diff --git a/requirements.txt b/requirements.txt index 515316315..e925b057c 100644 --- a/requirements.txt +++ b/requirements.txt @@ -30,3 +30,4 @@ whitenoise==5.0.1 zipp==0.6.0 pytoml==0.1.21 schema==0.7.1 +requests==2.23.0 diff --git a/vulnerabilities/data_dump.py b/vulnerabilities/data_dump.py index f462978f7..403720909 100644 --- a/vulnerabilities/data_dump.py +++ b/vulnerabilities/data_dump.py @@ -29,49 +29,38 @@ from vulnerabilities.models import VulnerabilityReference -def debian_dump(extract_data, base_release='jessie'): +def debian_dump(extract_data, base_release="jessie"): """ Save data scraped from Debian' security tracker. """ for data in extract_data: - vulnerability, _ = Vulnerability.objects.get_or_create( - cve_id=data['cve_id'], - ) + vulnerability, _ = Vulnerability.objects.get_or_create(cve_id=data["cve_id"],) - pkg_name = data['package_name'] + pkg_name = data["package_name"] package = Package.objects.create( name=pkg_name, - type='deb', - namespace='debian', - version=data.get('version', ''), - qualifiers=f'distro={base_release}', + type="deb", + namespace="debian", + version=data.get("version", ""), + qualifiers=f"distro={base_release}", ) - if data['status'] == 'open': - ImpactedPackage.objects.create( - vulnerability=vulnerability, - package=package - ) + if data["status"] == "open": + ImpactedPackage.objects.create(vulnerability=vulnerability, package=package) else: - ResolvedPackage.objects.create( - vulnerability=vulnerability, - package=package - ) + ResolvedPackage.objects.create(vulnerability=vulnerability, package=package) - fixed_version = data.get('fixed_version') + fixed_version = data.get("fixed_version") if fixed_version: package = Package.objects.create( name=pkg_name, - type='deb', - namespace='debian', + type="deb", + namespace="debian", version=fixed_version, - qualifiers=f'distro={base_release}', + qualifiers=f"distro={base_release}", ) - ResolvedPackage.objects.create( - vulnerability=vulnerability, - package=package - ) + ResolvedPackage.objects.create(vulnerability=vulnerability, package=package) def ubuntu_dump(html): @@ -79,247 +68,170 @@ def ubuntu_dump(html): Dump data scraped from Ubuntu's security tracker. """ for data in html: - vulnerability, _ = Vulnerability.objects.get_or_create( - cve_id=data['cve_id'], - ) - package = Package.objects.create( - name=data['package_name'], - type='deb', - namespace='ubuntu' - ) - ImpactedPackage.objects.create( - vulnerability=vulnerability, - package=package - ) + vulnerability, _ = Vulnerability.objects.get_or_create(cve_id=data["cve_id"],) + package = Package.objects.create(name=data["package_name"], type="deb", namespace="ubuntu") + ImpactedPackage.objects.create(vulnerability=vulnerability, package=package) def archlinux_dump(extract_data): """ Save data scraped from archlinux' security tracker. """ - base_url = 'https://security.archlinux.org' + base_url = "https://security.archlinux.org" for avg in extract_data: affected_packages = [] fixed_packages = [] - for package_name in avg['packages']: + for package_name in avg["packages"]: ap, _ = Package.objects.get_or_create( - name=package_name, - type='pacman', - namespace='archlinux', - version=avg['affected'], + name=package_name, type="pacman", namespace="archlinux", version=avg["affected"], ) affected_packages.append(ap) fp, _ = Package.objects.get_or_create( - name=package_name, - type='pacman', - namespace='archlinux', - version=avg['fixed'], + name=package_name, type="pacman", namespace="archlinux", version=avg["fixed"], ) fixed_packages.append(fp) - for cve_id in avg['issues']: - vulnerability, _ = Vulnerability.objects.get_or_create( - cve_id=cve_id, - ) + for cve_id in avg["issues"]: + vulnerability, _ = Vulnerability.objects.get_or_create(cve_id=cve_id,) VulnerabilityReference.objects.create( - vulnerability=vulnerability, - url=f'{base_url}/{cve_id}', + vulnerability=vulnerability, url=f"{base_url}/{cve_id}", ) - avg_name = avg['name'] + avg_name = avg["name"] VulnerabilityReference.objects.create( - vulnerability=vulnerability, - reference_id=avg_name, - url=f'{base_url}/{avg_name}', + vulnerability=vulnerability, reference_id=avg_name, url=f"{base_url}/{avg_name}", ) - for asa in avg['advisories']: + for asa in avg["advisories"]: VulnerabilityReference.objects.create( - vulnerability=vulnerability, - reference_id=asa, - url=f'{base_url}/{asa}', + vulnerability=vulnerability, reference_id=asa, url=f"{base_url}/{asa}", ) for ap in affected_packages: ImpactedPackage.objects.get_or_create( - vulnerability=vulnerability, - package=ap, + vulnerability=vulnerability, package=ap, ) for fp in fixed_packages: ResolvedPackage.objects.get_or_create( - vulnerability=vulnerability, - package=fp, + vulnerability=vulnerability, package=fp, ) def npm_dump(extract_data): for data in extract_data: - package_name = data['package_name'] - advisory = data['advisory'] + package_name = data["package_name"] + advisory = data["advisory"] - for cve_id in data['cve_ids']: - vulnerability, _ = Vulnerability.objects.get_or_create( - cve_id=cve_id, - ) + for cve_id in data["cve_ids"]: + vulnerability, _ = Vulnerability.objects.get_or_create(cve_id=cve_id,) if advisory: VulnerabilityReference.objects.create( - vulnerability=vulnerability, - url=advisory, + vulnerability=vulnerability, url=advisory, ) - for version in data['affected_versions']: + for version in data["affected_versions"]: package_affected = Package.objects.create( - name=package_name, - type='npm', - version=version, + name=package_name, type="npm", version=version, ) ImpactedPackage.objects.create( - vulnerability=vulnerability, - package=package_affected + vulnerability=vulnerability, package=package_affected ) - for version in data['fixed_versions']: + for version in data["fixed_versions"]: package_fixed = Package.objects.create( - name=package_name, - type='npm', - version=version - ) - ResolvedPackage.objects.create( - vulnerability=vulnerability, - package=package_fixed + name=package_name, type="npm", version=version ) + ResolvedPackage.objects.create(vulnerability=vulnerability, package=package_fixed) def ruby_dump(extract_data): for package_data in extract_data: - vulnerability, _ = Vulnerability.objects.get_or_create( - cve_id=package_data['cve_id'] - ) + vulnerability, _ = Vulnerability.objects.get_or_create(cve_id=package_data["cve_id"]) VulnerabilityReference.objects.get_or_create( - vulnerability=vulnerability, - url=package_data['advisory'] + vulnerability=vulnerability, url=package_data["advisory"] ) - for version in package_data['affected_versions']: + for version in package_data["affected_versions"]: affected_package = Package.objects.create( - name=package_data['package_name'], - type='gem', - version=version - ) - ImpactedPackage.objects.create( - vulnerability=vulnerability, - package=affected_package + name=package_data["package_name"], type="gem", version=version ) + ImpactedPackage.objects.create(vulnerability=vulnerability, package=affected_package) - for version in package_data['fixed_versions']: + for version in package_data["fixed_versions"]: unaffected_package = Package.objects.create( - name=package_data['package_name'], - type='gem', - version=version - ) - ResolvedPackage.objects.create( - vulnerability=vulnerability, - package=unaffected_package + name=package_data["package_name"], type="gem", version=version ) + ResolvedPackage.objects.create(vulnerability=vulnerability, package=unaffected_package) def rust_dump(extract_data): for package_data in extract_data: - vulnerability, _ = Vulnerability.objects.get_or_create( - summary=package_data['description'] - ) + vulnerability, _ = Vulnerability.objects.get_or_create(summary=package_data["description"]) VulnerabilityReference.objects.get_or_create( vulnerability=vulnerability, - url=package_data['advisory'], - reference_id=package_data['vuln_id'] + url=package_data["advisory"], + reference_id=package_data["vuln_id"], ) - for version in package_data['affected_versions']: + for version in package_data["affected_versions"]: affected_package = Package.objects.create( - name=package_data['package_name'], - type='cargo', - version=version - ) - ImpactedPackage.objects.create( - vulnerability=vulnerability, - package=affected_package + name=package_data["package_name"], type="cargo", version=version ) + ImpactedPackage.objects.create(vulnerability=vulnerability, package=affected_package) - for version in package_data['fixed_versions']: + for version in package_data["fixed_versions"]: unaffected_package = Package.objects.create( - name=package_data['package_name'], - type='cargo', - version=version - ) - ResolvedPackage.objects.create( - vulnerability=vulnerability, - package=unaffected_package + name=package_data["package_name"], type="cargo", version=version ) + ResolvedPackage.objects.create(vulnerability=vulnerability, package=unaffected_package) def safetydb_dump(extract_data): for package_data in extract_data: - for cve_id in package_data['cve_id']: + for cve_id in package_data["cve_id"]: vulnerability, _ = Vulnerability.objects.get_or_create( - summary=package_data['description'], - cve_id=cve_id + summary=package_data["description"], cve_id=cve_id ) VulnerabilityReference.objects.get_or_create( - vulnerability=vulnerability, - reference_id=package_data['vuln_id'] + vulnerability=vulnerability, reference_id=package_data["vuln_id"] ) - for version in package_data['affected_versions']: + for version in package_data["affected_versions"]: affected_package = Package.objects.create( - name=package_data['package_name'], - type='pypi', - version=version - ) - ImpactedPackage.objects.create( - vulnerability=vulnerability, - package=affected_package + name=package_data["package_name"], type="pypi", version=version ) + ImpactedPackage.objects.create(vulnerability=vulnerability, package=affected_package) - for version in package_data['unaffected_versions']: + for version in package_data["unaffected_versions"]: unaffected_package = Package.objects.create( - name=package_data['package_name'], - type='pypi', - version=version - ) - ResolvedPackage.objects.create( - vulnerability=vulnerability, - package=unaffected_package + name=package_data["package_name"], type="pypi", version=version ) + ResolvedPackage.objects.create(vulnerability=vulnerability, package=unaffected_package) def alpine_linux_dump(data_dicts): for package_data in data_dicts: unaffected_package = Package.objects.create( - name=package_data['package_name'], - type='alpine', - version=package_data['fixed_version'] + name=package_data["package_name"], type="alpine", version=package_data["fixed_version"] ) - for vuln_groups in package_data['vuln_ids']: - if vuln_groups[0].startswith('CVE'): - vulnerability_obj, _ = Vulnerability.objects.get_or_create( - cve_id=vuln_groups[0] - ) + for vuln_groups in package_data["vuln_ids"]: + if vuln_groups[0].startswith("CVE"): + vulnerability_obj, _ = Vulnerability.objects.get_or_create(cve_id=vuln_groups[0]) if len(vuln_groups) == 2: # TODO: Deal with vulnerabilities without cves VulnerabilityReference.objects.get_or_create( - vulnerability=vulnerability_obj, - reference_id=vuln_groups[1] + vulnerability=vulnerability_obj, reference_id=vuln_groups[1] ) else: @@ -327,6 +239,28 @@ def alpine_linux_dump(data_dicts): continue ResolvedPackage.objects.create( - vulnerability=vulnerability_obj, - package=unaffected_package + vulnerability=vulnerability_obj, package=unaffected_package ) + + +def opensuse_dump(extract_data): + + for package_data in extract_data: + vulnerability, _ = Vulnerability.objects.get_or_create(cve_id=package_data["vuln_id"]) + for url in package_data["urls"]: + for suse_id in package_data["ref_ids"]: + # TODO: Enable VulnerabilityReference to store multiple reference_id and + # urls and remove these loops. + VulnerabilityReference.objects.get_or_create( + vulnerability=vulnerability, url=package_data["urls"], reference_id=suse_id + ) + # FIXME: Deal with duplicate package entries + affected_package = Package.objects.create( + name=package_data["package_name"], + type="rpm", + version=package_data["version"], + namespace="opensuse", + ) + # TODO: Add qualifiers of platform and distro once we start using + # JSONField to store qualifiers. + ImpactedPackage.objects.create(vulnerability=vulnerability, package=affected_package) diff --git a/vulnerabilities/management/commands/import.py b/vulnerabilities/management/commands/import.py index 9fabf8339..ffd0d1bf8 100644 --- a/vulnerabilities/management/commands/import.py +++ b/vulnerabilities/management/commands/import.py @@ -25,9 +25,10 @@ from vulnerabilities import data_dump as dd from vulnerabilities.scraper import ( - debian, ubuntu, archlinux, npm, ruby, rust, safety_db, alpine_linux) + debian, ubuntu, archlinux, npm, ruby, rust, safety_db, alpine_linux, opensuse) IMPORTERS = { + 'opensuse': lambda: dd.opensuse_dump(opensuse.import_vulnerabilities()), 'alpinelinux': lambda: dd.alpine_linux_dump(alpine_linux.import_vulnerabilities()), 'safetydb': lambda: dd.safetydb_dump(safety_db.import_vulnerabilities()), 'rust': lambda: dd.rust_dump(rust.import_vulnerabilities()), diff --git a/vulnerabilities/scraper/cvrf_parser/cvrf_parser.py b/vulnerabilities/scraper/cvrf_parser/cvrf_parser.py new file mode 100755 index 000000000..eae6b4b5a --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/cvrf_parser.py @@ -0,0 +1,372 @@ +from argparse import Namespace +from lxml import etree + + +class CVRF_Syntax(object): + # CVRF Elements and Namespaces. + + cvrf_versions = ["1.1", "1.2"] + + VULN_ARGS = [ + "all", + "Title", + "ID", + "Notes", + "DiscoveryDate", + "ReleaseDate", + "Involvements", + "CVE", + "CWE", + "ProductID", + "ProductStatuses", + "Threats", + "CVSSScoreSets", + "Remediations", + "References", + "Acknowledgments", + "Vulnerability", + ] + + def __init__(self, cvrf_version): + # defaults to current cvrf version 1.2 specification unless otherwise + # specified + self.CVRF_SCHEMA = "http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/cs01/schemas/cvrf.xsd" + self.NAMESPACES = { + x.upper(): "{http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/%s}" % x + for x in ("cvrf", "vuln", "prod") + } + self.CVRF_CATALOG = "schemata/catalog_1_2.xml" + self.CVRF_SCHEMA_FILE = "schemata/cvrf/1.2/cvrf.xsd" + + if cvrf_version == "1.1": + self.CVRF_SCHEMA = "http://www.icasi.org/CVRF/schema/cvrf/1.1/cvrf.xsd" + self.NAMESPACES = { + x.upper(): "{http://www.icasi.org/CVRF/schema/%s/1.1}" % x + for x in ("cvrf", "vuln", "prod") + } + self.CVRF_CATALOG = "schemata/catalog_1_1.xml" + self.CVRF_SCHEMA_FILE = "schemata/cvrf/1.1/cvrf.xsd" + + +def get_partial_key_in_dict(key, dict): + for k, v in dict.items(): + if k.startswith(key): + return k + return None + + +def chop_ns_prefix(element): + """ + Return the element of a fully qualified namespace URI + + element: a fully qualified ET element tag + """ + return element[element.rindex("}") + 1:] + + +def get_vulnerability_node(node): + while node is not None: + if chop_ns_prefix(node.tag) == "Vulnerability": + return node + node = node.getparent() + return node + + +def is_productid_node(node): + if node is not None: + tag = chop_ns_prefix(node.tag) + if tag == "ProductID": + return True + return False + + +def has_child_product_nodes(node): + # get the nodes children and check to see if it contains ProductID nodes + children = node.getchildren() + for child in children: + tag = chop_ns_prefix(child.tag) + if tag == "ProductID": + return True + return False + + +def has_child_product_node(node, current_node): + # get the nodes children and check to see if it contains the node matching + # specific ProductID + children = node.getchildren() + for child in children: + tag = chop_ns_prefix(child.tag) + if tag == "ProductID": + if child.text.strip() == current_node.text.strip(): + return True + return False + + +def is_vuln_ns(node, cvrf_version): + tag = chop_ns_prefix(node.tag) + ns = node.tag.replace(tag, "") + + if CVRF_Syntax(cvrf_version).NAMESPACES["VULN"] == ns: + return True + else: + return False + + +def get_product_name_node(cvrf_doc, cvrf_version, product_id): + # Constrain Xpath search to the ProductTree container + for node in cvrf_doc.findall( + ".//" + CVRF_Syntax(cvrf_version).NAMESPACES["PROD"] + "ProductTree" + ): + for child in node.iter(): + if child.attrib and "ProductID" in child.attrib: + if child.attrib["ProductID"] == product_id: + return child + return None + + +def get_related_producttree_values(node, values, current_product_node, cvrf_doc): + if node is not None: + + # climb the xpath node tree to the top capturing all the node values + while node.getparent() is not None: + + # add values for current node + if node.tag and node.text and node.attrib: + tag = chop_ns_prefix(node.tag) + + text = [] + for key in node.attrib: + text.append(key + ":" + node.attrib[key]) + + if node.text: + if len(node.text.strip()) > 0: + text.append(node.text.strip()) + + text = "|".join(text) + if text: + if tag in values: + if isinstance(values[tag], list): + values[tag].append(text) + else: + values[tag] = [values[tag], text] + else: + values[tag] = text + + # climb the tree + node = node.getparent() + + return values + + +def get_related_vulnerability_values(node, values, current_product_node, cvrf_doc): + if node is not None: + children = node.getchildren() + child_index = 0 + + for child in children: + child_index += 1 + + # skip productid nodes + if is_productid_node(child): + continue + + # process the child if no children or has children specific + # properties for product + process_child = False + if len(child.getchildren()) == 0: # element has no children, applies to all elements + process_child = True + + if has_child_product_nodes(child): + if has_child_product_node(child, current_product_node): + process_child = True # has children and applies to desired product id + else: + process_child = ( + True # has children but not for specific product, applies to all elements + ) + + if not process_child: + continue + + if child.tag and child.attrib: + tag = chop_ns_prefix(child.tag) + "_" + \ + chop_ns_prefix(child.getparent().tag) + + text = [] + for key in child.attrib: + text.append(key + ":" + child.attrib[key]) + + if child.text: + if len(child.text.strip()) > 0: + text.append(child.text.strip()) + + text = "|".join(text) + if text: + if tag in values: + if isinstance(values[tag], list): + values[tag].append(text) + else: + values[tag] = [values[tag], text] + else: + values[tag] = text + + if child.tag and child.text and not child.attrib: + tag = chop_ns_prefix(child.tag) + "_" + \ + chop_ns_prefix(child.getparent().tag) + child_tag = chop_ns_prefix(child.tag) + parent_tag = chop_ns_prefix(child.getparent().tag) + text = child.text.strip() + + if text: + # put all elements with same parent tag together + parent_key = get_partial_key_in_dict(parent_tag, values) + if parent_key is not None: + if not isinstance(values[parent_key], list): + values[parent_key] += "|" + child_tag + ":" + text + else: + values[parent_key][-1] += "|" + \ + child_tag + ":" + text + else: + # convert to list when multiple elements exist for same + # tag + if tag in values: + if isinstance(values[tag], list): + values[tag].append(text) + else: + values[tag] = [values[tag], text] + else: + values[tag] = text + + # recursively get the values for the child + values = get_related_vulnerability_values( + child, values, current_product_node, cvrf_doc) + + # include the current product id + if current_product_node.tag and current_product_node.text: + tag = chop_ns_prefix(current_product_node.tag) + text = current_product_node.text.strip() + values[tag] = text + + return values + + +def get_vulnerability_ordinal(node): + ordinal = 0 + while node is not None: + if chop_ns_prefix(node.tag) == "Vulnerability": + ordinal = node.attrib["Ordinal"] + node = node.getparent() + return ordinal + + +def post_process_arglist(arg, namespace, valid_args, cvrf_version): + parsables = [] + + if CVRF_Syntax(cvrf_version).NAMESPACES[namespace] + "all" in arg: + for element in valid_args: + parsables.append(CVRF_Syntax( + cvrf_version).NAMESPACES[namespace] + element) + parsables.remove(CVRF_Syntax( + cvrf_version).NAMESPACES[namespace] + "all") + else: + for element in arg: + parsables.append(element) + + return parsables + + +def cvrf_parse(cvrf_doc, parsables, args, cvrf_version): + """ + Parse a cvrf_doc and return a list of elements as determined by parsables + + cvrf_doc: the serialized CVRF ElementTree object + parsables: list of elements to parse from a CVRF doc + returns: a dictionary of the format {filename:[item, ...]