rhsa-2013_0257
Vulnerability from csaf_redhat
Published
2013-02-13 18:54
Modified
2024-11-05 17:58
Summary
Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 security update

Notes

Topic
An updated apache-cxf package for JBoss Enterprise Application Platform 5.2.0 that fixes two security issues is now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
Details
JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam. If web services were deployed using Apache CXF with the WSS4JInInterceptor enabled to apply WS-Security processing, HTTP GET requests to these services were always granted access, without applying authentication checks. The URIMappingInterceptor is a legacy mechanism for allowing REST-like access (via GET requests) to simple SOAP services. A remote attacker could use this flaw to access the REST-like interface of a simple SOAP service using GET requests that bypass the security constraints applied by WSS4JInInterceptor. This flaw was only exploitable if WSS4JInInterceptor was used to apply WS-Security processing. Services that use WS-SecurityPolicy to apply security were not affected. (CVE-2012-5633) It was found that Apache CXF was vulnerable to SOAPAction spoofing attacks under certain conditions. If web services were exposed via Apache CXF that use a unique SOAPAction for each service operation, then a remote attacker could perform SOAPAction spoofing to call a forbidden operation if it accepts the same parameters as an allowed operation. WS-Policy validation was performed against the operation being invoked, and an attack must pass validation to be successful. (CVE-2012-3451) Note that the CVE-2012-3451 and CVE-2012-5633 issues only affected environments that have JBoss Web Services CXF installed. Red Hat would like to thank the Apache CXF project for reporting CVE-2012-3451. Warning: Before applying this update, back up your existing JBoss Enterprise Application Platform installation (including all applications and configuration files). All users of JBoss Enterprise Application Platform 5.2.0 on Red Hat Enterprise Linux 4, 5, and 6 are advised to upgrade to this updated package. The JBoss server process must be restarted for the update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated apache-cxf package for JBoss Enterprise Application Platform\n5.2.0 that fixes two security issues is now available for Red Hat\nEnterprise Linux 4, 5, and 6.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "JBoss Enterprise Application Platform is a platform for Java applications,\nwhich integrates the JBoss Application Server with JBoss Hibernate and\nJBoss Seam.\n\nIf web services were deployed using Apache CXF with the WSS4JInInterceptor\nenabled to apply WS-Security processing, HTTP GET requests to these\nservices were always granted access, without applying authentication\nchecks. The URIMappingInterceptor is a legacy mechanism for allowing\nREST-like access (via GET requests) to simple SOAP services. A remote\nattacker could use this flaw to access the REST-like interface of a simple\nSOAP service using GET requests that bypass the security constraints\napplied by WSS4JInInterceptor. This flaw was only exploitable if\nWSS4JInInterceptor was used to apply WS-Security processing. Services that\nuse WS-SecurityPolicy to apply security were not affected. (CVE-2012-5633)\n\nIt was found that Apache CXF was vulnerable to SOAPAction spoofing attacks\nunder certain conditions. If web services were exposed via Apache CXF that\nuse a unique SOAPAction for each service operation, then a remote attacker\ncould perform SOAPAction spoofing to call a forbidden operation if it\naccepts the same parameters as an allowed operation. WS-Policy validation\nwas performed against the operation being invoked, and an attack must pass\nvalidation to be successful. (CVE-2012-3451)\n\nNote that the CVE-2012-3451 and CVE-2012-5633 issues only affected\nenvironments that have JBoss Web Services CXF installed.\n\nRed Hat would like to thank the Apache CXF project for reporting\nCVE-2012-3451.\n\nWarning: Before applying this update, back up your existing JBoss\nEnterprise Application Platform installation (including all applications\nand configuration files).\n\nAll users of JBoss Enterprise Application Platform 5.2.0 on Red Hat\nEnterprise Linux 4, 5, and 6 are advised to upgrade to this updated\npackage. The JBoss server process must be restarted for the update to take\neffect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2013:0257",
        "url": "https://access.redhat.com/errata/RHSA-2013:0257"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "http://cxf.apache.org/security-advisories.html",
        "url": "http://cxf.apache.org/security-advisories.html"
      },
      {
        "category": "external",
        "summary": "851896",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=851896"
      },
      {
        "category": "external",
        "summary": "889008",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=889008"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0257.json"
      }
    ],
    "title": "Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 security update",
    "tracking": {
      "current_release_date": "2024-11-05T17:58:22+00:00",
      "generator": {
        "date": "2024-11-05T17:58:22+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2013:0257",
      "initial_release_date": "2013-02-13T18:54:00+00:00",
      "revision_history": [
        {
          "date": "2013-02-13T18:54:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2013-02-13T19:01:01+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T17:58:22+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS",
                  "product_id": "4AS-JBEAP-5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:5::el4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES",
                  "product_id": "4ES-JBEAP-5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:5::el4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server",
                  "product_id": "5Server-JBEAP-5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:5::el5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server",
                  "product_id": "6Server-JBEAP-5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:5::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache-cxf-0:2.2.12-10.patch_06.ep5.el4.src",
                "product": {
                  "name": "apache-cxf-0:2.2.12-10.patch_06.ep5.el4.src",
                  "product_id": "apache-cxf-0:2.2.12-10.patch_06.ep5.el4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-cxf@2.2.12-10.patch_06.ep5.el4?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "apache-cxf-0:2.2.12-10.patch_06.ep5.el5.src",
                "product": {
                  "name": "apache-cxf-0:2.2.12-10.patch_06.ep5.el5.src",
                  "product_id": "apache-cxf-0:2.2.12-10.patch_06.ep5.el5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-cxf@2.2.12-10.patch_06.ep5.el5?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "apache-cxf-0:2.2.12-10.patch_06.ep5.el6.src",
                "product": {
                  "name": "apache-cxf-0:2.2.12-10.patch_06.ep5.el6.src",
                  "product_id": "apache-cxf-0:2.2.12-10.patch_06.ep5.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-cxf@2.2.12-10.patch_06.ep5.el6?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache-cxf-0:2.2.12-10.patch_06.ep5.el4.noarch",
                "product": {
                  "name": "apache-cxf-0:2.2.12-10.patch_06.ep5.el4.noarch",
                  "product_id": "apache-cxf-0:2.2.12-10.patch_06.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-cxf@2.2.12-10.patch_06.ep5.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "apache-cxf-0:2.2.12-10.patch_06.ep5.el5.noarch",
                "product": {
                  "name": "apache-cxf-0:2.2.12-10.patch_06.ep5.el5.noarch",
                  "product_id": "apache-cxf-0:2.2.12-10.patch_06.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-cxf@2.2.12-10.patch_06.ep5.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "apache-cxf-0:2.2.12-10.patch_06.ep5.el6.noarch",
                "product": {
