults can be changed by setting the\norg.apache.tomcat.util.http.Parameters.MAX_COUNT and\norg.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties in\n\"jboss-as/server/[PROFILE]/deploy/properties-service.xml\". (CVE-2012-0022)\n\nThis update also fixes a bug that occurred when using certain forms with a\ncustom encoding. (BZ#794470)\n\nWarning: Before applying this update, back up all applications deployed on\nJBoss Enterprise Portal Platform, along with all customized configuration\nfiles.\n\nAll users of JBoss Enterprise Portal Platform 4.3 CP07 as provided from the\nRed Hat Customer Portal are advised to install this update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2012:0345",
"url": "https://access.redhat.com/errata/RHSA-2012:0345"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal\u0026downloadType=securityPatches\u0026version=4.3+CP07",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal\u0026downloadType=securityPatches\u0026version=4.3+CP07"
},
{
"category": "external",
"summary": "783359",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=783359"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/data/csaf/v2/advisories/2012/rhsa-2012_0345.json"
}
],
"title": "Red Hat Security Advisory: jbossweb security and bug fix update",
"tracking": {
"current_release_date": "2024-09-15T19:28:47+00:00",
"generator": {
"date": "2024-09-15T19:28:47+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "3.33.3"
}
},
"id": "RHSA-2012:0345",
"initial_release_date": "2012-03-01T06:45:00+00:00",
"revision_history": [
{
"date": "2012-03-01T06:45:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2012-03-01T06:53:20+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-09-15T19:28:47+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Portal 4.3",
"product": {
"name": "Red Hat JBoss Portal 4.3",
"product_id": "Red Hat JBoss Portal 4.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_portal_platform:4.3"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Middleware"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2012-0022",
"discovery_date": "2012-01-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "783359"
}
],
"notes": [
{
"category": "description",
"text": "Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: large number of parameters DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Portal 4.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-0022"
},
{
"category": "external",
"summary": "RHBZ#783359",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=783359"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-0022",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-0022"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-0022",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0022"
}
],
"release_date": "2012-01-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update).\n\nThe JBoss server process must be restarted for this update to take effect.",
"product_ids": [
"Red Hat JBoss Portal 4.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2012:0345"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Portal 4.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: large number of parameters DoS"
}
]
}
Loading...