} + """ + items = [] + ordinal_products = {} + + for element in parsables: + for node in cvrf_doc.iter(element): + for child in node.iter(): + + # process vuln productid elements uniquely by productid? + if is_vuln_ns(child, cvrf_version): + if is_productid_node(child) and args.unique_products: + ordinal = get_vulnerability_ordinal(child) + if ordinal not in ordinal_products: + ordinal_products[ordinal] = [] + + product_id = child.text.strip() if child.text else "" + if product_id not in ordinal_products[ordinal]: + ordinal_products[ordinal].append(product_id) + items.append(child) + else: + # capture all non-productid elements + items.append(child) + else: + # capture all non-vuln ns elements + items.append(child) + + # Hardcoded output for now, eventually make this user-tunable + return items # "stdout" + + +def get_data_from_node(cvrf_doc, cvrf_version, node): + """ + Print each XML node + + node: the ElementTree node to be printed + strip_ns: boolean that when true indicates the namespace prefix will be chomped + f: the file to print to (default is stdout) + """ + + related_values = {} + + # should we collect related product elements data? (for vuln prod + # elements only) + if is_vuln_ns(node, cvrf_version) and is_productid_node(node): + vuln_root_node = get_vulnerability_node(node) + related_values = get_related_vulnerability_values( + vuln_root_node, related_values, node, cvrf_doc + ) + product_node = get_product_name_node( + cvrf_doc, cvrf_version, node.text.strip()) + related_values = get_related_producttree_values( + product_node, related_values, node, cvrf_doc + ) + return related_values + + +def get_data_dict_from_url(url, cvrf_version="1.1"): + + file_name = url.split("/")[-1] + if cvrf_version == "1.1": + vuln = ["{http://www.icasi.org/CVRF/schema/vuln/1.1}all"] + + elif cvrf_version == "1.2": + vuln = ["{http://www.icasi.org/CVRF/schema/vuln/1.2}all"] + + schema = "schemata/cvrf/{}/cvrf.xsd".format(cvrf_version) + args = Namespace( + cvrf_version=cvrf_version, + file=file_name, + include_related_product_elements=True, + related_product_tags=["all"], + schema=schema, + unique_products=True, + vuln=vuln, + ) + try: + doc = etree.parse(url, etree.XMLParser(encoding="utf-8")) + parsables = list( + post_process_arglist( + args.vuln, "VULN", CVRF_Syntax( + cvrf_version).VULN_ARGS, cvrf_version + ) + ) + results = cvrf_parse(doc, parsables, args, cvrf_version) + for result in results: + if get_data_from_node(doc, cvrf_version, result): + yield get_data_from_node(doc, cvrf_version, result) + except BaseException: + pass diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/catalog_1_1.xml b/vulnerabilities/scraper/cvrf_parser/schemata/catalog_1_1.xml new file mode 100755 index 000000000..a2b81bee6 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/catalog_1_1.xml @@ -0,0 +1,15 @@ + + + + + + + + + + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/catalog_1_2.xml b/vulnerabilities/scraper/cvrf_parser/schemata/catalog_1_2.xml new file mode 100755 index 000000000..9830047eb --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/catalog_1_2.xml @@ -0,0 +1,16 @@ + + + + + + + + + + + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/common.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/common.xsd new file mode 100755 index 000000000..df7457546 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/common.xsd @@ -0,0 +1,176 @@ + + + + + + + + + + + + This is the XML schema for the Common Vulerability Reporting Framework's common data types. + + Brian Schafer <bschafer@microsoft.com> + Joe Clarke <jclarke@cisco.com> + Joe Hemmerlein <Joe.Hemmerlein@microsoft.com> + 2012-05-07 + CVRF Common Data Types + 1.1 + + + + + + + + A normalized string type that cannot be empty. + + + + + + + + A string type that cannot be empty. + + + + + + + + String type with an optional language attribute. The default language is English. + + + + + + Locale code used for the string value. The default is "en". + + + + + + + + Normalized string type with an optional language attribute. The default language is English. This string cannot be empty. + + + + + + Locale code used for the string value. The default is "en". + + + + + + + + Dotted string representing the document revision + + + + + + + + Types enumerating the type of reference document + + + + + This document is an external reference to the current vulnerability. + + + + + This document is a reference to this same vulnerability. + + + + + + + Types enumerating the various publishers of a document. + + + + + Developers or maintainers of information system products or services. + + + + + Individuals or organizations that find vulnerabilities or security weaknesses. + + + + + Individuals or organizations that manage a single vendor's response or multiple vendors' responses to a vulnerability, a security flaw, or an incident. + + + + + Everyone using a vendor's product. + + + + + Catchall for everyone else. Currently this includes forwarders, re-publishers, language translators and miscellaneous contributors. + + + + + + + Allowed type values for CVRF notes. + + + + + A general, high-level note (Title may have more information). + + + + + A low-level detailed discussion (Title may have more information). + + + + + A description of something (Title may have more information). + + + + + A summary of something (Title may have more information). + + + + + A list of frequently asked questions. + + + + + Any possible legal discussion, including constraints, surrounding the document. + + + + + Something that doesn’t fit (Title should have more information). + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/common/1.2/common.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/common/1.2/common.xsd new file mode 100755 index 000000000..a6342cdd7 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/common/1.2/common.xsd @@ -0,0 +1,206 @@ + + + + + + + + + + + + + This is the XML schema for data types shared by the domain + specific schemas of the OASIS Common Security Advisory Framework (CSAF) TC's + CVRF (Common Vulnerability Reporting Framework). + + Feng Cao (feng.cao@oracle.com) + Stefan Hagen (stefan@hagen.link) + 2017-05-24 + CSAF CVRF Common Data Types + 1.2 + + + + + + + + A normalized string type that cannot be + empty. + + + + + + + + A string type that cannot be empty. + + + + + + + + String type with an optional language attribute. The default + language is English. + + + + + + Locale code used for the string value. The default is + "en". + + + + + + + + Normalized string type with an optional language attribute. + The default language is English. This string cannot be empty. + + + + + + Locale code used for the string value. The default is + "en". + + + + + + + + Dotted string representing the document + revision + + + + + + + + Types enumerating the type of reference + document + + + + + This document is an external reference to the current + vulnerability. + + + + + This document is a reference to this same + vulnerability. + + + + + + + Types enumerating the various publishers of a + document. + + + + + Developers or maintainers of information system products + or services. + + + + + Individuals or organizations that find vulnerabilities or + security weaknesses. + + + + + Individuals or organizations that manage a single vendor's + response or multiple vendors' responses to a vulnerability, a security flaw, or an + incident. + + + + + Everyone using a vendor's product. + + + + + Catchall for everyone else. Currently this includes + forwarders, re-publishers, language translators and miscellaneous + contributors. + + + + + + + Allowed type values for CSAF CVRF notes. + + + + + A general, high-level note (Title may have more + information). + + + + + A low-level detailed discussion (Title may have more + information). + + + + + A description of something (Title may have more + information). + + + + + A summary of something (Title may have more + information). + + + + + A list of frequently asked questions. + + + + + Any possible legal discussion, including constraints, + surrounding the document. + + + + + Something that doesnt fit (Title should have more + information). + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/cvrf-rhsa-2012-1591.xml b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/cvrf-rhsa-2012-1591.xml new file mode 100755 index 000000000..3be7aaafc --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/cvrf-rhsa-2012-1591.xml @@ -0,0 +1,3963 @@ + + + Red Hat Security Advisory: JBoss Enterprise Application Platform 6.0.1 update + Security Advisory + + secalert@redhat.com + Red Hat Security Response Team + + + RHSA-2012:1591 + Final + 1 + + + 1 + 2012-12-18T21:29:00Z + Current version + + + 2012-12-18T21:30:00Z + 2012-12-18T21:29:00Z + + Red Hat rhsa-to-cvrf 1.0.1484 + 2012-12-18T22:22:02Z + + + + +Updated JBoss Enterprise Application Platform 6.0.1 packages that fix +multiple security issues, various bugs, and add enhancements are now +available for Red Hat Enterprise Linux 5. + +The Red Hat Security Response Team has rated this update as having +important security impact. Common Vulnerability Scoring System (CVSS) base +scores, which give detailed severity ratings, are available for each +vulnerability from the CVE links in the References section. + +JBoss Enterprise Application Platform 6 is a platform for Java applications +based on JBoss Application Server 7. + +This release serves as a replacement for JBoss Enterprise Application +Platform 6.0.0, and includes bug fixes and enhancements. Refer to the 6.0.1 +Release Notes for information on the most significant of these changes, +available shortly from https://access.redhat.com/knowledge/docs/ + +This update removes unused signed JARs; unused SHA1 checksums from JAR +MANIFEST.MF files to reduce the Server memory footprint; adds MANIFEST.MF +to JAR files where it was previously missing; and removes redundant Javadoc +files from the main packages. (BZ#853551) + +Security fixes: + +Apache CXF checked to ensure XML elements were signed or encrypted by a +Supporting Token, but not whether the correct token was used. A remote +attacker could transmit confidential information without the appropriate +security, and potentially circumvent access controls on web services +exposed via Apache CXF. (CVE-2012-2379) + +When using role-based authorization to configure EJB access, JACC +permissions should be used to determine access; however, due to a flaw the +configured authorization modules (JACC, XACML, etc.) were not called, and +the JACC permissions were not used to determine access to an EJB. +(CVE-2012-4550) + +A flaw in the way Apache CXF enforced child policies of WS-SecurityPolicy +1.1 on the client side could, in certain cases, lead to a client failing to +sign or encrypt certain elements as directed by the security policy, +leading to information disclosure and insecure information transmission. +(CVE-2012-2378) + +A flaw was found in the way IronJacamar authenticated credentials and +returned a valid datasource connection when configured to +"allow-multiple-users". A remote attacker, provided the correct subject, +could obtain a datasource connection that might belong to a privileged +user. (CVE-2012-3428) + +It was found that Apache CXF was vulnerable to SOAPAction spoofing attacks +under certain conditions. Note that WS-Policy validation is performed +against the operation being invoked, and an attack must pass validation to +be successful. (CVE-2012-3451) + +When there are no allowed roles for an EJB method invocation, the +invocation should be denied for all users. It was found that the +processInvocation() method in +org.jboss.as.ejb3.security.AuthorizationInterceptor incorrectly authorizes +all method invocations to proceed when the list of allowed roles is empty. +(CVE-2012-4549) + +It was found that in Mojarra, the FacesContext that is made available +during application startup is held in a ThreadLocal. The reference is not +properly cleaned up in all cases. As a result, if a JavaServer Faces (JSF) +WAR calls FacesContext.getCurrentInstance() during application startup, +another WAR can get access to the leftover context and thus get access to +the other WAR's resources. A local attacker could use this flaw to access +another WAR's resources using a crafted, deployed application. +(CVE-2012-2672) + +An input sanitization flaw was found in the mod_negotiation Apache HTTP +Server module. A remote attacker able to upload or create files with +arbitrary names in a directory that has the MultiViews options enabled, +could use this flaw to conduct cross-site scripting attacks against users +visiting the site. (CVE-2008-0455, CVE-2012-2687) + +Red Hat would like to thank the Apache CXF project for reporting +CVE-2012-2379, CVE-2012-2378, and CVE-2012-3451. The CVE-2012-4550 issue +was discovered by Josef Cacek of the Red Hat JBoss EAP Quality Engineering +team; CVE-2012-3428 and CVE-2012-4549 were discovered by Arun Neelicattu of +the Red Hat Security Response Team; and CVE-2012-2672 was discovered by +Marek Schmidt and Stan Silvert of Red Hat. + +Warning: Before applying this update, back up your existing JBoss +Enterprise Application Platform installation and deployed applications. +Refer to the Solution section for further details. + Please see https://www.redhat.com/footer/terms-of-use.html + + Copyright © 2012 Red Hat, Inc. All rights reserved. + Important + + + https://rhn.redhat.com/errata/RHSA-2012-1591.html + https://rhn.redhat.com/errata/RHSA-2012-1591.html + + + https://access.redhat.com/security/updates/classification/#important + https://access.redhat.com/security/updates/classification/#important + + + https://access.redhat.com/knowledge/docs/ + https://access.redhat.com/knowledge/docs/ + + + + + + JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + + antlr-eap6-2.7.7-15_redhat_2.ep6.el5.src.rpm + + + apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5.src.rpm + + + apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4.src.rpm + + + apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1.src.rpm + + + apache-commons-collections-3.2.1-10.redhat_2.ep6.el5.src.rpm + + + apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1.src.rpm + + + apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5.src.rpm + + + apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5.src.rpm + + + apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1.src.rpm + + + apache-commons-lang-2.6-3.redhat_2.ep6.el5.src.rpm + + + apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1.src.rpm + + + apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1.src.rpm + + + apache-cxf-2.4.9-4.redhat_2.ep6.el5.src.rpm + + + apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4.src.rpm + + + apache-mime4j-0.6-7.redhat_2.ep6.el5.5.src.rpm + + + atinject-1-8.2_redhat_2.ep6.el5.5.src.rpm + + + cal10n-0.7.3-8.redhat_2.ep6.el5.5.src.rpm + + + codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5.src.rpm + + + dom4j-1.6.1-14_redhat_3.ep6.el5.src.rpm + + + glassfish-jaf-1.1.1-16.redhat_2.ep6.el5.src.rpm + + + glassfish-javamail-1.4.4-16.redhat_2.ep6.el5.src.rpm + + + glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5.src.rpm + + + glassfish-jsf-2.1.13-1_redhat_1.ep6.el5.src.rpm + + + glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5.src.rpm + + + gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5.src.rpm + + + guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6.src.rpm + + + h2database-1.3.168-2_redhat_1.ep6.el5.src.rpm + + + hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3.src.rpm + + + hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4.src.rpm + + + hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3.src.rpm + + + hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5.src.rpm + + + hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4.src.rpm + + + hornetq-2.2.23-1.Final_redhat_1.ep6.el5.src.rpm + + + hornetq-native-2.2.21-1.1.Final.ep6.el5.src.rpm + + + httpcomponents-5-4_redhat_2.ep6.el5.src.rpm + + + httpd-2.2.22-14.ep6.el5.src.rpm + + + httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3.src.rpm + + + infinispan-5.1.8-1.Final_redhat_1.ep6.el5.src.rpm + + + ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5.src.rpm + + + jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3.src.rpm + + + jandex-1.0.3-7.Final_redhat_2.ep6.el5.2.src.rpm + + + javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3.src.rpm + + + jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3.src.rpm + + + jaxen-1.1.3-8.redhat_2.ep6.el5.4.src.rpm + + + jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3.src.rpm + + + jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3.src.rpm + + + jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5.src.rpm + + + jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3.src.rpm + + + jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2.src.rpm + + + jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3.src.rpm + + + jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5.src.rpm + + + jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2.src.rpm + + + jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5.src.rpm + + + jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5.src.rpm + + + jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5.src.rpm + + + jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5.src.rpm + + + jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5.src.rpm + + + jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5.src.rpm + + + jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5.src.rpm + + + jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5.src.rpm + + + jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5.src.rpm + + + jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5.src.rpm + + + jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5.src.rpm + + + jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5.src.rpm + + + jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5.src.rpm + + + jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4.src.rpm + + + jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5.src.rpm + + + jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5.src.rpm + + + jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5.src.rpm + + + jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5.src.rpm + + + jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1.src.rpm + + + jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5.src.rpm + + + jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5.src.rpm + + + jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5.src.rpm + + + jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5.src.rpm + + + jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5.src.rpm + + + jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5.src.rpm + + + jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5.src.rpm + + + jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5.src.rpm + + + jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5.src.rpm + + + jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5.src.rpm + + + jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5.src.rpm + + + jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5.src.rpm + + + jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1.src.rpm + + + jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5.src.rpm + + + jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2.src.rpm + + + jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1.src.rpm + + + jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5.src.rpm + + + jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7.src.rpm + + + jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5.src.rpm + + + jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5.src.rpm + + + jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5.src.rpm + + + jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5.src.rpm + + + jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5.src.rpm + + + jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5.src.rpm + + + jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5.src.rpm + + + jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5.src.rpm + + + jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5.src.rpm + + + jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5.src.rpm + + + jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5.src.rpm + + + jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5.src.rpm + + + jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5.src.rpm + + + jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5.src.rpm + + + jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1.src.rpm + + + jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5.src.rpm + + + jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5.src.rpm + + + jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jbossts-4.16.6-1.Final_redhat_1.ep6.el5.src.rpm + + + jbossweb-7.0.17-1.Final_redhat_1.ep6.el5.src.rpm + + + jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3.src.rpm + + + jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5.src.rpm + + + jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5.src.rpm + + + jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5.src.rpm + + + jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5.src.rpm + + + jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5.src.rpm + + + jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3.src.rpm + + + jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5.src.rpm + + + jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5.src.rpm + + + jettison-1.3.1-7_redhat_2.ep6.el5.src.rpm + + + jgroups-3.0.14-2.Final_redhat_1.ep6.el5.src.rpm + + + jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4.src.rpm + + + joda-time-1.6.2-5.redhat_3.ep6.el5.4.src.rpm + + + jtype-0.1.1-9_redhat_2.3.ep6.el5.4.src.rpm + + + juddi-3.1.3-3_redhat_2.1.ep6.el5.3.src.rpm + + + jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2.src.rpm + + + jython-eap6-2.5.2-5.redhat_2.ep6.el5.4.src.rpm + + + log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4.src.rpm + + + log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5.src.rpm + + + mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5.src.rpm + + + mod_cluster-native-1.2.3-3.Final.ep6.el5.src.rpm + + + mod_jk-1.2.36-5.1.ep6.el5.src.rpm + + + netty-3.2.6-2_redhat_2.2.ep6.el5.4.src.rpm + + + objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3.src.rpm + + + org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5.src.rpm + + + org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5.src.rpm + + + org.osgi-4.2.0-4.redhat_2.ep6.el5.3.src.rpm + + + picketbox-4.0.14-2.Final_redhat_2.ep6.el5.src.rpm + + + picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3.src.rpm + + + picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5.src.rpm + + + relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4.src.rpm + + + resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3.src.rpm + + + rngom-201103-0.5.redhat_2.ep6.el5.4.src.rpm + + + scannotation-1.0.2-8.redhat_2.ep6.el5.2.src.rpm + + + shrinkwrap-1.0.0-16.redhat_2.ep6.el5.src.rpm + + + slf4j-eap6-1.6.1-23.redhat_2.ep6.el5.src.rpm + + + slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2.src.rpm + + + snakeyaml-1.8-8.redhat_2.ep6.el5.2.src.rpm + + + staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2.src.rpm + + + stilts-0.1.26-6.GA.redhat_2.ep6.el5.4.src.rpm + + + sun-codemodel-2.6-3_redhat_2.ep6.el5.3.src.rpm + + + sun-istack-commons-2.6.1-9_redhat_2.ep6.el5.src.rpm + + + sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3.src.rpm + + + sun-txw2-20110809-6_redhat_2.ep6.el5.4.src.rpm + + + sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4.src.rpm + + + sun-xsom-20110809-5_redhat_3.ep6.el5.3.src.rpm + + + tomcat-native-1.1.24-1.1.ep6.el5.src.rpm + + + velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4.src.rpm + + + weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5.src.rpm + + + weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1.src.rpm + + + woodstox-core-4.1.1-1.redhat_2.ep6.el5.4.src.rpm + + + ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5.src.rpm + + + ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5.src.rpm + + + ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5.src.rpm + + + wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5.src.rpm + + + wss4j-1.6.7-1.redhat_1.ep6.el5.src.rpm + + + xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2.src.rpm + + + xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5.src.rpm + + + xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3.src.rpm + + + xml-security-1.5.2-2.redhat_1.ep6.el5.src.rpm + + + xom-1.2.7-1._redhat_3.1.ep6.el5.6.src.rpm + + + antlr-eap6-2.7.7-15_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-collections-3.2.1-10.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-lang-2.6-3.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-cxf-2.4.9-4.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-mime4j-0.6-7.redhat_2.ep6.el5.5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + atinject-1-8.2_redhat_2.ep6.el5.5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + cal10n-0.7.3-8.redhat_2.ep6.el5.5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + dom4j-1.6.1-14_redhat_3.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + glassfish-jaf-1.1.1-16.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + glassfish-javamail-1.4.4-16.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + glassfish-jsf-2.1.13-1_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + h2database-1.3.168-2_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + hornetq-2.2.23-1.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + hornetq-native-2.2.21-1.1.Final.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + httpcomponents-5-4_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + httpd-2.2.22-14.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + infinispan-5.1.8-1.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jandex-1.0.3-7.Final_redhat_2.ep6.el5.2 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jaxen-1.1.3-8.redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossts-4.16.6-1.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossweb-7.0.17-1.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jettison-1.3.1-7_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jgroups-3.0.14-2.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + joda-time-1.6.2-5.redhat_3.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jtype-0.1.1-9_redhat_2.3.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + juddi-3.1.3-3_redhat_2.1.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jython-eap6-2.5.2-5.redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + mod_cluster-native-1.2.3-3.Final.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + mod_jk-1.2.36-5.1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + netty-3.2.6-2_redhat_2.2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + org.osgi-4.2.0-4.redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + picketbox-4.0.14-2.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + rngom-201103-0.5.redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + scannotation-1.0.2-8.redhat_2.ep6.el5.2 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + shrinkwrap-1.0.0-16.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + slf4j-eap6-1.6.1-23.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + snakeyaml-1.8-8.redhat_2.ep6.el5.2 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + stilts-0.1.26-6.GA.redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + sun-codemodel-2.6-3_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + sun-istack-commons-2.6.1-9_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + sun-txw2-20110809-6_redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + sun-xsom-20110809-5_redhat_3.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + tomcat-native-1.1.24-1.1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + woodstox-core-4.1.1-1.redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + wss4j-1.6.7-1.redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + xml-security-1.5.2-2.redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + xom-1.2.7-1._redhat_3.1.ep6.el5.6 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + + + An input sanitization flaw was found in the mod_negotiation Apache HTTP Server module. A remote attacker able to upload or create files with arbitrary names in a directory that has the MultiViews options enabled, could use this flaw to conduct cross-site scripting attacks against users visiting the site. + 2012-08-21T00:00:00Z + 2012-06-13T00:00:00Z + + CVE-2008-0455 + + 5Server-JBEAP-6:antlr-eap6-2.7.7-15_redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-collections-3.2.1-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5 + 5Server-JBEAP-6:apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-lang-2.6-3.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-cxf-2.4.9-4.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-mime4j-0.6-7.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:atinject-1-8.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:cal10n-0.7.3-8.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:dom4j-1.6.1-14_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jaf-1.1.1-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-javamail-1.4.4-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf-2.1.13-1_redhat_1.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5 + 5Server-JBEAP-6:gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6 + 5Server-JBEAP-6:h2database-1.3.168-2_redhat_1.ep6.el5 + 5Server-JBEAP-6:hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hornetq-2.2.23-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:hornetq-native-2.2.21-1.1.Final.ep6.el5 + 5Server-JBEAP-6:httpcomponents-5-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:httpd-2.2.22-14.ep6.el5 + 5Server-JBEAP-6:httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:infinispan-5.1.8-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jandex-1.0.3-7.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxen-1.1.3-8.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5 + 5Server-JBEAP-6:jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1 + 5Server-JBEAP-6:jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5 + 5Server-JBEAP-6:jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7 + 5Server-JBEAP-6:jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1 + 5Server-JBEAP-6:jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossts-4.16.6-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossweb-7.0.17-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5 + 5Server-JBEAP-6:jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jettison-1.3.1-7_redhat_2.ep6.el5 + 5Server-JBEAP-6:jgroups-3.0.14-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:joda-time-1.6.2-5.redhat_3.ep6.el5.4 + 5Server-JBEAP-6:jtype-0.1.1-9_redhat_2.3.ep6.el5.4 + 5Server-JBEAP-6:juddi-3.1.3-3_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jython-eap6-2.5.2-5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:mod_cluster-native-1.2.3-3.Final.ep6.el5 + 5Server-JBEAP-6:mod_jk-1.2.36-5.1.ep6.el5 + 5Server-JBEAP-6:netty-3.2.6-2_redhat_2.2.ep6.el5.4 + 5Server-JBEAP-6:objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:org.osgi-4.2.0-4.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketbox-4.0.14-2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5 + 5Server-JBEAP-6:relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4 + 5Server-JBEAP-6:resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:rngom-201103-0.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:scannotation-1.0.2-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:shrinkwrap-1.0.0-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-eap6-1.6.1-23.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2 + 5Server-JBEAP-6:snakeyaml-1.8-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:stilts-0.1.26-6.GA.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-codemodel-2.6-3_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-istack-commons-2.6.1-9_redhat_2.ep6.el5 + 5Server-JBEAP-6:sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-txw2-20110809-6_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-xsom-20110809-5_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:tomcat-native-1.1.24-1.1.ep6.el5 + 5Server-JBEAP-6:velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:woodstox-core-4.1.1-1.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5 + 5Server-JBEAP-6:wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5 + 5Server-JBEAP-6:wss4j-1.6.7-1.redhat_1.ep6.el5 + 5Server-JBEAP-6:xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2 + 5Server-JBEAP-6:xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5 + 5Server-JBEAP-6:xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:xml-security-1.5.2-2.redhat_1.ep6.el5 + 5Server-JBEAP-6:xom-1.2.7-1._redhat_3.1.ep6.el5.6 + + Low + + 2.6 + AV:N/AC:H/Au:N/C:N/I:P/A:N + + + +All users of JBoss Enterprise Application Platform 6.0.0 on Red Hat +Enterprise Linux 5 are advised to upgrade to these updated packages. The +JBoss server process must be restarted for the update to take effect. + +Before applying this update, make sure all previously released errata +relevant to your system have been applied. Also, back up any customized +JBoss Enterprise Application Platform 6 configuration files. On update, the +configuration files that have been locally modified will not be updated. +The updated version of such files will be stored as the rpmnew files. Make +sure to locate any such files after the update and merge any changes +manually. + +For more details, refer to the Release Notes for JBoss Enterprise +Application Platform 6.0.1, available shortly from +https://access.redhat.com/knowledge/docs/ + +This update is available via the Red Hat Network. Details on how to use the +Red Hat Network to apply this update are available at +https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2012-1591.html + + + + https://www.redhat.com/security/data/cve/CVE-2008-0455.html + CVE-2008-0455 + + + https://bugzilla.redhat.com/show_bug.cgi?id=850794 + bz#850794: CVE-2012-2687 CVE-2008-0455 httpd: mod_negotiation XSS via untrusted file names in directories with MultiViews enabled + + + + + + A flaw in the way Apache CXF enforced child policies of WS-SecurityPolicy 1.1 on the client side could, in certain cases, lead to a client failing to sign or encrypt certain elements as directed by the security policy, leading to information disclosure and insecure information transmission. + 2012-05-28T00:00:00Z + 2012-06-07T00:00:00Z + + CVE-2012-2378 + + 5Server-JBEAP-6:antlr-eap6-2.7.7-15_redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-collections-3.2.1-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5 + 5Server-JBEAP-6:apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-lang-2.6-3.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-cxf-2.4.9-4.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-mime4j-0.6-7.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:atinject-1-8.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:cal10n-0.7.3-8.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:dom4j-1.6.1-14_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jaf-1.1.1-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-javamail-1.4.4-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf-2.1.13-1_redhat_1.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5 + 5Server-JBEAP-6:gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6 + 5Server-JBEAP-6:h2database-1.3.168-2_redhat_1.ep6.el5 + 5Server-JBEAP-6:hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hornetq-2.2.23-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:hornetq-native-2.2.21-1.1.Final.ep6.el5 + 5Server-JBEAP-6:httpcomponents-5-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:httpd-2.2.22-14.ep6.el5 + 5Server-JBEAP-6:httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:infinispan-5.1.8-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jandex-1.0.3-7.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxen-1.1.3-8.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5 + 5Server-JBEAP-6:jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1 + 5Server-JBEAP-6:jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5 + 5Server-JBEAP-6:jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7 + 5Server-JBEAP-6:jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1 + 5Server-JBEAP-6:jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossts-4.16.6-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossweb-7.0.17-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5 + 5Server-JBEAP-6:jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jettison-1.3.1-7_redhat_2.ep6.el5 + 5Server-JBEAP-6:jgroups-3.0.14-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:joda-time-1.6.2-5.redhat_3.ep6.el5.4 + 5Server-JBEAP-6:jtype-0.1.1-9_redhat_2.3.ep6.el5.4 + 5Server-JBEAP-6:juddi-3.1.3-3_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jython-eap6-2.5.2-5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:mod_cluster-native-1.2.3-3.Final.ep6.el5 + 5Server-JBEAP-6:mod_jk-1.2.36-5.1.ep6.el5 + 5Server-JBEAP-6:netty-3.2.6-2_redhat_2.2.ep6.el5.4 + 5Server-JBEAP-6:objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:org.osgi-4.2.0-4.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketbox-4.0.14-2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5 + 5Server-JBEAP-6:relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4 + 5Server-JBEAP-6:resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:rngom-201103-0.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:scannotation-1.0.2-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:shrinkwrap-1.0.0-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-eap6-1.6.1-23.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2 + 5Server-JBEAP-6:snakeyaml-1.8-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:stilts-0.1.26-6.GA.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-codemodel-2.6-3_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-istack-commons-2.6.1-9_redhat_2.ep6.el5 + 5Server-JBEAP-6:sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-txw2-20110809-6_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-xsom-20110809-5_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:tomcat-native-1.1.24-1.1.ep6.el5 + 5Server-JBEAP-6:velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:woodstox-core-4.1.1-1.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5 + 5Server-JBEAP-6:wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5 + 5Server-JBEAP-6:wss4j-1.6.7-1.redhat_1.ep6.el5 + 5Server-JBEAP-6:xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2 + 5Server-JBEAP-6:xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5 + 5Server-JBEAP-6:xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:xml-security-1.5.2-2.redhat_1.ep6.el5 + 5Server-JBEAP-6:xom-1.2.7-1._redhat_3.1.ep6.el5.6 + + Moderate + + 4.3 + AV:N/AC:M/Au:N/C:P/I:N/A:N + + + +All users of JBoss Enterprise Application Platform 6.0.0 on Red Hat +Enterprise Linux 5 are advised to upgrade to these updated packages. The +JBoss server process must be restarted for the update to take effect. + +Before applying this update, make sure all previously released errata +relevant to your system have been applied. Also, back up any customized +JBoss Enterprise Application Platform 6 configuration files. On update, the +configuration files that have been locally modified will not be updated. +The updated version of such files will be stored as the rpmnew files. Make +sure to locate any such files after the update and merge any changes +manually. + +For more details, refer to the Release Notes for JBoss Enterprise +Application Platform 6.0.1, available shortly from +https://access.redhat.com/knowledge/docs/ + +This update is available via the Red Hat Network. Details on how to use the +Red Hat Network to apply this update are available at +https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2012-1591.html + + + + http://cxf.apache.org/cve-2012-2378.html + http://cxf.apache.org/cve-2012-2378.html + + + https://www.redhat.com/security/data/cve/CVE-2012-2378.html + CVE-2012-2378 + + + https://bugzilla.redhat.com/show_bug.cgi?id=826533 + bz#826533: CVE-2012-2378 jbossws-cxf, apache-cxf: Certain child policies of WS-SecurityPolicy 1.1 SupportingToken policy not applied on the client side + + + Red Hat would like to thank the Apache CXF project for reporting this issue. + + + + Apache CXF checked to ensure XML elements were signed or encrypted by a Supporting Token, but not whether the correct token was used. A remote attacker could transmit confidential information without the appropriate security, and potentially circumvent access controls on web services exposed via Apache CXF. + 2012-05-28T00:00:00Z + 2012-06-07T00:00:00Z + + CVE-2012-2379 + + 5Server-JBEAP-6:antlr-eap6-2.7.7-15_redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-collections-3.2.1-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5 + 5Server-JBEAP-6:apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-lang-2.6-3.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-cxf-2.4.9-4.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-mime4j-0.6-7.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:atinject-1-8.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:cal10n-0.7.3-8.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:dom4j-1.6.1-14_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jaf-1.1.1-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-javamail-1.4.4-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf-2.1.13-1_redhat_1.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5 + 5Server-JBEAP-6:gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6 + 5Server-JBEAP-6:h2database-1.3.168-2_redhat_1.ep6.el5 + 5Server-JBEAP-6:hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hornetq-2.2.23-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:hornetq-native-2.2.21-1.1.Final.ep6.el5 + 5Server-JBEAP-6:httpcomponents-5-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:httpd-2.2.22-14.ep6.el5 + 5Server-JBEAP-6:httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:infinispan-5.1.8-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jandex-1.0.3-7.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxen-1.1.3-8.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5 + 5Server-JBEAP-6:jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1 + 5Server-JBEAP-6:jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5 + 5Server-JBEAP-6:jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7 + 5Server-JBEAP-6:jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1 + 5Server-JBEAP-6:jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossts-4.16.6-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossweb-7.0.17-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5 + 5Server-JBEAP-6:jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jettison-1.3.1-7_redhat_2.ep6.el5 + 5Server-JBEAP-6:jgroups-3.0.14-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:joda-time-1.6.2-5.redhat_3.ep6.el5.4 + 5Server-JBEAP-6:jtype-0.1.1-9_redhat_2.3.ep6.el5.4 + 5Server-JBEAP-6:juddi-3.1.3-3_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jython-eap6-2.5.2-5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:mod_cluster-native-1.2.3-3.Final.ep6.el5 + 5Server-JBEAP-6:mod_jk-1.2.36-5.1.ep6.el5 + 5Server-JBEAP-6:netty-3.2.6-2_redhat_2.2.ep6.el5.4 + 5Server-JBEAP-6:objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:org.osgi-4.2.0-4.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketbox-4.0.14-2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5 + 5Server-JBEAP-6:relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4 + 5Server-JBEAP-6:resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:rngom-201103-0.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:scannotation-1.0.2-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:shrinkwrap-1.0.0-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-eap6-1.6.1-23.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2 + 5Server-JBEAP-6:snakeyaml-1.8-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:stilts-0.1.26-6.GA.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-codemodel-2.6-3_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-istack-commons-2.6.1-9_redhat_2.ep6.el5 + 5Server-JBEAP-6:sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-txw2-20110809-6_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-xsom-20110809-5_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:tomcat-native-1.1.24-1.1.ep6.el5 + 5Server-JBEAP-6:velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:woodstox-core-4.1.1-1.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5 + 5Server-JBEAP-6:wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5 + 5Server-JBEAP-6:wss4j-1.6.7-1.redhat_1.ep6.el5 + 5Server-JBEAP-6:xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2 + 5Server-JBEAP-6:xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5 + 5Server-JBEAP-6:xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:xml-security-1.5.2-2.redhat_1.ep6.el5 + 5Server-JBEAP-6:xom-1.2.7-1._redhat_3.1.ep6.el5.6 + + Important + + 5.8 + AV:N/AC:M/Au:N/C:P/I:P/A:N + + + +All users of JBoss Enterprise Application Platform 6.0.0 on Red Hat +Enterprise Linux 5 are advised to upgrade to these updated packages. The +JBoss server process must be restarted for the update to take effect. + +Before applying this update, make sure all previously released errata +relevant to your system have been applied. Also, back up any customized +JBoss Enterprise Application Platform 6 configuration files. On update, the +configuration files that have been locally modified will not be updated. +The updated version of such files will be stored as the rpmnew files. Make +sure to locate any such files after the update and merge any changes +manually. + +For more details, refer to the Release Notes for JBoss Enterprise +Application Platform 6.0.1, available shortly from +https://access.redhat.com/knowledge/docs/ + +This update is available via the Red Hat Network. Details on how to use the +Red Hat Network to apply this update are available at +https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2012-1591.html + + + + http://cxf.apache.org/cve-2012-2379.html + http://cxf.apache.org/cve-2012-2379.html + + + https://www.redhat.com/security/data/cve/CVE-2012-2379.html + CVE-2012-2379 + + + https://bugzilla.redhat.com/show_bug.cgi?id=826534 + bz#826534: CVE-2012-2379 jbossws-cxf, apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token + + + Red Hat would like to thank the Apache CXF project for reporting this issue. + + + + It was found that in Mojarra, the FacesContext that is made available during application startup is held in a ThreadLocal. The reference is not properly cleaned up in all cases. As a result, if a JavaServer Faces (JSF) WAR calls FacesContext.getCurrentInstance() during application startup, another WAR can get access to the leftover context and thus get access to the other WAR's resources. A local attacker could use this flaw to access another WAR's resources using a crafted, deployed application. + 2012-06-01T00:00:00Z + 2012-06-01T00:00:00Z + + CVE-2012-2672 + + 5Server-JBEAP-6:antlr-eap6-2.7.7-15_redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-collections-3.2.1-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5 + 5Server-JBEAP-6:apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-lang-2.6-3.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-cxf-2.4.9-4.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-mime4j-0.6-7.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:atinject-1-8.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:cal10n-0.7.3-8.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:dom4j-1.6.1-14_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jaf-1.1.1-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-javamail-1.4.4-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf-2.1.13-1_redhat_1.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5 + 5Server-JBEAP-6:gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6 + 5Server-JBEAP-6:h2database-1.3.168-2_redhat_1.ep6.el5 + 5Server-JBEAP-6:hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hornetq-2.2.23-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:hornetq-native-2.2.21-1.1.Final.ep6.el5 + 5Server-JBEAP-6:httpcomponents-5-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:httpd-2.2.22-14.ep6.el5 + 5Server-JBEAP-6:httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:infinispan-5.1.8-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jandex-1.0.3-7.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxen-1.1.3-8.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5 + 5Server-JBEAP-6:jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1 + 5Server-JBEAP-6:jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5 + 5Server-JBEAP-6:jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7 + 5Server-JBEAP-6:jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1 + 5Server-JBEAP-6:jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossts-4.16.6-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossweb-7.0.17-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5 + 5Server-JBEAP-6:jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jettison-1.3.1-7_redhat_2.ep6.el5 + 5Server-JBEAP-6:jgroups-3.0.14-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:joda-time-1.6.2-5.redhat_3.ep6.el5.4 + 5Server-JBEAP-6:jtype-0.1.1-9_redhat_2.3.ep6.el5.4 + 5Server-JBEAP-6:juddi-3.1.3-3_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jython-eap6-2.5.2-5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:mod_cluster-native-1.2.3-3.Final.ep6.el5 + 5Server-JBEAP-6:mod_jk-1.2.36-5.1.ep6.el5 + 5Server-JBEAP-6:netty-3.2.6-2_redhat_2.2.ep6.el5.4 + 5Server-JBEAP-6:objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:org.osgi-4.2.0-4.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketbox-4.0.14-2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5 + 5Server-JBEAP-6:relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4 + 5Server-JBEAP-6:resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:rngom-201103-0.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:scannotation-1.0.2-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:shrinkwrap-1.0.0-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-eap6-1.6.1-23.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2 + 5Server-JBEAP-6:snakeyaml-1.8-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:stilts-0.1.26-6.GA.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-codemodel-2.6-3_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-istack-commons-2.6.1-9_redhat_2.ep6.el5 + 5Server-JBEAP-6:sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-txw2-20110809-6_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-xsom-20110809-5_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:tomcat-native-1.1.24-1.1.ep6.el5 + 5Server-JBEAP-6:velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:woodstox-core-4.1.1-1.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5 + 5Server-JBEAP-6:wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5 + 5Server-JBEAP-6:wss4j-1.6.7-1.redhat_1.ep6.el5 + 5Server-JBEAP-6:xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2 + 5Server-JBEAP-6:xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5 + 5Server-JBEAP-6:xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:xml-security-1.5.2-2.redhat_1.ep6.el5 + 5Server-JBEAP-6:xom-1.2.7-1._redhat_3.1.ep6.el5.6 + + Low + + 1.9 + AV:L/AC:M/Au:N/C:P/I:N/A:N + + + +All users of JBoss Enterprise Application Platform 6.0.0 on Red Hat +Enterprise Linux 5 are advised to upgrade to these updated packages. The +JBoss server process must be restarted for the update to take effect. + +Before applying this update, make sure all previously released errata +relevant to your system have been applied. Also, back up any customized +JBoss Enterprise Application Platform 6 configuration files. On update, the +configuration files that have been locally modified will not be updated. +The updated version of such files will be stored as the rpmnew files. Make +sure to locate any such files after the update and merge any changes +manually. + +For more details, refer to the Release Notes for JBoss Enterprise +Application Platform 6.0.1, available shortly from +https://access.redhat.com/knowledge/docs/ + +This update is available via the Red Hat Network. Details on how to use the +Red Hat Network to apply this update are available at +https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2012-1591.html + + + + https://www.redhat.com/security/data/cve/CVE-2012-2672.html + CVE-2012-2672 + + + https://bugzilla.redhat.com/show_bug.cgi?id=829560 + bz#829560: CVE-2012-2672 Mojarra: deployed web applications can read FacesContext from other applications under certain conditions + + + This issue was discovered by Marek Schmidt and Stan Silvert of Red Hat. + + + + An input sanitization flaw was found in the mod_negotiation Apache HTTP Server module. A remote attacker able to upload or create files with arbitrary names in a directory that has the MultiViews options enabled, could use this flaw to conduct cross-site scripting attacks against users visiting the site. + 2012-08-21T00:00:00Z + 2012-06-13T00:00:00Z + + CVE-2012-2687 + + 5Server-JBEAP-6:antlr-eap6-2.7.7-15_redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-collections-3.2.1-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5 + 5Server-JBEAP-6:apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-lang-2.6-3.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-cxf-2.4.9-4.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-mime4j-0.6-7.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:atinject-1-8.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:cal10n-0.7.3-8.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:dom4j-1.6.1-14_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jaf-1.1.1-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-javamail-1.4.4-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf-2.1.13-1_redhat_1.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5 + 5Server-JBEAP-6:gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6 + 5Server-JBEAP-6:h2database-1.3.168-2_redhat_1.ep6.el5 + 5Server-JBEAP-6:hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hornetq-2.2.23-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:hornetq-native-2.2.21-1.1.Final.ep6.el5 + 5Server-JBEAP-6:httpcomponents-5-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:httpd-2.2.22-14.ep6.el5 + 5Server-JBEAP-6:httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:infinispan-5.1.8-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jandex-1.0.3-7.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxen-1.1.3-8.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5 + 5Server-JBEAP-6:jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1 + 5Server-JBEAP-6:jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5 + 5Server-JBEAP-6:jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7 + 5Server-JBEAP-6:jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1 + 5Server-JBEAP-6:jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossts-4.16.6-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossweb-7.0.17-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5 + 5Server-JBEAP-6:jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jettison-1.3.1-7_redhat_2.ep6.el5 + 5Server-JBEAP-6:jgroups-3.0.14-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:joda-time-1.6.2-5.redhat_3.ep6.el5.4 + 5Server-JBEAP-6:jtype-0.1.1-9_redhat_2.3.ep6.el5.4 + 5Server-JBEAP-6:juddi-3.1.3-3_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jython-eap6-2.5.2-5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:mod_cluster-native-1.2.3-3.Final.ep6.el5 + 5Server-JBEAP-6:mod_jk-1.2.36-5.1.ep6.el5 + 5Server-JBEAP-6:netty-3.2.6-2_redhat_2.2.ep6.el5.4 + 5Server-JBEAP-6:objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:org.osgi-4.2.0-4.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketbox-4.0.14-2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5 + 5Server-JBEAP-6:relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4 + 5Server-JBEAP-6:resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:rngom-201103-0.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:scannotation-1.0.2-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:shrinkwrap-1.0.0-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-eap6-1.6.1-23.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2 + 5Server-JBEAP-6:snakeyaml-1.8-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:stilts-0.1.26-6.GA.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-codemodel-2.6-3_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-istack-commons-2.6.1-9_redhat_2.ep6.el5 + 5Server-JBEAP-6:sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-txw2-20110809-6_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-xsom-20110809-5_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:tomcat-native-1.1.24-1.1.ep6.el5 + 5Server-JBEAP-6:velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:woodstox-core-4.1.1-1.