From 7ebd8f3baa03a875e2684304c1c5d0b8867429fe Mon Sep 17 00:00:00 2001 From: Shivam Sandbhor Date: Wed, 15 Apr 2020 17:48:15 +0530 Subject: [PATCH 1/8] Add CVRF parser and import opensuse advisories Signed-off-by: Shivam Sandbhor --- vulnerabilities/data_dump.py | 260 +- vulnerabilities/management/commands/import.py | 3 +- .../scraper/cvrf_parser/cvrf_parser.py | 410 ++ .../cvrf_parser/schemata/catalog_1_1.xml | 15 + .../cvrf_parser/schemata/catalog_1_2.xml | 16 + .../schemata/common/.svn/all-wcprops | 5 + .../cvrf_parser/schemata/common/.svn/entries | 31 + .../schemata/common/1.1/.svn/all-wcprops | 11 + .../schemata/common/1.1/.svn/entries | 62 + .../1.1/.svn/text-base/common.xsd.svn-base | 176 + .../schemata/common/1.1/common.xsd | 176 + .../schemata/common/1.2/common.xsd | 206 + .../schemata/cvrf/.svn/all-wcprops | 5 + .../cvrf_parser/schemata/cvrf/.svn/entries | 31 + .../schemata/cvrf/1.1/.svn/all-wcprops | 11 + .../schemata/cvrf/1.1/.svn/entries | 62 + .../cvrf/1.1/.svn/text-base/cvrf.xsd.svn-base | 487 ++ .../schemata/cvrf/1.1/cvrf-rhsa-2012-1591.xml | 3963 +++++++++++++++++ .../cvrf_parser/schemata/cvrf/1.1/cvrf.xsd | 487 ++ .../cvrf_parser/schemata/cvrf/1.2/cvrf.xsd | 501 +++ .../cvrf_parser/schemata/dublincore/dc.xsd | 118 + .../schemata/prod/.svn/all-wcprops | 5 + .../cvrf_parser/schemata/prod/.svn/entries | 31 + .../schemata/prod/1.1/.svn/all-wcprops | 11 + .../schemata/prod/1.1/.svn/entries | 62 + .../prod/1.1/.svn/prop-base/prod.xsd.svn-base | 5 + .../prod/1.1/.svn/text-base/prod.xsd.svn-base | 292 ++ .../cvrf_parser/schemata/prod/1.1/prod.xsd | 292 ++ .../cvrf_parser/schemata/prod/1.2/prod.xsd | 343 ++ .../schemata/scap/cpe-language_2.2a.xsd | 182 + .../cvrf_parser/schemata/scap/cvss-v2_0.9.xsd | 415 ++ .../cvrf_parser/schemata/scap/cvss-v3.0.xsd | 285 ++ .../schemata/scap/scap-core_0.9.xsd | 170 + .../schemata/vuln/.svn/all-wcprops | 5 + .../cvrf_parser/schemata/vuln/.svn/entries | 31 + .../schemata/vuln/1.1/.svn/all-wcprops | 11 + .../schemata/vuln/1.1/.svn/entries | 62 + .../vuln/1.1/.svn/text-base/vuln.xsd.svn-base | 631 +++ .../cvrf_parser/schemata/vuln/1.1/vuln.xsd | 631 +++ .../cvrf_parser/schemata/vuln/1.2/vuln.xsd | 812 ++++ .../cvrf_parser/schemata/vuln/vuln.xsd | 817 ++++ .../cvrf_parser/schemata/w3.org/xml.xsd | 117 + vulnerabilities/scraper/opensuse.py | 56 + 43 files changed, 12138 insertions(+), 164 deletions(-) create mode 100755 vulnerabilities/scraper/cvrf_parser/cvrf_parser.py create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/catalog_1_1.xml create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/catalog_1_2.xml create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/common/.svn/all-wcprops create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/common/.svn/entries create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/all-wcprops create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/entries create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/text-base/common.xsd.svn-base create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/common.xsd create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/common/1.2/common.xsd create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/cvrf/.svn/all-wcprops create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/cvrf/.svn/entries create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/all-wcprops create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/entries create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/text-base/cvrf.xsd.svn-base create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/cvrf-rhsa-2012-1591.xml create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/cvrf.xsd create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.2/cvrf.xsd create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/dublincore/dc.xsd create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/prod/.svn/all-wcprops create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/prod/.svn/entries create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/all-wcprops create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/entries create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/prop-base/prod.xsd.svn-base create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/text-base/prod.xsd.svn-base create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/prod.xsd create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/prod/1.2/prod.xsd create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/scap/cpe-language_2.2a.xsd create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/scap/cvss-v2_0.9.xsd create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/scap/cvss-v3.0.xsd create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/scap/scap-core_0.9.xsd create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/vuln/.svn/all-wcprops create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/vuln/.svn/entries create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/all-wcprops create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/entries create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/text-base/vuln.xsd.svn-base