                  "name": "apache-cxf-0:2.2.12-10.patch_06.ep5.el6.noarch",
                  "product_id": "apache-cxf-0:2.2.12-10.patch_06.ep5.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-cxf@2.2.12-10.patch_06.ep5.el6?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.2.12-10.patch_06.ep5.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS",
          "product_id": "4AS-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.noarch"
        },
        "product_reference": "apache-cxf-0:2.2.12-10.patch_06.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.2.12-10.patch_06.ep5.el4.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS",
          "product_id": "4AS-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.src"
        },
        "product_reference": "apache-cxf-0:2.2.12-10.patch_06.ep5.el4.src",
        "relates_to_product_reference": "4AS-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.2.12-10.patch_06.ep5.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES",
          "product_id": "4ES-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.noarch"
        },
        "product_reference": "apache-cxf-0:2.2.12-10.patch_06.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.2.12-10.patch_06.ep5.el4.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES",
          "product_id": "4ES-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.src"
        },
        "product_reference": "apache-cxf-0:2.2.12-10.patch_06.ep5.el4.src",
        "relates_to_product_reference": "4ES-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.2.12-10.patch_06.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el5.noarch"
        },
        "product_reference": "apache-cxf-0:2.2.12-10.patch_06.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.2.12-10.patch_06.ep5.el5.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el5.src"
        },
        "product_reference": "apache-cxf-0:2.2.12-10.patch_06.ep5.el5.src",
        "relates_to_product_reference": "5Server-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.2.12-10.patch_06.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el6.noarch"
        },
        "product_reference": "apache-cxf-0:2.2.12-10.patch_06.ep5.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.2.12-10.patch_06.ep5.el6.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el6.src"
        },
        "product_reference": "apache-cxf-0:2.2.12-10.patch_06.ep5.el6.src",
        "relates_to_product_reference": "6Server-JBEAP-5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Apache CXF project"
          ]
        }
      ],
      "cve": "CVE-2012-3451",
      "discovery_date": "2012-08-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "851896"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-cxf: SOAPAction spoofing on document literal web services",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.noarch",
          "4AS-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.src",
          "4ES-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.noarch",
          "4ES-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.src",
          "5Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el5.noarch",
          "5Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el5.src",
          "6Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el6.noarch",
          "6Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el6.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-3451"
        },
        {
          "category": "external",
          "summary": "RHBZ#851896",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=851896"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-3451",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-3451"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3451",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3451"
        }
      ],
      "release_date": "2012-09-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-02-13T18:54:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "4AS-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.noarch",
            "4AS-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.src",
            "4ES-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.noarch",
            "4ES-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.src",
            "5Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el5.noarch",
            "5Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el5.src",
            "6Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el6.noarch",
            "6Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el6.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0257"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "4AS-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.noarch",
            "4AS-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.src",
            "4ES-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.noarch",
            "4ES-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.src",
            "5Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el5.noarch",
            "5Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el5.src",
            "6Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el6.noarch",
            "6Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el6.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache-cxf: SOAPAction spoofing on document literal web services"
    },
    {
      "cve": "CVE-2012-5633",
      "discovery_date": "2012-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "889008"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.noarch",
          "4AS-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.src",
          "4ES-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.noarch",
          "4ES-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.src",
          "5Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el5.noarch",
          "5Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el5.src",
          "6Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el6.noarch",
          "6Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el6.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-5633"
        },
        {
          "category": "external",
          "summary": "RHBZ#889008",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=889008"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-5633",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-5633"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-5633",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5633"
        }
      ],
      "release_date": "2013-02-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-02-13T18:54:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "4AS-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.noarch",
            "4AS-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.src",
            "4ES-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.noarch",
            "4ES-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.src",
            "5Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el5.noarch",
            "5Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el5.src",
            "6Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el6.noarch",
            "6Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el6.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0257"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "4AS-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.noarch",
            "4AS-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.src",
            "4ES-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.noarch",
            "4ES-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el4.src",
            "5Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el5.noarch",
            "5Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el5.src",
            "6Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el6.noarch",
            "6Server-JBEAP-5:apache-cxf-0:2.2.12-10.patch_06.ep5.el6.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.