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5 + 5Server-JBEAP-6:wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5 + 5Server-JBEAP-6:wss4j-1.6.7-1.redhat_1.ep6.el5 + 5Server-JBEAP-6:xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2 + 5Server-JBEAP-6:xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5 + 5Server-JBEAP-6:xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:xml-security-1.5.2-2.redhat_1.ep6.el5 + 5Server-JBEAP-6:xom-1.2.7-1._redhat_3.1.ep6.el5.6 + + Low + + 2.6 + AV:N/AC:H/Au:N/C:N/I:P/A:N + + + +All users of JBoss Enterprise Application Platform 6.0.0 on Red Hat +Enterprise Linux 5 are advised to upgrade to these updated packages. The +JBoss server process must be restarted for the update to take effect. + +Before applying this update, make sure all previously released errata +relevant to your system have been applied. Also, back up any customized +JBoss Enterprise Application Platform 6 configuration files. On update, the +configuration files that have been locally modified will not be updated. +The updated version of such files will be stored as the rpmnew files. Make +sure to locate any such files after the update and merge any changes +manually. + +For more details, refer to the Release Notes for JBoss Enterprise +Application Platform 6.0.1, available shortly from +https://access.redhat.com/knowledge/docs/ + +This update is available via the Red Hat Network. Details on how to use the +Red Hat Network to apply this update are available at +https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2012-1591.html + + + + https://www.redhat.com/security/data/cve/CVE-2012-2687.html + CVE-2012-2687 + + + + + + A flaw was found in the way IronJacamar authenticated credentials and returned a valid datasource connection when configured to "allow-multiple-users". A remote attacker, provided the correct subject, could obtain a datasource connection that might belong to a privileged user. + 2012-07-25T00:00:00Z + 2012-12-18T00:00:00Z + + CVE-2012-3428 + + 5Server-JBEAP-6:antlr-eap6-2.7.7-15_redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-collections-3.2.1-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5 + 5Server-JBEAP-6:apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-lang-2.6-3.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-cxf-2.4.9-4.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-mime4j-0.6-7.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:atinject-1-8.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:cal10n-0.7.3-8.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:dom4j-1.6.1-14_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jaf-1.1.1-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-javamail-1.4.4-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf-2.1.13-1_redhat_1.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5 + 5Server-JBEAP-6:gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6 + 5Server-JBEAP-6:h2database-1.3.168-2_redhat_1.ep6.el5 + 5Server-JBEAP-6:hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hornetq-2.2.23-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:hornetq-native-2.2.21-1.1.Final.ep6.el5 + 5Server-JBEAP-6:httpcomponents-5-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:httpd-2.2.22-14.ep6.el5 + 5Server-JBEAP-6:httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:infinispan-5.1.8-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jandex-1.0.3-7.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxen-1.1.3-8.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5 + 5Server-JBEAP-6:jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1 + 5Server-JBEAP-6:jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5 + 5Server-JBEAP-6:jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7 + 5Server-JBEAP-6:jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1 + 5Server-JBEAP-6:jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossts-4.16.6-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossweb-7.0.17-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5 + 5Server-JBEAP-6:jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jettison-1.3.1-7_redhat_2.ep6.el5 + 5Server-JBEAP-6:jgroups-3.0.14-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:joda-time-1.6.2-5.redhat_3.ep6.el5.4 + 5Server-JBEAP-6:jtype-0.1.1-9_redhat_2.3.ep6.el5.4 + 5Server-JBEAP-6:juddi-3.1.3-3_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jython-eap6-2.5.2-5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:mod_cluster-native-1.2.3-3.Final.ep6.el5 + 5Server-JBEAP-6:mod_jk-1.2.36-5.1.ep6.el5 + 5Server-JBEAP-6:netty-3.2.6-2_redhat_2.2.ep6.el5.4 + 5Server-JBEAP-6:objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:org.osgi-4.2.0-4.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketbox-4.0.14-2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5 + 5Server-JBEAP-6:relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4 + 5Server-JBEAP-6:resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:rngom-201103-0.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:scannotation-1.0.2-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:shrinkwrap-1.0.0-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-eap6-1.6.1-23.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2 + 5Server-JBEAP-6:snakeyaml-1.8-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:stilts-0.1.26-6.GA.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-codemodel-2.6-3_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-istack-commons-2.6.1-9_redhat_2.ep6.el5 + 5Server-JBEAP-6:sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-txw2-20110809-6_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-xsom-20110809-5_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:tomcat-native-1.1.24-1.1.ep6.el5 + 5Server-JBEAP-6:velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:woodstox-core-4.1.1-1.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5 + 5Server-JBEAP-6:wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5 + 5Server-JBEAP-6:wss4j-1.6.7-1.redhat_1.ep6.el5 + 5Server-JBEAP-6:xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2 + 5Server-JBEAP-6:xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5 + 5Server-JBEAP-6:xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:xml-security-1.5.2-2.redhat_1.ep6.el5 + 5Server-JBEAP-6:xom-1.2.7-1._redhat_3.1.ep6.el5.6 + + Moderate + + 4.3 + AV:N/AC:M/Au:N/C:N/I:P/A:N + + + +All users of JBoss Enterprise Application Platform 6.0.0 on Red Hat +Enterprise Linux 5 are advised to upgrade to these updated packages. The +JBoss server process must be restarted for the update to take effect. + +Before applying this update, make sure all previously released errata +relevant to your system have been applied. Also, back up any customized +JBoss Enterprise Application Platform 6 configuration files. On update, the +configuration files that have been locally modified will not be updated. +The updated version of such files will be stored as the rpmnew files. Make +sure to locate any such files after the update and merge any changes +manually. + +For more details, refer to the Release Notes for JBoss Enterprise +Application Platform 6.0.1, available shortly from +https://access.redhat.com/knowledge/docs/ + +This update is available via the Red Hat Network. Details on how to use the +Red Hat Network to apply this update are available at +https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2012-1591.html + + + + https://www.redhat.com/security/data/cve/CVE-2012-3428.html + CVE-2012-3428 + + + https://bugzilla.redhat.com/show_bug.cgi?id=843358 + bz#843358: CVE-2012-3428 JBoss: Datasource connection manager returns valid connection for wrong credentials when using security-domains + + + This issue was discovered by Arun Neelicattu of the Red Hat Security Response Team. + + + + It was found that Apache CXF was vulnerable to SOAPAction spoofing attacks under certain conditions. Note that WS-Policy validation is performed against the operation being invoked, and an attack must pass validation to be successful. + 2012-08-25T00:00:00Z + 2012-09-19T00:00:00Z + + CVE-2012-3451 + + 5Server-JBEAP-6:antlr-eap6-2.7.7-15_redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-collections-3.2.1-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5 + 5Server-JBEAP-6:apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-lang-2.6-3.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-cxf-2.4.9-4.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-mime4j-0.6-7.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:atinject-1-8.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:cal10n-0.7.3-8.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:dom4j-1.6.1-14_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jaf-1.1.1-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-javamail-1.4.4-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf-2.1.13-1_redhat_1.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5 + 5Server-JBEAP-6:gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6 + 5Server-JBEAP-6:h2database-1.3.168-2_redhat_1.ep6.el5 + 5Server-JBEAP-6:hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hornetq-2.2.23-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:hornetq-native-2.2.21-1.1.Final.ep6.el5 + 5Server-JBEAP-6:httpcomponents-5-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:httpd-2.2.22-14.ep6.el5 + 5Server-JBEAP-6:httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:infinispan-5.1.8-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jandex-1.0.3-7.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxen-1.1.3-8.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5 + 5Server-JBEAP-6:jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1 + 5Server-JBEAP-6:jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5 + 5Server-JBEAP-6:jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7 + 5Server-JBEAP-6:jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1 + 5Server-JBEAP-6:jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossts-4.16.6-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossweb-7.0.17-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5 + 5Server-JBEAP-6:jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jettison-1.3.1-7_redhat_2.ep6.el5 + 5Server-JBEAP-6:jgroups-3.0.14-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:joda-time-1.6.2-5.redhat_3.ep6.el5.4 + 5Server-JBEAP-6:jtype-0.1.1-9_redhat_2.3.ep6.el5.4 + 5Server-JBEAP-6:juddi-3.1.3-3_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jython-eap6-2.5.2-5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:mod_cluster-native-1.2.3-3.Final.ep6.el5 + 5Server-JBEAP-6:mod_jk-1.2.36-5.1.ep6.el5 + 5Server-JBEAP-6:netty-3.2.6-2_redhat_2.2.ep6.el5.4 + 5Server-JBEAP-6:objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:org.osgi-4.2.0-4.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketbox-4.0.14-2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5 + 5Server-JBEAP-6:relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4 + 5Server-JBEAP-6:resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:rngom-201103-0.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:scannotation-1.0.2-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:shrinkwrap-1.0.0-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-eap6-1.6.1-23.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2 + 5Server-JBEAP-6:snakeyaml-1.8-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:stilts-0.1.26-6.GA.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-codemodel-2.6-3_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-istack-commons-2.6.1-9_redhat_2.ep6.el5 + 5Server-JBEAP-6:sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-txw2-20110809-6_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-xsom-20110809-5_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:tomcat-native-1.1.24-1.1.ep6.el5 + 5Server-JBEAP-6:velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:woodstox-core-4.1.1-1.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5 + 5Server-JBEAP-6:wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5 + 5Server-JBEAP-6:wss4j-1.6.7-1.redhat_1.ep6.el5 + 5Server-JBEAP-6:xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2 + 5Server-JBEAP-6:xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5 + 5Server-JBEAP-6:xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:xml-security-1.5.2-2.redhat_1.ep6.el5 + 5Server-JBEAP-6:xom-1.2.7-1._redhat_3.1.ep6.el5.6 + + Moderate + + 4.3 + AV:N/AC:M/Au:N/C:N/I:P/A:N + + + +All users of JBoss Enterprise Application Platform 6.0.0 on Red Hat +Enterprise Linux 5 are advised to upgrade to these updated packages. The +JBoss server process must be restarted for the update to take effect. + +Before applying this update, make sure all previously released errata +relevant to your system have been applied. Also, back up any customized +JBoss Enterprise Application Platform 6 configuration files. On update, the +configuration files that have been locally modified will not be updated. +The updated version of such files will be stored as the rpmnew files. Make +sure to locate any such files after the update and merge any changes +manually. + +For more details, refer to the Release Notes for JBoss Enterprise +Application Platform 6.0.1, available shortly from +https://access.redhat.com/knowledge/docs/ + +This update is available via the Red Hat Network. Details on how to use the +Red Hat Network to apply this update are available at +https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2012-1591.html + + + + https://www.redhat.com/security/data/cve/CVE-2012-3451.html + CVE-2012-3451 + + + https://bugzilla.redhat.com/show_bug.cgi?id=851896 + bz#851896: CVE-2012-3451 jbossws-cxf, apache-cxf: SOAPAction spoofing on document literal web services + + + Red Hat would like to thank the Apache CXF project for reporting this issue. + + + + When there are no allowed roles for an EJB method invocation, the invocation should be denied for all users. It was found that the processInvocation() method in org.jboss.as.ejb3.security.AuthorizationInterceptor incorrectly authorizes all method invocations to proceed when the list of allowed roles is empty. + 2012-10-29T00:00:00Z + 2012-12-18T00:00:00Z + + CVE-2012-4549 + + 5Server-JBEAP-6:antlr-eap6-2.7.7-15_redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-collections-3.2.1-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5 + 5Server-JBEAP-6:apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-lang-2.6-3.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-cxf-2.4.9-4.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-mime4j-0.6-7.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:atinject-1-8.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:cal10n-0.7.3-8.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:dom4j-1.6.1-14_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jaf-1.1.1-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-javamail-1.4.4-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf-2.1.13-1_redhat_1.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5 + 5Server-JBEAP-6:gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6 + 5Server-JBEAP-6:h2database-1.3.168-2_redhat_1.ep6.el5 + 5Server-JBEAP-6:hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hornetq-2.2.23-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:hornetq-native-2.2.21-1.1.Final.ep6.el5 + 5Server-JBEAP-6:httpcomponents-5-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:httpd-2.2.22-14.ep6.el5 + 5Server-JBEAP-6:httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:infinispan-5.1.8-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jandex-1.0.3-7.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxen-1.1.3-8.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5 + 5Server-JBEAP-6:jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1 + 5Server-JBEAP-6:jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5 + 5Server-JBEAP-6:jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7 + 5Server-JBEAP-6:jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1 + 5Server-JBEAP-6:jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossts-4.16.6-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossweb-7.0.17-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5 + 5Server-JBEAP-6:jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jettison-1.3.1-7_redhat_2.ep6.el5 + 5Server-JBEAP-6:jgroups-3.0.14-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:joda-time-1.6.2-5.redhat_3.ep6.el5.4 + 5Server-JBEAP-6:jtype-0.1.1-9_redhat_2.3.ep6.el5.4 + 5Server-JBEAP-6:juddi-3.1.3-3_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jython-eap6-2.5.2-5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:mod_cluster-native-1.2.3-3.Final.ep6.el5 + 5Server-JBEAP-6:mod_jk-1.2.36-5.1.ep6.el5 + 5Server-JBEAP-6:netty-3.2.6-2_redhat_2.2.ep6.el5.4 + 5Server-JBEAP-6:objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:org.osgi-4.2.0-4.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketbox-4.0.14-2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5 + 5Server-JBEAP-6:relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4 + 5Server-JBEAP-6:resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:rngom-201103-0.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:scannotation-1.0.2-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:shrinkwrap-1.0.0-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-eap6-1.6.1-23.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2 + 5Server-JBEAP-6:snakeyaml-1.8-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:stilts-0.1.26-6.GA.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-codemodel-2.6-3_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-istack-commons-2.6.1-9_redhat_2.ep6.el5 + 5Server-JBEAP-6:sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-txw2-20110809-6_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-xsom-20110809-5_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:tomcat-native-1.1.24-1.1.ep6.el5 + 5Server-JBEAP-6:velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:woodstox-core-4.1.1-1.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5 + 5Server-JBEAP-6:wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5 + 5Server-JBEAP-6:wss4j-1.6.7-1.redhat_1.ep6.el5 + 5Server-JBEAP-6:xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2 + 5Server-JBEAP-6:xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5 + 5Server-JBEAP-6:xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:xml-security-1.5.2-2.redhat_1.ep6.el5 + 5Server-JBEAP-6:xom-1.2.7-1._redhat_3.1.ep6.el5.6 + + Moderate + + 5.8 + AV:N/AC:M/Au:N/C:P/I:P/A:N + + + +All users of JBoss Enterprise Application Platform 6.0.0 on Red Hat +Enterprise Linux 5 are advised to upgrade to these updated packages. The +JBoss server process must be restarted for the update to take effect. + +Before applying this update, make sure all previously released errata +relevant to your system have been applied. Also, back up any customized +JBoss Enterprise Application Platform 6 configuration files. On update, the +configuration files that have been locally modified will not be updated. +The updated version of such files will be stored as the rpmnew files. Make +sure to locate any such files after the update and merge any changes +manually. + +For more details, refer to the Release Notes for JBoss Enterprise +Application Platform 6.0.1, available shortly from +https://access.redhat.com/knowledge/docs/ + +This update is available via the Red Hat Network. Details on how to use the +Red Hat Network to apply this update are available at +https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2012-1591.html + + + + https://www.redhat.com/security/data/cve/CVE-2012-4549.html + CVE-2012-4549 + + + https://bugzilla.redhat.com/show_bug.cgi?id=870868 + bz#870868: CVE-2012-4549 JBoss AS: EJB authorization succeeds for any role when allowed roles list is empty + + + This issue was discovered by Arun Neelicattu of the Red Hat Security Response Team. + + + + When using role-based authorization to configure EJB access, JACC permissions should be used to determine access; however, due to a flaw the configured authorization modules (JACC, XACML, etc.) were not called, and the JACC permissions were not used to determine access to an EJB. + 2012-10-24T00:00:00Z + 2012-04-19T00:00:00Z + + CVE-2012-4550 + + 5Server-JBEAP-6:antlr-eap6-2.7.7-15_redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-collections-3.2.1-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5 + 5Server-JBEAP-6:apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-lang-2.6-3.