Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.4 update
Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.2.4 and fix multiple security issues, several bugs, and add various enhancements are now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
describes (5)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2014-3481US | medium5.0 | — | ||
org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform (JEAP) before 6.2.4 enables entity expansion, which allows remote attackers… | ||||
| CVE-2014-0035US | medium4.3OT elevated | — | ||
The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, t… | ||||
| CVE-2014-0034US | medium4.3OT elevated | — | ||
The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to g… | ||||
| CVE-2014-0110US | medium4.3 | — | ||
Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large invalid SOAP message. | ||||
| CVE-2014-0109US | medium4.3 | — | ||
Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/htm… | ||||
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2014:0797self
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=6.2.0external
- https://access.redhat.com/security/updates/classification/#moderateexternal
- https://access.redhat.com/site/documentation/en-US/JBoss_Enterprise_Application_Platform/6.2/html-single/6.2.4_Release_Notes/index.htmlexternal
- 1093526external
- 1093527external
- 1093529external
- 1093530external
remediations (5)
- FixedRed Hat JBoss Enterprise Application Platform 6.2
The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.
https://access.redhat.com/errata/RHSA-2014:0797 - FixedRed Hat JBoss Enterprise Application Platform 6.2
The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.
https://access.redhat.com/errata/RHSA-2014:0797 - FixedRed Hat JBoss Enterprise Application Platform 6.2
The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.
https://access.redhat.com/errata/RHSA-2014:0797 - FixedRed Hat JBoss Enterprise Application Platform 6.2
The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.
https://access.redhat.com/errata/RHSA-2014:0797 - FixedRed Hat JBoss Enterprise Application Platform 6.2
The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.
https://access.redhat.com/errata/RHSA-2014:0797
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan