rhsa-2016_1432
Vulnerability from csaf_redhat
Published
2016-07-18 19:41
Modified
2024-11-22 10:00
Summary
Red Hat Security Advisory: jboss-ec2-eap security, bug fix, and enhancement update

Notes

Topic
A jboss-ec2-eap update is now available for Red Hat JBoss Enterprise Application Platform 6.4.0 on Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. The jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services (AWS) Elastic Compute Cloud (EC2). With this update, the packages have been updated to ensure compatibility with Red Hat JBoss Enterprise Application Platform 6.4.9. Security Fix(es): * It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141) More information about this vulnerability is available at: https://access.redhat.com/articles/2360521 * A directory traversal flaw was found in Tomcat's and JBoss Web's RequestUtil.java. A remote, authenticated user could use this flaw to bypass intended SecurityManager restrictions and list a parent directory via a '/..' in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory. (CVE-2015-5174) The CVE-2016-2141 issue was discovered by Dennis Reed (Red Hat).
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A jboss-ec2-eap update is now available for Red Hat JBoss Enterprise Application Platform 6.4.0 on Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7.\n\nThe jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services (AWS) Elastic Compute Cloud (EC2). With this update, the packages have been updated to ensure compatibility with Red Hat JBoss Enterprise Application Platform 6.4.9.\n\nSecurity Fix(es):\n\n* It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141)\n\nMore information about this vulnerability is available at: https://access.redhat.com/articles/2360521\n\n* A directory traversal flaw was found in Tomcat\u0027s and JBoss Web\u0027s RequestUtil.java. A remote, authenticated user could use this flaw to bypass intended SecurityManager restrictions and list a parent directory via a \u0027/..\u0027 in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory. (CVE-2015-5174)\n\nThe CVE-2016-2141 issue was discovered by Dennis Reed (Red Hat).",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:1432",
        "url": "https://access.redhat.com/errata/RHSA-2016:1432"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/6.4/index.html",
        "url": "https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/6.4/index.html"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/articles/2360521",
        "url": "https://access.redhat.com/articles/2360521"
      },
      {
        "category": "external",
        "summary": "1265698",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1265698"
      },
      {
        "category": "external",
        "summary": "1313589",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1313589"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1432.json"
      }
    ],
    "title": "Red Hat Security Advisory: jboss-ec2-eap security, bug fix, and enhancement update",
    "tracking": {
      "current_release_date": "2024-11-22T10:00:55+00:00",
      "generator": {
        "date": "2024-11-22T10:00:55+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2016:1432",
      "initial_release_date": "2016-07-18T19:41:10+00:00",
      "revision_history": [
        {
          "date": "2016-07-18T19:41:10+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2016-07-18T19:41:10+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T10:00:55+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server",
                  "product_id": "6Server-JBEAP-6.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jboss-ec2-eap-samples-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch",
                "product": {
                  "name": "jboss-ec2-eap-samples-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch",
                  "product_id": "jboss-ec2-eap-samples-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-ec2-eap-samples@7.5.9-2.Final_redhat_2.ep6.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch",
                "product": {
                  "name": "jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch",
                  "product_id": "jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-ec2-eap@7.5.9-2.Final_redhat_2.ep6.el6?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.src",
                "product": {
                  "name": "jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.src",
                  "product_id": "jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jboss-ec2-eap@7.5.9-2.Final_redhat_2.ep6.el6?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6.4:jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch"
        },
        "product_reference": "jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-6.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.src as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6.4:jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.src"
        },
        "product_reference": "jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.src",
        "relates_to_product_reference": "6Server-JBEAP-6.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jboss-ec2-eap-samples-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6.4:jboss-ec2-eap-samples-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch"
        },
        "product_reference": "jboss-ec2-eap-samples-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-6.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-5174",
      "discovery_date": "2015-08-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1265698"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A directory traversal flaw was found in Tomcat\u0027s RequestUtil.java. A remote, authenticated user could use this flaw to bypass intended SecurityManager restrictions and list a parent directory via a \u0027/..\u0027 in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: URL Normalization issue",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-JBEAP-6.4:jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch",
          "6Server-JBEAP-6.4:jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.src",
          "6Server-JBEAP-6.4:jboss-ec2-eap-samples-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-5174"
        },
        {
          "category": "external",
          "summary": "RHBZ#1265698",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1265698"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-5174",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-5174"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5174",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5174"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/bugtraq/2016/Feb/149",
          "url": "http://seclists.org/bugtraq/2016/Feb/149"
        }
      ],
      "release_date": "2016-02-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-07-18T19:41:10+00:00",
          "details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe JBoss server process must be restarted for the update to take effect.",
          "product_ids": [
            "6Server-JBEAP-6.4:jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch",
            "6Server-JBEAP-6.4:jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.src",
            "6Server-JBEAP-6.4:jboss-ec2-eap-samples-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1432"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "6Server-JBEAP-6.4:jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch",
            "6Server-JBEAP-6.4:jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.src",
            "6Server-JBEAP-6.4:jboss-ec2-eap-samples-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: URL Normalization issue"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Dennis Reed"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2016-2141",
      "discovery_date": "2015-11-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1313589"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "JGroups: Authorization bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-JBEAP-6.4:jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch",
          "6Server-JBEAP-6.4:jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.src",
          "6Server-JBEAP-6.4:jboss-ec2-eap-samples-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-2141"
        },
        {
          "category": "external",
          "summary": "RHBZ#1313589",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1313589"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-2141",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-2141"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-2141",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2141"
        }
      ],
      "release_date": "2016-06-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-07-18T19:41:10+00:00",
          "details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe JBoss server process must be restarted for the update to take effect.",
          "product_ids": [
            "6Server-JBEAP-6.4:jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch",
            "6Server-JBEAP-6.4:jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.src",
            "6Server-JBEAP-6.4:jboss-ec2-eap-samples-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1432"
        },
        {
          "category": "workaround",
          "details": "Please refer to https://access.redhat.com/articles/2360521 for more information.",
          "product_ids": [
            "6Server-JBEAP-6.4:jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch",
            "6Server-JBEAP-6.4:jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.src",
            "6Server-JBEAP-6.4:jboss-ec2-eap-samples-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-JBEAP-6.4:jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch",
            "6Server-JBEAP-6.4:jboss-ec2-eap-0:7.5.9-2.Final_redhat_2.ep6.el6.src",
            "6Server-JBEAP-6.4:jboss-ec2-eap-samples-0:7.5.9-2.Final_redhat_2.ep6.el6.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "JGroups: Authorization bypass"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.