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-cxf-2.4.9-4.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-mime4j-0.6-7.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:atinject-1-8.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:cal10n-0.7.3-8.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:dom4j-1.6.1-14_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jaf-1.1.1-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-javamail-1.4.4-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf-2.1.13-1_redhat_1.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5 + 5Server-JBEAP-6:gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6 + 5Server-JBEAP-6:h2database-1.3.168-2_redhat_1.ep6.el5 + 5Server-JBEAP-6:hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hornetq-2.2.23-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:hornetq-native-2.2.21-1.1.Final.ep6.el5 + 5Server-JBEAP-6:httpcomponents-5-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:httpd-2.2.22-14.ep6.el5 + 5Server-JBEAP-6:httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:infinispan-5.1.8-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jandex-1.0.3-7.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxen-1.1.3-8.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5 + 5Server-JBEAP-6:jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1 + 5Server-JBEAP-6:jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5 + 5Server-JBEAP-6:jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7 + 5Server-JBEAP-6:jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1 + 5Server-JBEAP-6:jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossts-4.16.6-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossweb-7.0.17-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5 + 5Server-JBEAP-6:jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jettison-1.3.1-7_redhat_2.ep6.el5 + 5Server-JBEAP-6:jgroups-3.0.14-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:joda-time-1.6.2-5.redhat_3.ep6.el5.4 + 5Server-JBEAP-6:jtype-0.1.1-9_redhat_2.3.ep6.el5.4 + 5Server-JBEAP-6:juddi-3.1.3-3_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jython-eap6-2.5.2-5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:mod_cluster-native-1.2.3-3.Final.ep6.el5 + 5Server-JBEAP-6:mod_jk-1.2.36-5.1.ep6.el5 + 5Server-JBEAP-6:netty-3.2.6-2_redhat_2.2.ep6.el5.4 + 5Server-JBEAP-6:objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:org.osgi-4.2.0-4.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketbox-4.0.14-2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5 + 5Server-JBEAP-6:relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4 + 5Server-JBEAP-6:resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:rngom-201103-0.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:scannotation-1.0.2-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:shrinkwrap-1.0.0-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-eap6-1.6.1-23.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2 + 5Server-JBEAP-6:snakeyaml-1.8-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:stilts-0.1.26-6.GA.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-codemodel-2.6-3_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-istack-commons-2.6.1-9_redhat_2.ep6.el5 + 5Server-JBEAP-6:sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-txw2-20110809-6_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-xsom-20110809-5_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:tomcat-native-1.1.24-1.1.ep6.el5 + 5Server-JBEAP-6:velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:woodstox-core-4.1.1-1.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5 + 5Server-JBEAP-6:wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5 + 5Server-JBEAP-6:wss4j-1.6.7-1.redhat_1.ep6.el5 + 5Server-JBEAP-6:xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2 + 5Server-JBEAP-6:xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5 + 5Server-JBEAP-6:xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:xml-security-1.5.2-2.redhat_1.ep6.el5 + 5Server-JBEAP-6:xom-1.2.7-1._redhat_3.1.ep6.el5.6 + + Important + + 6.8 + AV:N/AC:L/Au:N/C:P/I:P/A:N + + + +All users of JBoss Enterprise Application Platform 6.0.0 on Red Hat +Enterprise Linux 5 are advised to upgrade to these updated packages. The +JBoss server process must be restarted for the update to take effect. + +Before applying this update, make sure all previously released errata +relevant to your system have been applied. Also, back up any customized +JBoss Enterprise Application Platform 6 configuration files. On update, the +configuration files that have been locally modified will not be updated. +The updated version of such files will be stored as the rpmnew files. Make +sure to locate any such files after the update and merge any changes +manually. + +For more details, refer to the Release Notes for JBoss Enterprise +Application Platform 6.0.1, available shortly from +https://access.redhat.com/knowledge/docs/ + +This update is available via the Red Hat Network. Details on how to use the +Red Hat Network to apply this update are available at +https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2012-1591.html + + + + https://www.redhat.com/security/data/cve/CVE-2012-4550.html + CVE-2012-4550 + + + https://bugzilla.redhat.com/show_bug.cgi?id=870871 + bz#870871: CVE-2012-4550 JBoss JACC: Security constraints configured for EJBs are incorrectly interpreted and not applied + + + This issue was discovered by Josef Cacek of the Red Hat JBoss EAP Quality Engineering team. + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/cvrf.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/cvrf.xsd new file mode 100755 index 000000000..b4153b9fe --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/cvrf.xsd @@ -0,0 +1,487 @@ + + + + + + + + + + + + + + This is the XML schema for the Common Vulnerability Reporting Framework. For more information, see the CVRF whitepaper. + + Brian Schafer <bschafer@microsoft.com> + Joe Clarke <jclarke@cisco.com> + Joe Hemmerlein <Joe.Hemmerlein@microsoft.com> + 2012-05-07 + CVRF Dictionary + 1.1 + + + + + + + + Types enumerating the status of the document. + + + + + Pre-release, intended for issuing party’s internal use only, or possibly used externally when the party is seeking feedback or indicating its intentions regarding a specific issue. + + + + + The issuing party believes the content is subject to change. + + + + + The issuing party asserts the content is unlikely to change. + + + + + + + Floating point number representing the CVRF specification version + + + + + + + + + + + Root element of a CVRF document. + + + + + + A definitive canonical name for the document, providing enough descriptive content to differentiate from other similar documents, ideally providing a unique “handle”. + + + + + + + + + + A short canonical name, chosen by the document producer, which will inform the consumer about the type of the document. + + + + + + + + + + A container holding all information about the publisher of the CVRF document. + + + + + + Author contact information such as address, phone number, email, etc. + + + + + + + + + + The name of the issuing party and their authority to release the document, in particular, the party's constituency and responsibilities or other obligations. + + + + + + + + + + + Type is an enumerated list containing an array of different document publisher types. + + + + + Vendor ID is a unique identifier (OID) that a vendor uses as issued by FIRST under the auspices of IETF. + + + + + + + The Document Tracking meta-container contains all of the attributes necessary to track a CVRF document. + + + + + + Contains document ID and optional document aliases + + + + + + Short unique identifier used to refer to the document unambiguously in any context. + + + + + + + + + + Optional alternative ID for document + + + + + + + + + + + + + The condition of the document with regard to completeness and the likelihood of future editions. + + + + + Document Version is a simple counter to track the version of the document. + + + + + The Document Revision History contains one entry for each substantive version of the document, including the initial version and entries for each subsequent update. + + + + + + A set of Version, Date, and Description elements describing one iteration of this document + + + + + + Revision number of this iteration of the document. + + + + + Date when this iteration of the document was released. + + + + + Description of this iteration of the document. + + + + + + + + + + + + + + + + The initial date (and time, optionally) that the document was initially released by the issuing party. + + + + + The current date (and time, optionally) that the document was released by the issuing party. + + + + + The Document Generator meta-container contains all of the elements related to the generation of the document. + + + + + + The name and version of the engine that generated the CVRF document. + + + + + + + + + + The date the CVRF document was generated. + + + + + + + + + + + The Document Notes text contains all of the individual notes necessary to provide different types of low-level discussions of a CVRF document to various audiences. + + + + + + A individual note in freeform text. + + + + + + + Title should be a concise description of what is contained in this specific note. + + + + + Audience will indicate who is intended to read the note. + + + + + Type of content within this note. + + + + + Ordinal is a locally significant integral counter indexed from 1 used to track notes. + + + + + + + + + + + + The Document Distribution string should contain details on constraints, if any, about sharing this CVRF Document with additional recipients. + + + + + + + + + + Aggregate Severity is provided by the producer of the document to convey the urgency and criticality with which the vulnerability or vulnerabilities should be addressed. + + + + + + + URL of the namespace from which the Aggregate Severity is taken. + + + + + + + + + This meta-container should include references to any conferences, papers, advisories, and other resources that are related and considered to be of value to the document consumer. + + + + + + Related documents to the CVRF document. + + + + + + The URL of the related document. + + + + + The description of the related document. + + + + + + + + + + + Enumerated type value of reference relative to this document. + + + + + + + + + + The Acknowledgments container holds one or more Acknowledgement containers for document-level acknowledgements. + + + + + + The Acknowledgment container holds recognition details for external parties, specific to the document as a whole rather than individual vulnerabilities. + + + + + + The name (i.e., individual name) of the party being acknowledged. + + + + + + + + + + The organization of the party being acknowledged or the organization itself being acknowledged. + + + + + + + + + + The details of the acknowledgment that address the recognition of external parties who were instrumental in the discovery, reporting and response of this document. + + + + + + + + + + The optional URL to the person, place, or thing being acknowledged. + + + + + + + + + + + + + + + This is to ensure that each Vulnerability's Ordinal uses a unique value. + + + + + + + This is to ensure that each note has a unique ordinal value. + + + + + + + A key to reference a specific product defined in a referenced product schema. + + + + + + + An instance of the ProductKey to be used in the ProductID element for affected products. + + + + + + + An instance of the ProductKey to be used in the CVSS ScoreSet product references. + + + + + + + An instance of the ProductKey to be used in the Threat product references. + + + + + + + An instance of the ProductKey to be used in the Remediation product references. + + + + + + + A key to reference a specific product group defined in a referenced product schema. + + + + + + + An instance of the GroupKey to be used in the Threat product references. + + + + + + + An instance of the GroupKey to be used in the Remediation product references. + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.2/cvrf.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.2/cvrf.xsd new file mode 100755 index 000000000..dedcb7c76 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.2/cvrf.xsd @@ -0,0 +1,501 @@ + + + + + + + + + + + + + + + + + + + + + This is the XML schema for the main frame model of the OASIS Common Security Advisory Framework (CSAF) TC's CVRF (Common Vulnerability Reporting Framework). + + Feng Cao (feng.cao@oracle.com) + Stefan Hagen (stefan@hagen.link) + 2017-05-24 + CSAF CVRF main frame model + 1.2 + + + + + + + + Types enumerating the status of the document. + + + + + Pre-release, intended for issuing partys internal use only, or possibly used externally when the party is seeking feedback or indicating its intentions regarding a specific issue. + + + + + The issuing party believes the content is subject to change. + + + + + The issuing party asserts the content is unlikely to change. + + + + + + + Floating point number representing the CSAF CVRF specification version + + + + + + + + + + + Root element of a CSAF CVRF document. + + + + + + A definitive canonical name for the document, providing enough descriptive content to differentiate from other similar documents, ideally providing a unique handle. + + + + + + + + + + A short canonical name, chosen by the document producer, which will inform the consumer about the type of the document. + + + + + + + + + + A container holding all information about the publisher of the CSAF CVRF document. + + + + + + Author contact information such as address, phone number, email, etc. + + + + + + + + + + The name of the issuing party and their authority to release the document, in particular, the party's constituency and responsibilities or other obligations. + + + + + + + + + + + Type is an enumerated list containing an array of different document publisher types. + + + + + Vendor ID is a unique identifier (OID) that a vendor uses as issued by FIRST under the auspices of IETF. + + + + + + + The Document Tracking meta-container contains all of the attributes necessary to track a CSAF CVRF document. + + + + + + Contains document ID and optional document aliases + + + + + + Short unique identifier used to refer to the document unambiguously in any context. + + + + + + + + + + Optional alternative ID for document + + + + + + + + + + + + + The condition of the document with regard to completeness and the likelihood of future editions. + + + + + Document Version is a simple counter to track the version of the document. + + + + + The Document Revision History contains one entry for each substantive version of the document, including the initial version and entries for each subsequent update. + + + + + + A set of Version, Date, and Description elements describing one iteration of this document + + + + + + Revision number of this iteration of the document. + + + + + Date when this iteration of the document was released. + + + + + Description of this iteration of the document. + + + + + + + + + + + + + + + + The initial date (and time, optionally) that the document was initially released by the issuing party. + + + + + The current date (and time, optionally) that the document was released by the issuing party. + + + + + The Document Generator meta-container contains all of the elements related to the generation of the document. + + + + + + The name and version of the engine that generated the CSAF CVRF document. + + + + + + + + + + The date the CSAF CVRF document was generated. + + + + + + + + + + + The Document Notes text contains all of the individual notes necessary to provide different types of low-level discussions of a CSAF CVRF document to various audiences. + + + + + + A individual note in freeform text. + + + + + + + Title should be a concise description of what is contained in this specific note. + + + + + Audience will indicate who is intended to read the note. + + + + + Type of content within this note. + + + + + Ordinal is a locally significant integral counter indexed from 1 used to track notes. + + + + + + + + + + + + The Document Distribution string should contain details on constraints, if any, about sharing this CSAF CVRF Document with additional recipients. + + + + + + + + + + Aggregate Severity is provided by the producer of the document to convey the urgency and criticality with which the vulnerability or vulnerabilities should be addressed. + + + + + + + URL of the namespace from which the Aggregate Severity is taken. + + + + + + + + + This meta-container should include references to any conferences, papers, advisories, and other resources that are related and considered to be of value to the document consumer. + + + + + + Related documents to the CSAF CVRF document. + + + + + + The URL of the related document. + + + + + The description of the related document. + + + + + + + + + + + Enumerated type value of reference relative to this document. + + + + + + + + + + The Acknowledgments container holds one or more Acknowledgement containers for document-level acknowledgements. + + + + + + The Acknowledgment container holds recognition details for external parties, specific to the document as a whole rather than individual vulnerabilities. + + + + + + The name (i.e., individual name) of the party being acknowledged. + + + + + + + + + + The organization of the party being acknowledged or the organization itself being acknowledged. + + + + + + + + + + The details of the acknowledgment that address the recognition of external parties who were instrumental in the discovery, reporting and response of this document. + + + + + + + + + + The optional URL to the person, place, or thing being acknowledged. + + + + + + + + + + + + + + + This is to ensure that each Vulnerability's Ordinal uses a unique value. + + + + + + + This is to ensure that each note has a unique ordinal value. + + + + + + + A key to reference a specific product defined in a referenced product schema. + + + + + + + An instance of the ProductKey to be used in the ProductID element for affected products. + + + + + + + An instance of the ProductKey to be used in the CVSS ScoreSet product references. + + + + + + + An instance of the ProductKey to be used in the Threat product references. + + + + + + + An instance of the ProductKey to be used in the Remediation product references. + + + + + + + A key to reference a specific product group defined in a referenced product schema. + + + + + + + An instance of the GroupKey to be used in the Threat product references. + + + + + + + An instance of the GroupKey to be used in the Remediation product references. + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/prod.