{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated Red Hat JBoss Enterprise Application Platform 6.2.1 packages that\nfix one security issue are now available for Red Hat Enterprise Linux 5\nand 6.\n\nThe Red Hat Security Response Team has rated this update as having Low\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform 6 is a platform for Java\napplications based on JBoss Application Server 7.\n\nIt was found that the security audit functionality, as provided by Red Hat\nJBoss Enterprise Application Platform 6, logged request parameters in plain\ntext. This may have caused passwords to be included in the audit log files\nwhen using BASIC or FORM-based authentication. A local attacker with access\nto audit log files could possibly use this flaw to obtain application or\nserver authentication credentials. (CVE-2014-0058)\n\nThe provided patch to fix CVE-2014-0058 also allows greater control over\nwhich of the following components of web requests are captured in audit\nlogs:\n\n - parameters\n - cookies\n - headers\n - attributes\n\nIt is also possible to selectively mask some elements of headers,\nparameters, cookies, and attributes using masks. This capability is\nprovided by two system properties, which are introduced by this patch:\n\n1) org.jboss.security.web.audit\n\nDescription:\nThis property controls the granularity of the security auditing of web\nrequests.\n\nPossible values:\noff = Disables auditing of web requests\nheaders = Audits only the headers of web requests\ncookies = Audits only the cookies of web requests\nparameters = Audits only the parameters of web requests\nattributes = Audits only the attributes of web requests\nheaders,cookies,parameters = Audits the headers, cookies, and parameters of\nweb requests\nheaders,cookies = Audits the headers and cookies of web requests\n\nDefault Value:\nheaders, parameters\n\nExamples:\nSetting \"org.jboss.security.web.audit=off\" disables security auditing of\nweb requests entirely.\nSetting \"org.jboss.security.web.audit=headers\" enables security auditing of\nonly headers in web requests.\n\n2) org.jboss.security.web.audit.mask\n\nDescription:\nThis property can be used to specify a list of strings to be matched\nagainst headers, parameters, cookies, and attributes of web requests.\nAny element matching the specified masks will be excluded from security\naudit logging.\n\nPossible values:\nAny comma separated string indicating keys of headers, parameters, cookies,\nand attributes.\n\nDefault Value:\nj_password, authorization\n\nNote that currently the matching of the masks is fuzzy rather than strict.\nFor example, a mask of \"authorization\" will mask both the header called\nauthorization and the parameter called \"custom_authorization\". A future\nrelease may introduce strict masks.\n\nWarning: Before applying this update, back up your existing Red Hat JBoss\nEnterprise Application Platform installation and deployed applications.\n\nAll users of Red Hat JBoss Enterprise Application Platform 6.2.1 on Red Hat\nEnterprise Linux 5 and 6 are advised to upgrade to these updated packages.\nThe JBoss server process must be restarted for the update to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:0204",
        "url": "https://access.redhat.com/errata/RHSA-2014:0204"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "1063641",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063641"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0204.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 security update",
    "tracking": {
      "current_release_date": "2024-11-05T18:19:59+00:00",
      "generator": {
        "date": "2024-11-05T18:19:59+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2014:0204",
      "initial_release_date": "2014-02-24T19:59:37+00:00",
      "revision_history": [
        {
          "date": "2014-02-24T19:59:37+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-02-24T20:40:07+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T18:19:59+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server",
                  "product_id": "5Server-JBEAP-6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server",
                  "product_id": "6Server-JBEAP-6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el5.src",
                "product": {
                  "name": "jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el5.src",
                  "product_id": "jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-as-web@7.3.1-4.Final_redhat_4.1.ep6.el5?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el6.src",
                "product": {
                  "name": "jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el6.src",
                  "product_id": "jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-as-web@7.3.1-4.Final_redhat_4.1.ep6.el6?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el5.noarch",
                "product": {
                  "name": "jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el5.noarch",
                  "product_id": "jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-as-web@7.3.1-4.Final_redhat_4.1.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el6.noarch",
                "product": {
                  "name": "jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el6.noarch",
                  "product_id": "jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-as-web@7.3.1-4.Final_redhat_4.1.ep6.el6?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-6.2:jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el5.noarch"
        },
        "product_reference": "jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEAP-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el5.src as a component of Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-6.2:jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el5.src"
        },
        "product_reference": "jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el5.src",
        "relates_to_product_reference": "5Server-JBEAP-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6.2:jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el6.noarch"
        },
        "product_reference": "jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el6.src as a component of Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6.2:jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el6.src"
        },
        "product_reference": "jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el6.src",
        "relates_to_product_reference": "6Server-JBEAP-6.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-0058",
      "discovery_date": "2014-02-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1063641"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain application or server authentication credentials.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "EAP6: Plain text password logging during security audit",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-JBEAP-6.2:jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el5.noarch",
          "5Server-JBEAP-6.2:jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el5.src",
          "6Server-JBEAP-6.2:jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el6.noarch",
          "6Server-JBEAP-6.2:jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el6.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0058"
        },
        {
          "category": "external",
          "summary": "RHBZ#1063641",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1063641"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0058",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0058"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0058",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0058"
        }
      ],
      "release_date": "2014-02-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-02-24T19:59:37+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied. Also, back up any customized Red\nHat JBoss Enterprise Application Platform 6 configuration files. On update,\nthe configuration files that have been locally modified will not be\nupdated. The updated version of such files will be stored as the rpmnew\nfiles. Make sure to locate any such files after the update and merge any\nchanges manually.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "5Server-JBEAP-6.2:jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el5.noarch",
            "5Server-JBEAP-6.2:jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el5.src",
            "6Server-JBEAP-6.2:jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el6.noarch",
            "6Server-JBEAP-6.2:jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el6.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0204"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 1.9,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "5Server-JBEAP-6.2:jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el5.noarch",
            "5Server-JBEAP-6.2:jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el5.src",
            "6Server-JBEAP-6.2:jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el6.noarch",
            "6Server-JBEAP-6.2:jboss-as-web-0:7.3.1-4.Final_redhat_4.1.ep6.el6.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "EAP6: Plain text password logging during security audit"
    }
  ]
}