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/prod.xsd new file mode 100755 index 000000000..4feb771c6 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/prod.xsd @@ -0,0 +1,292 @@ + + + + + + + + + + + + + + + This is the XML schema for the Common Vulnerability Reporting Framework's Product model. For more information, see the CVRF whitepaper. + + Joe Hemmerlein <joe.hemmerlein@microsoft.com> + Joe Clarke <jclarke@cisco.com> + 2012-05-07 + CVRF Product Dictionary + 1.1 + + + + + + + + Types enumerating the individual parts (stubs) that comprise a product name. + + + + + The name of the vendor or manufacturer that makes the product . + + + + + The product family that the product falls into. + + + + + The name of the product. + + + + + The version of the product. This can be a numeric or other descriptor. + + + + + The patch level of the product. + + + + + The service pack of the product. + + + + + The architecture for which the product is intended. + + + + + The language of the product. + + + + + A non-specific legacy entry. + + + + + A specification such as a standard, best common practice, etc. + + + + + The host name of a system/service. + + + + + The URI component of a system/service. + + + + + The file name component of a system/service. + + + + + + + Types enumerating the ways products can be related to each other. + + + + + This product is a default component of the referenced product. + + + + + This product is an optional component of the referenced product. + + + + + This product is an external component of the referenced product. + + + + + This product is installed on the referenced product. + + + + + This product is installed with the referenced product. + + + + + + + + + + + + + + + + + + Neutral product tree to streamline product entries that can be referenced elsewhere in the document. The end of each branch ("FullProductName") represents a referrenceable product. + + + + + + + + Defines how this product is related to another product. + + + + + + + + The ProductReference refers to the unique ProductID of the product that is to which another product will be related. + + + + + The RelationType attribute defines how the two products are related. + + + + + RelatesToProductReference refers to the unique ProductID of the product to which the ProductReference attribute value relates. + + + + + + + Container for grouping products to be used in vulnerabilities. + + + + + + A named container to associate two or more product IDs together for use in vulnerabilities. + + + + + + Optional textual description for this group. + + + + + + + + + + The ID of an existing product in this tree that is to be a member of this group. + + + + + + The unique identifier used to reference this group. + + + + + + + + + + + + This is to ensure that each FullProductName uses a unique ProductID value. + + + + + + + This is to ensure that each Group uses a unique GroupID value. + + + + + + + A key to reference a specific product. + + + + + + + An instance of the ProductKey used to define a relationship product. + + + + + + + An instance of the ProductKey used to define a related product. + + + + + + + An instance of the ProductKey used to define a product group membership list. + + + + + + + + Endpoint of product tree - this is an actual product entry. The string represents the friendly product name (i.e. the way it would be printed in other publications) + + + + + + + A value that uniquely identifies this Product entry in the scope of this document. Whenever a reference to this Product entry is needed anywhere in this document, its unique ID will be referenced. + + + + + The Common Platform Enumeration (CPE) attribute refers to a method for naming platforms. The structure for CPE is described at http://cpe.mitre.org. + + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.2/prod.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.2/prod.xsd new file mode 100755 index 000000000..547fc57e6 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.2/prod.xsd @@ -0,0 +1,343 @@ + + + + + + + + + + + + + + + + + + + This is the XML schema for the Product Tree + sub model of the OASIS Common Security Advisory Framework (CSAF) TC's + CVRF (Common Vulnerability Reporting Framework). + + Feng Cao (feng.cao@oracle.com) + Stefan Hagen (stefan@hagen.link() + 2017-05-24 + CSAF CVRF Product Tree sub model + 1.2 + + + + + + + + Types enumerating the individual parts (stubs) that comprise a + product name. + + + + + The name of the vendor or manufacturer that makes the + product . + + + + + The product family that the product falls + into. + + + + + The name of the product. + + + + + The version of the product. This can be a numeric or other + descriptor. + + + + + The patch level of the product. + + + + + The service pack of the product. + + + + + The architecture for which the product is + intended. + + + + + The language of the product. + + + + + A non-specific legacy entry. + + + + + A specification such as a standard, best common practice, + etc. + + + + + The host name of a system/service. + + + + + The URI component of a system/service. + + + + + The file name component of a + system/service. + + + + + + + Types enumerating the ways products can be related to each + other. + + + + + This product is a default component of the referenced + product. + + + + + This product is an optional component of the referenced + product. + + + + + This product is an external component of the referenced + product. + + + + + This product is installed on the referenced + product. + + + + + This product is installed with the referenced + product. + + + + + + + + + + + + + + + + + + Neutral product tree to streamline product entries that can be + referenced elsewhere in the document. The end of each branch ("FullProductName") represents + a referrenceable product. + + + + + + + + Defines how this product is related to another + product. + + + + + + + + The ProductReference refers to the unique ProductID + of the product that is to which another product will be + related. + + + + + The RelationType attribute defines how the two + products are related. + + + + + RelatesToProductReference refers to the unique + ProductID of the product to which the ProductReference attribute value + relates. + + + + + + + Container for grouping products to be used in + vulnerabilities. + + + + + + A named container to associate two or more product + IDs together for use in vulnerabilities. + + + + + + Optional textual description for this + group. + + + + + + + + + + The ID of an existing product in this tree + that is to be a member of this group. + + + + + + The unique identifier used to reference this + group. + + + + + + + + + + + + This is to ensure that each FullProductName uses a unique + ProductID value. + + + + + + + This is to ensure that each Group uses a unique GroupID + value. + + + + + + + A key to reference a specific product. + + + + + + + An instance of the ProductKey used to define a relationship + product. + + + + + + + An instance of the ProductKey used to define a related + product. + + + + + + + An instance of the ProductKey used to define a product group + membership list. + + + + + + + + Endpoint of product tree - this is an actual product entry. + The string represents the friendly product name (i.e. the way it would be printed in other + publications) + + + + + + + A value that uniquely identifies this Product entry in + the scope of this document. Whenever a reference to this Product entry is needed + anywhere in this document, its unique ID will be referenced. + + + + + The Common Platform Enumeration (CPE) attribute refers + to a method for naming platforms. The structure for CPE is described at + http://cpe.mitre.org. + + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/vuln.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/vuln.xsd new file mode 100755 index 000000000..7e3a1e013 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/vuln.xsd @@ -0,0 +1,631 @@ + + + + + + + + + + + + + + + + This is the XML schema for the Common Vulnerability Reporting Framework's Vulnerability model. For more information, see the CVRF whitepaper. + + Brian Schafer <bschafer@microsoft.com> + Joe Clarke <jclarke@cisco.com> + Joe Hemmerlein <Joe.Hemmerlein@microsoft.com> + 2012-05-07 + CVRF Vulnerability Dictionary + 1.1 + + + + + + + + Types enumerating a party's current engagement status for this vulnerability. + + + + + The party has acknowledged that they are aware of the vulnerability report. + + + + + The party disputes the vulnerability report in its entirety + + + + + Some hot-fixes, permanent fixes, or patches have been made available by the party, but more fixes or patches are going to be released in the future. + + + + + The party asserts that they have completed remediation of the vulnerability. + + + + + The party has been contacted, but was unresponsive or unavailable. + + + + + No contact has been attempted with the party. + + + + + + + String type to match CVE IDs + + + + + + + + String type to match CWE IDs + + + + + + + + String representing the components needed to compute the various CVSS scores + + + + + + + + Types enumerating the affected statuses described by a vulnerability + + + + + The first version known to be affected by this vulnerability. + + + + + This version is the first fixed version for the vulnerability but may not be the recommended fixed version. + + + + + This version is contains a fix for the vulnerability but may not be the recommended fixed version. + + + + + This version is known to be affected by the vulnerability. + + + + + This version is known NOT to be affected by the vulnerability. + + + + + This is the last version in a train known to be affected. Versions released after this would contain a fix for this vulnerability. + + + + + This version has a fix for the vulnerability and is the vendor-recommended version for fixing the vulnerability. + + + + + + + Types enumerating the Threat type described by the vulnerability + + + + + Impact contains an assessment of the impact on the user or the target set if the vulnerability is successful exploited. + + + + + Exploit Status contains a description of the degree to which an exploit for the vulnerability is known. + + + + + Target Set contains a description of the currently known victim population in whatever terms are appropriate. + + + + + + + Types enumerating the Remedy type described by the vulnerability. + + + + + Workaround contains information about a configuration or specific deployment scenario that can be used to avoid exposure to the vulnerability. + + + + + Mitigation contains information about a configuration or deployment scenario that helps to reduce the risk of the vulnerability but that does not resolve the vulnerability on the affected product. + + + + + Vendor Fix contains information about an official fix that is issued by the original author of the affected product. + + + + + Currently there is no fix available. + + + + + There is no fix for the vulnerability and there never will be one. + + + + + + + Existing product ID from the product tree. + + + + + Existing product group ID from the product tree. + + + + + + + + This is a meta-container for the aggregation of all fields that are related to a single vulnerability within the document. + + + + + + Vulnerability Title gives the document producer the ability to apply a canonical name or title to the vulnerability. + + + + + + + + + + Vulnerability ID gives the document producer a place to publish a unique label or tracking ID for the vulnerability (if such information exists). + + + + + + + System Name indicates the name of the vulnerability tracking or numbering system that this vulnerability ID comes from. + + + + + + + + + The Notes container holds all individual notes concerning this vulnerability. + + + + + + The Notes text contains all of the content necessary to provide different types of low-level discussions of a given vulnerability to various audiences. + + + + + + + Title should be a concise description of what is contained in Vulnerability Notes. + + + + + Audience will indicate who is intended to read the note. + + + + + Type of content within this note. + + + + + Ordinal is a locally significant integral counter indexed from 1 used to track notes. + + + + + + + + + + + + Date vulnerability was initially discovered by its original discoverer. + + + + + Date vulnerability was initially released to the public. + + + + + The Involvements container lists any number of vendor or third party interactions related to this vulnerability. + + + + + + Involvement contains a specific set of interaction details. + + + + + + The description of the Involvement. + + + + + + + + + + + Type of party with whom the involvement is taking place. + + + + + Status of the involvement with the specified party. + + + + + + + + + + The CVE string refers to the MITRE standard Common Vulnerabilities Enumeration (CVE) tracking number for the vulnerability. + + + + + Detailed description of the referrenced Common Weakness Enumeration (CWE) identifier. + + + + + + + The MITRE-assigned CWE identifier. + + + + + + + + + The ProductStatuses container holds the list of all the products affected by the vulnerability in question. + + + + + + The Status element holds an enumerated value based on available Product Name Entry items as constructed from the Product Tree container. + + + + + + + + Affected status for the product or products defined in this container. + + + + + + + + + + Contains all Threat containers + + + + + + Threat contains the "kinetic" information associated with a vulnerability. + + + + + + The description of the Threat. + + + + + + + + + + + + + The type of the Threat. + + + + + The date this Threat item was last updated; if omitted it is deemed to be unknown, irrelevant, or unimportant. + + + + + + + + + + The CVSS Score Set meta-container holds one or more CVSS score sets to describe vulnerable products. + + + + + + CVSS scores for a given product ID.  If the ProductID attribute is omitted, the score applies to all vulnerable products. + + + + + + The CVSS Base Score is the numeric value of the computed CVSS Base Score which should be a float from 0 – 10.0. + + + + + The CVSS Base Score is the numeric value of the computed CVSS Temporal Score which should be a float from 0 – 10.0. + + + + + The CVSS Base Score is the numeric value of the computed CVSS Environmental Score which should be a float from 0 – 10.0. + + + + + The CVSS Vector string is the official notation that contains all of the values used to compute the Base, Temporal, and Environmental scores. + + + + + + + + + + + + The Remediation meta-container tag holds all related Workaround, Mitigation, Vendor Fix, and Entitlement entries that are associated with the specific vulnerability. + + + + + + Holds all of the specific details on how to handle (and presumably, fix) the vulnerability, tied to Product ID. + + + + + + Textual description of this remedy. + + + + + + + + + + The Entitlement string will contain any possible vendor-defined constraints for obtaining fixed software or hardware that fully resolves the vulnerability. + + + + + + + + + + URL from which the remedy can be obtained. + + + + + + + + Specific type of remedy. + + + + + The date Remedy was last updated, if omitted it is deemed to be unknown, unimportant, or irrelevant. + + + + + + + + + + This meta-container should include references to any conferences, papers, advisories, and other resources that are related to this vulnerability. + + + + + + This meta-container contains an orthogonally related document, background info, whitepaper, etc. to the specific vulnerability. + + + + + + The URL of the related document. + + + + + The description of the related document. + + + + + + + + + + + Enumerated type value of reference relative to this document. + + + + + + + + + + The Acknowledgments container holds one or more Acknowledgement containers for vulnerability-level acknowledgements. + + + + + + The Acknowledgment container holds recognition for external parties who were instrumental in the discovery of, reporting of, and response to the vulnerability. + + + + + + The name (i.e., individual name) of the party being acknowledged. + + + + + + + + + + The organization of the party being acknowledged or the organization itself being acknowledged. + + + + + + + + + + The details of the acknowledgment that address the recognition of external parties who were instrumental in the discovery, reporting and response of this document. + + + + + + + + + + The optional URL to the person, place, or thing being acknowledged. + + + + + + + + + + + + Locally significant numeric value to track vulnerabilities within a CVRF document. This enables vulnerabilities to be referenced from elsewhere inside the document (often at the document-level) + + + + + + This is to ensure that each product mentions a given ProductID only one. + + + + + + + This is to ensure that each CVSS score set mentions a given ProductID only one. + + + + + + + This is to ensure that each note has a unique ordinal value. + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.2/vuln.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.2/vuln.xsd new file mode 100755 index 000000000..3e39ecc69 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.2/vuln.xsd @@ -0,0 +1,812 @@ + + + + + + + + + + + + + + + + + + + + + + + This is the XML schema for the Vulnerability + sub model of the OASIS Common Security Advisory Framework (CSAF) TC's + CVRF (Common Vulnerability Reporting Framework). + + Art Manion (amanion@cert.org) + Feng Cao (feng.cao@oracle.com) + Harold Booth (harold.booth@nist.gov) + Stefan Hagen (stefan@hagen.link) + Troy Fridley (trfridle@cisco.com) + 2017-05-24 + CSAF CVRF Vulnerability sub model + 1.2 + + + + + + + + Types enumerating a party's current engagement status for this + vulnerability. + + + + + The party has acknowledged that they are aware of the + vulnerability report. + + + + + The party disputes the vulnerability report in its + entirety + + + + + Some hot-fixes, permanent fixes, or patches have been made + available by the party, but more fixes or patches are going to be released in the + future. + + + + + The party asserts that they have completed remediation of + the vulnerability. + + + + + The party has been contacted, but was unresponsive or + unavailable. + + + + + No contact has been attempted with the + party. + + + + + + + String type to match CVE IDs + + + + + + + + String type to match CWE IDs + + + + + + + + String representing the components needed to compute the + various CVSS scores + + + + + + + + String representing the components needed to compute the + various CVSS version 3 scores which can be longer than v2 scores (up to 138 characters). + + + + + + + + Types enumerating the affected statuses described by a + vulnerability + + + + + The first version known to be affected by this + vulnerability. + + + + + This version is the first fixed version for the + vulnerability but may not be the recommended fixed version. + + + + + This version is contains a fix for the vulnerability but + may not be the recommended fixed version. + + + + + This version is known to be affected by the + vulnerability. + + + + + This version is known NOT to be affected by the + vulnerability. + + + + + This is the last version in a train known to be affected. + Versions released after this would contain a fix for this + vulnerability. + + + + + This version has a fix for the vulnerability and is the + vendor-recommended version for fixing the vulnerability. + + + + + + + Types enumerating the Threat type described by the + vulnerability + + + + + Impact contains an assessment of the impact on the user or + the target set if the vulnerability is successful exploited. + + + + + Exploit Status contains a description of the degree to + which an exploit for the vulnerability is known. + + + + + Target Set contains a description of the currently known + victim population in whatever terms are appropriate. + + + + + + + Types enumerating the Remedy type described by the + vulnerability. + + + + + Workaround contains information about a configuration or + specific deployment scenario that can be used to avoid exposure to the + vulnerability. + + + + + Mitigation contains information about a configuration or + deployment scenario that helps to reduce the risk of the vulnerability but that does not + resolve the vulnerability on the affected product. + + + + + Vendor Fix contains information about an official fix that + is issued by the original author of the affected product. + + + + + Currently there is no fix available. + + + + + There is no fix for the vulnerability and there never will + be one. + + + + + + + Existing product ID from the product tree. + + + + + Existing product group ID from the product + tree. + + + + + + + + This is a meta-container for the aggregation of all fields + that are related to a single vulnerability within the document. + + + + + + Vulnerability Title gives the document producer the + ability to apply a canonical name or title to the vulnerability. + + + + + + + + + + Vulnerability ID gives the document producer a place to + publish a unique label or tracking ID for the vulnerability (if such information + exists). + + + + + + + System Name indicates the name of the + vulnerability tracking or numbering system that this vulnerability ID comes + from. + + + + + + + + + The Notes container holds all individual notes + concerning this vulnerability. + + + + + + The Notes text contains all of the content + necessary to provide different types of low-level discussions of a given + vulnerability to various audiences. + + + + + + + Title should be a concise description of + what is contained in Vulnerability Notes. + + + + + Audience will indicate who is intended to + read the note. + + + + + Type of content within this + note. + + + + + Ordinal is a locally significant integral + counter indexed from 1 used to track notes. + + + + + + + + + + + + Date vulnerability was initially discovered by its + original discoverer. + + + + + Date vulnerability was initially released to the + public. + + + + + The Involvements container lists any number of vendor or + third party interactions related to this vulnerability. + + + + + + Involvement contains a specific set of interaction + details. + + + + + + The description of the + Involvement. + + + + + + + + + + + Type of party with whom the involvement is + taking place. + + + + + Status of the involvement with the specified + party. + + + + + + + + + + The CVE string refers to the MITRE standard Common + Vulnerabilities Enumeration (CVE) tracking number for the + vulnerability. + + + + + Detailed description of the referrenced Common Weakness + Enumeration (CWE) identifier. + + + + + + + The MITRE-assigned CWE + identifier. + + + + + + + + + The ProductStatuses container holds the list of all the + products affected by the vulnerability in question. + + + + + + The Status element holds an enumerated value based + on available Product Name Entry items as constructed from the Product Tree + container. + + + + + + + + Affected status for the product or products + defined in this container. + + + + + + + + + + Contains all Threat containers + + + + + + Threat contains the "kinetic" information + associated with a vulnerability. + + + + + + The description of the + Threat. + + + + + + + + + + + + + The type of the Threat. + + + + + The date this Threat item was last updated; if + omitted it is deemed to be unknown, irrelevant, or + unimportant. + + + + + + + + + + The CVSS Score Set meta-container holds one or more CVSS + score sets to describe vulnerable products. + + + + + + + CVSS scores for a given product ID. If the + ProductID attribute is omitted, the score applies to all vulnerable + products. + + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Base Score which should be a float from 0 + 10.0. + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Temporal Score which should be a float from 0 + 10.0. + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Environmental Score which should be a float from 0 + 10.0. + + + + + The CVSS Vector string is the official + notation that contains all of the values used to compute the Base, + Temporal, and Environmental scores. + + + + + + + + + + CVSS scores for a given product ID. If the + ProductID attribute is omitted, the score applies to all vulnerable + products. + + + + + + The CVSS Base Score is the numeric value of the computed CVSS Base Score which should be a float from 0 to 10.0. + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Temporal Score which should be a float from 0 + 10.0. + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Environmental Score which should be a float from 0 + 10.0. + + + + + The CVSS Vector string is the official + notation that contains all of the values used to compute the Base, + Temporal, and Environmental scores. + + + + + + + + + + + + + The Remediation meta-container tag holds all related + Workaround, Mitigation, Vendor Fix, and Entitlement entries that are associated with + the specific vulnerability. + + + + + + Holds all of the specific details on how to handle + (and presumably, fix) the vulnerability, tied to Product ID. + + + + + + Textual description of this + remedy. + + + + + + + + + + The Entitlement string will contain any + possible vendor-defined constraints for obtaining fixed software or + hardware that fully resolves the vulnerability. + + + + + + + + + + URL from which the remedy can be + obtained. + + + + + + + + Specific type of remedy. + + + + + The date Remedy was last updated, if omitted + it is deemed to be unknown, unimportant, or irrelevant. + + + + + + + + + + This meta-container should include references to any + conferences, papers, advisories, and other resources that are related to this + vulnerability. + + + + + + This meta-container contains an orthogonally + related document, background info, whitepaper, etc. to the specific + vulnerability. + + + + + + The URL of the related + document. + + + + + The description of the related + document. + + + + + + + + + + + Enumerated type value of reference relative to + this document. + + + + + + + + + + The Acknowledgments container holds one or more + Acknowledgement containers for vulnerability-level + acknowledgements. + + + + + + The Acknowledgment container holds recognition for + external parties who were instrumental in the discovery of, reporting of, and + response to the vulnerability. + + + + + + The name (i.e., individual name) of the + party being acknowledged. + + + + + + + + + + The organization of the party being + acknowledged or the organization itself being + acknowledged. + + + + + + + + + + The details of the acknowledgment that + address the recognition of external parties who were instrumental in the + discovery, reporting and response of this document. + + + + + + + + + + The optional URL to the person, place, or + thing being acknowledged. + + + + + + + + + + + + Locally significant numeric value to track vulnerabilities + within a CSAF CVRF document. This enables vulnerabilities to be referenced from elsewhere + inside the document (often at the document-level) + + + + + + This is to ensure that each product mentions a given + ProductID only one. + + + + + + + This is to ensure that each CVSS score set mentions a given + ProductID only one per CVSS version 2. + + + + + + + This is to ensure that each CVSS score set mentions a given + ProductID only one per CVSS version 3. + + + + + + + This is to ensure that each note has a unique ordinal + value. + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/vuln/vuln.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/vuln.xsd new file mode 100755 index 000000000..6ec88b7a4 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/vuln.xsd @@ -0,0 +1,817 @@ + + + + + + + + + + + + + + + + + + This is the XML schema for the Vulnerability + sub model of the OASIS Common Security Advisory Framework (CSAF) TC's + CVRF (Common Vulnerability Reporting Framework). + + Art Manion (amanion@cert.org) + Feng Cao (feng.cao@oracle.com) + Harold Booth (harold.booth@nist.gov) + Stefan Hagen (stefan@hagen.link) + Troy Fridley (trfridle@cisco.com) + 2017-05-24 + CSAF CVRF Vulnerability sub model + 1.2 + + + + + + + + Types enumerating a party's current engagement status for this + vulnerability. + + + + + The party has acknowledged that they are aware of the + vulnerability report. + + + + + The party disputes the vulnerability report in its + entirety + + + + + Some hot-fixes, permanent fixes, or patches have been made + available by the party, but more fixes or patches are going to be released in the + future. + + + + + The party asserts that they have completed remediation of + the vulnerability. + + + + + The party has been contacted, but was unresponsive or + unavailable. + + + + + No contact has been attempted with the + party. + + + + + + + String type to match CVE IDs + + + + + + + + String type to match CWE IDs + + + + + + + + String representing the components needed to compute the + various CVSS scores + + + + + + + + String representing the components needed to compute the + various CVSS version 3 scores which can be longer than v2 scores (up to 138 characters). + + + + + + + + Types enumerating the affected statuses described by a + vulnerability + + + + + The first version known to be affected by this + vulnerability. + + + + + This version is the first fixed version for the + vulnerability but may not be the recommended fixed version. + + + + + This version is contains a fix for the vulnerability but + may not be the recommended fixed version. + + + + + This version is known to be affected by the + vulnerability. + + + + + This version is known NOT to be affected by the + vulnerability. + + + + + This is the last version in a train known to be affected. + Versions released after this would contain a fix for this + vulnerability. + + + + + This version has a fix for the vulnerability and is the + vendor-recommended version for fixing the vulnerability. + + + + + + + Types enumerating the Threat type described by the + vulnerability + + + + + Impact contains an assessment of the impact on the user or + the target set if the vulnerability is successful exploited. + + + + + Exploit Status contains a description of the degree to + which an exploit for the vulnerability is known. + + + + + Target Set contains a description of the currently known + victim population in whatever terms are appropriate. + + + + + + + Types enumerating the Remedy type described by the + vulnerability. + + + + + Workaround contains information about a configuration or + specific deployment scenario that can be used to avoid exposure to the + vulnerability. + + + + + Mitigation contains information about a configuration or + deployment scenario that helps to reduce the risk of the vulnerability but that does not + resolve the vulnerability on the affected product. + + + + + Vendor Fix contains information about an official fix that + is issued by the original author of the affected product. + + + + + Currently there is no fix available. + + + + + There is no fix for the vulnerability and there never will + be one. + + + + + + + Existing product ID from the product tree. + + + + + Existing product group ID from the product + tree. + + + + + + + + This is a meta-container for the aggregation of all fields + that are related to a single vulnerability within the document. + + + + + + Vulnerability Title gives the document producer the + ability to apply a canonical name or title to the vulnerability. + + + + + + + + + + Vulnerability ID gives the document producer a place to + publish a unique label or tracking ID for the vulnerability (if such information + exists). + + + + + + + System Name indicates the name of the + vulnerability tracking or numbering system that this vulnerability ID comes + from. + + + + + + + + + The Notes container holds all individual notes + concerning this vulnerability. + + + + + + The Notes text contains all of the content + necessary to provide different types of low-level discussions of a given + vulnerability to various audiences. + + + + + + + Title should be a concise description of + what is contained in Vulnerability Notes. + + + + + Audience will indicate who is intended to + read the note. + + + + + Type of content within this + note. + + + + + Ordinal is a locally significant integral + counter indexed from 1 used to track notes. + + + + + + + + + + + + Date vulnerability was initially discovered by its + original discoverer. + + + + + Date vulnerability was initially released to the + public. + + + + + The Involvements container lists any number of vendor or + third party interactions related to this vulnerability. + + + + + + Involvement contains a specific set of interaction + details. + + + + + + The description of the + Involvement. + + + + + + + + + + + Type of party with whom the involvement is + taking place. + + + + + Status of the involvement with the specified + party. + + + + + + + + + + The CVE string refers to the MITRE standard Common + Vulnerabilities Enumeration (CVE) tracking number for the + vulnerability. + + + + + Detailed description of the referrenced Common Weakness + Enumeration (CWE) identifier. + + + + + + + The MITRE-assigned CWE + identifier. + + + + + + + + + The ProductStatuses container holds the list of all the + products affected by the vulnerability in question. + + + + + + The Status element holds an enumerated value based + on available Product Name Entry items as constructed from the Product Tree + container. + + + + + + + + Affected status for the product or products + defined in this container. + + + + + + + + + + Contains all Threat containers + + + + + + Threat contains the "kinetic" information + associated with a vulnerability. + + + + + + The description of the + Threat. + + + + + + + + + + + + + The type of the Threat. + + + + + The date this Threat item was last updated; if + omitted it is deemed to be unknown, irrelevant, or + unimportant. + + + + + + + + + + The CVSS Score Set meta-container holds one or more CVSS + score sets to describe vulnerable products. + + + + + + + CVSS scores for a given product ID. If the + ProductID attribute is omitted, the score applies to all vulnerable + products. + + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Base Score which should be a float from 0 + 10.0. + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Temporal Score which should be a float from 0 + 10.0. + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Environmental Score which should be a float from 0 + 10.0. + + + + + The CVSS Vector string is the official + notation that contains all of the values used to compute the Base, + Temporal, and Environmental scores. + + + + + + + + + + CVSS scores for a given product ID. If the + ProductID attribute is omitted, the score applies to all vulnerable + products. + + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Base Score which should be a float from 0 + 10.0. + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Temporal Score which should be a float from 0 + 10.0. + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Environmental Score which should be a float from 0 + 10.0. + + + + + The CVSS Vector string is the official + notation that contains all of the values used to compute the Base, + Temporal, and Environmental scores. + + + + + + + + + + + + + The Remediation meta-container tag holds all related + Workaround, Mitigation, Vendor Fix, and Entitlement entries that are associated with + the specific vulnerability. + + + + + + Holds all of the specific details on how to handle + (and presumably, fix) the vulnerability, tied to Product ID. + + + + + + Textual description of this + remedy. + + + + + + + + + + The Entitlement string will contain any + possible vendor-defined constraints for obtaining fixed software or + hardware that fully resolves the vulnerability. + + + + + + + + + + URL from which the remedy can be + obtained. + + + + + + + + Specific type of remedy. + + + + + The date Remedy was last updated, if omitted + it is deemed to be unknown, unimportant, or irrelevant. + + + + + + + + + + This meta-container should include references to any + conferences, papers, advisories, and other resources that are related to this + vulnerability. + + + + + + This meta-container contains an orthogonally + related document, background info, whitepaper, etc. to the specific + vulnerability. + + + + + + The URL of the related + document. + + + + + The description of the related + document. + + + + + + + + + + + Enumerated type value of reference relative to + this document. + + + + + + + + + + The Acknowledgments container holds one or more + Acknowledgement containers for vulnerability-level + acknowledgements. + + + + + + The Acknowledgment container holds recognition for + external parties who were instrumental in the discovery of, reporting of, and + response to the vulnerability. + + + + + + The name (i.e., individual name) of the + party being acknowledged. + + + + + + + + + + The organization of the party being + acknowledged or the organization itself being + acknowledged. + + + + + + + + + + The details of the acknowledgment that + address the recognition of external parties who were instrumental in the + discovery, reporting and response of this document. + + + + + + + + + + The optional URL to the person, place, or + thing being acknowledged. + + + + + + + + + + + + Locally significant numeric value to track vulnerabilities + within a CSAF CVRF document. This enables vulnerabilities to be referenced from elsewhere + inside the document (often at the document-level) + + + + + + This is to ensure that each product mentions a given + ProductID only one. + + + + + + + This is to ensure that each CVSS score set mentions a given + ProductID only one per CVSS version 2. + + + + + + + This is to ensure that each CVSS score set mentions a given + ProductID only one per CVSS version 3. + + + + + + + This is to ensure that each note has a unique ordinal + value. + + + + + + diff --git a/vulnerabilities/scraper/opensuse.py b/vulnerabilities/scraper/opensuse.py new file mode 100755 index 000000000..4af81a4df --- /dev/null +++ b/vulnerabilities/scraper/opensuse.py @@ -0,0 +1,55 @@ +import requests +from bs4 import BeautifulSoup + +from vulnerabilities.scraper.cvrf_parser import cvrf_parser + +base_url = 'http://ftp.suse.com/pub/projects/security/cvrf/' + + +def name_version_split(pkg_name): + last_char = 0 + for i in range(len(pkg_name)): + if pkg_name[i] == '-': + if pkg_name[i + 1].isnumeric() and pkg_name[i - 1].isalpha(): + return (pkg_name[:i], pkg_name[i + 1:]) + + +def get_urls_of_xmls_from_page(base_url): + r = requests.get(base_url) + soup = BeautifulSoup(r.content, 'lxml') + for a_tag in soup.find_all('a', href=True): + if a_tag['href'].endswith('.xml'): + yield base_url + a_tag['href'] + + +def import_vulnerabilities(): + vulnerabilities = [] + vulnerability_dicts = [] + for xml_url in get_urls_of_xmls_from_page(base_url): + vulnerabilities = cvrf_parser.get_data_dict_from_url(xml_url) + for vulnerability in vulnerabilities: + description = vulnerability['Note_Notes'].split('lang:en|')[1] + platform, package = vulnerability['ProductID'].split(':') + if not name_version_split(package): + continue + pkg_name, pkg_version = name_version_split(package) + cve_id = vulnerability['CVE_Vulnerability'] + ref_urls = vulnerability['URL_Reference'] + ref_ids = list( + filter(lambda x: not x.startswith('CVE'), + vulnerability['Description_Reference']) + ) + ref_ids = list(map(lambda x: x.replace(' ', '-').upper(), ref_ids)) + vulnerability_dicts.append( + { + 'description': description, + 'platform': platform, + 'vuln_id': cve_id, + 'package_name': pkg_name, + 'urls': ref_urls, + 'ref_ids': ref_ids, + 'version': pkg_version, + } + ) + + return vulnerability_dicts