create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/vuln.xsd create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.2/vuln.xsd create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/vuln/vuln.xsd create mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/w3.org/xml.xsd create mode 100755 vulnerabilities/scraper/opensuse.py diff --git a/vulnerabilities/data_dump.py b/vulnerabilities/data_dump.py index f462978f7..403720909 100644 --- a/vulnerabilities/data_dump.py +++ b/vulnerabilities/data_dump.py @@ -29,49 +29,38 @@ from vulnerabilities.models import VulnerabilityReference -def debian_dump(extract_data, base_release='jessie'): +def debian_dump(extract_data, base_release="jessie"): """ Save data scraped from Debian' security tracker. """ for data in extract_data: - vulnerability, _ = Vulnerability.objects.get_or_create( - cve_id=data['cve_id'], - ) + vulnerability, _ = Vulnerability.objects.get_or_create(cve_id=data["cve_id"],) - pkg_name = data['package_name'] + pkg_name = data["package_name"] package = Package.objects.create( name=pkg_name, - type='deb', - namespace='debian', - version=data.get('version', ''), - qualifiers=f'distro={base_release}', + type="deb", + namespace="debian", + version=data.get("version", ""), + qualifiers=f"distro={base_release}", ) - if data['status'] == 'open': - ImpactedPackage.objects.create( - vulnerability=vulnerability, - package=package - ) + if data["status"] == "open": + ImpactedPackage.objects.create(vulnerability=vulnerability, package=package) else: - ResolvedPackage.objects.create( - vulnerability=vulnerability, - package=package - ) + ResolvedPackage.objects.create(vulnerability=vulnerability, package=package) - fixed_version = data.get('fixed_version') + fixed_version = data.get("fixed_version") if fixed_version: package = Package.objects.create( name=pkg_name, - type='deb', - namespace='debian', + type="deb", + namespace="debian", version=fixed_version, - qualifiers=f'distro={base_release}', + qualifiers=f"distro={base_release}", ) - ResolvedPackage.objects.create( - vulnerability=vulnerability, - package=package - ) + ResolvedPackage.objects.create(vulnerability=vulnerability, package=package) def ubuntu_dump(html): @@ -79,247 +68,170 @@ def ubuntu_dump(html): Dump data scraped from Ubuntu's security tracker. """ for data in html: - vulnerability, _ = Vulnerability.objects.get_or_create( - cve_id=data['cve_id'], - ) - package = Package.objects.create( - name=data['package_name'], - type='deb', - namespace='ubuntu' - ) - ImpactedPackage.objects.create( - vulnerability=vulnerability, - package=package - ) + vulnerability, _ = Vulnerability.objects.get_or_create(cve_id=data["cve_id"],) + package = Package.objects.create(name=data["package_name"], type="deb", namespace="ubuntu") + ImpactedPackage.objects.create(vulnerability=vulnerability, package=package) def archlinux_dump(extract_data): """ Save data scraped from archlinux' security tracker. """ - base_url = 'https://security.archlinux.org' + base_url = "https://security.archlinux.org" for avg in extract_data: affected_packages = [] fixed_packages = [] - for package_name in avg['packages']: + for package_name in avg["packages"]: ap, _ = Package.objects.get_or_create( - name=package_name, - type='pacman', - namespace='archlinux', - version=avg['affected'], + name=package_name, type="pacman", namespace="archlinux", version=avg["affected"], ) affected_packages.append(ap) fp, _ = Package.objects.get_or_create( - name=package_name, - type='pacman', - namespace='archlinux', - version=avg['fixed'], + name=package_name, type="pacman", namespace="archlinux", version=avg["fixed"], ) fixed_packages.append(fp) - for cve_id in avg['issues']: - vulnerability, _ = Vulnerability.objects.get_or_create( - cve_id=cve_id, - ) + for cve_id in avg["issues"]: + vulnerability, _ = Vulnerability.objects.get_or_create(cve_id=cve_id,) VulnerabilityReference.objects.create( - vulnerability=vulnerability, - url=f'{base_url}/{cve_id}', + vulnerability=vulnerability, url=f"{base_url}/{cve_id}", ) - avg_name = avg['name'] + avg_name = avg["name"] VulnerabilityReference.objects.create( - vulnerability=vulnerability, - reference_id=avg_name, - url=f'{base_url}/{avg_name}', + vulnerability=vulnerability, reference_id=avg_name, url=f"{base_url}/{avg_name}", ) - for asa in avg['advisories']: + for asa in avg["advisories"]: VulnerabilityReference.objects.create( - vulnerability=vulnerability, - reference_id=asa, - url=f'{base_url}/{asa}', + vulnerability=vulnerability, reference_id=asa, url=f"{base_url}/{asa}", ) for ap in affected_packages: ImpactedPackage.objects.get_or_create( - vulnerability=vulnerability, - package=ap, + vulnerability=vulnerability, package=ap, ) for fp in fixed_packages: ResolvedPackage.objects.get_or_create( - vulnerability=vulnerability, - package=fp, + vulnerability=vulnerability, package=fp, ) def npm_dump(extract_data): for data in extract_data: - package_name = data['package_name'] - advisory = data['advisory'] + package_name = data["package_name"] + advisory = data["advisory"] - for cve_id in data['cve_ids']: - vulnerability, _ = Vulnerability.objects.get_or_create( - cve_id=cve_id, - ) + for cve_id in data["cve_ids"]: + vulnerability, _ = Vulnerability.objects.get_or_create(cve_id=cve_id,) if advisory: VulnerabilityReference.objects.create( - vulnerability=vulnerability, - url=advisory, + vulnerability=vulnerability, url=advisory, ) - for version in data['affected_versions']: + for version in data["affected_versions"]: package_affected = Package.objects.create( - name=package_name, - type='npm', - version=version, + name=package_name, type="npm", version=version, ) ImpactedPackage.objects.create( - vulnerability=vulnerability, - package=package_affected + vulnerability=vulnerability, package=package_affected ) - for version in data['fixed_versions']: + for version in data["fixed_versions"]: package_fixed = Package.objects.create( - name=package_name, - type='npm', - version=version - ) - ResolvedPackage.objects.create( - vulnerability=vulnerability, - package=package_fixed + name=package_name, type="npm", version=version ) + ResolvedPackage.objects.create(vulnerability=vulnerability, package=package_fixed) def ruby_dump(extract_data): for package_data in extract_data: - vulnerability, _ = Vulnerability.objects.get_or_create( - cve_id=package_data['cve_id'] - ) + vulnerability, _ = Vulnerability.objects.get_or_create(cve_id=package_data["cve_id"]) VulnerabilityReference.objects.get_or_create( - vulnerability=vulnerability, - url=package_data['advisory'] + vulnerability=vulnerability, url=package_data["advisory"] ) - for version in package_data['affected_versions']: + for version in package_data["affected_versions"]: affected_package = Package.objects.create( - name=package_data['package_name'], - type='gem', - version=version - ) - ImpactedPackage.objects.create( - vulnerability=vulnerability, - package=affected_package + name=package_data["package_name"], type="gem", version=version ) + ImpactedPackage.objects.create(vulnerability=vulnerability, package=affected_package) - for version in package_data['fixed_versions']: + for version in package_data["fixed_versions"]: unaffected_package = Package.objects.create( - name=package_data['package_name'], - type='gem', - version=version - ) - ResolvedPackage.objects.create( - vulnerability=vulnerability, - package=unaffected_package + name=package_data["package_name"], type="gem", version=version ) + ResolvedPackage.objects.create(vulnerability=vulnerability, package=unaffected_package) def rust_dump(extract_data): for package_data in extract_data: - vulnerability, _ = Vulnerability.objects.get_or_create( - summary=package_data['description'] - ) + vulnerability, _ = Vulnerability.objects.get_or_create(summary=package_data["description"]) VulnerabilityReference.objects.get_or_create( vulnerability=vulnerability, - url=package_data['advisory'], - reference_id=package_data['vuln_id'] + url=package_data["advisory"], + reference_id=package_data["vuln_id"], ) - for version in package_data['affected_versions']: + for version in package_data["affected_versions"]: affected_package = Package.objects.create( - name=package_data['package_name'], - type='cargo', - version=version - ) - ImpactedPackage.objects.create( - vulnerability=vulnerability, - package=affected_package + name=package_data["package_name"], type="cargo", version=version ) + ImpactedPackage.objects.create(vulnerability=vulnerability, package=affected_package) - for version in package_data['fixed_versions']: + for version in package_data["fixed_versions"]: unaffected_package = Package.objects.create( - name=package_data['package_name'], - type='cargo', - version=version - ) - ResolvedPackage.objects.create( - vulnerability=vulnerability, - package=unaffected_package + name=package_data["package_name"], type="cargo", version=version ) + ResolvedPackage.objects.create(vulnerability=vulnerability, package=unaffected_package) def safetydb_dump(extract_data): for package_data in extract_data: - for cve_id in package_data['cve_id']: + for cve_id in package_data["cve_id"]: vulnerability, _ = Vulnerability.objects.get_or_create( - summary=package_data['description'], - cve_id=cve_id + summary=package_data["description"], cve_id=cve_id ) VulnerabilityReference.objects.get_or_create( - vulnerability=vulnerability, - reference_id=package_data['vuln_id'] + vulnerability=vulnerability, reference_id=package_data["vuln_id"] ) - for version in package_data['affected_versions']: + for version in package_data["affected_versions"]: affected_package = Package.objects.create( - name=package_data['package_name'], - type='pypi', - version=version - ) - ImpactedPackage.objects.create( - vulnerability=vulnerability, - package=affected_package + name=package_data["package_name"], type="pypi", version=version ) + ImpactedPackage.objects.create(vulnerability=vulnerability, package=affected_package) - for version in package_data['unaffected_versions']: + for version in package_data["unaffected_versions"]: unaffected_package = Package.objects.create( - name=package_data['package_name'], - type='pypi', - version=version - ) - ResolvedPackage.objects.create( - vulnerability=vulnerability, - package=unaffected_package + name=package_data["package_name"], type="pypi", version=version ) + ResolvedPackage.objects.create(vulnerability=vulnerability, package=unaffected_package) def alpine_linux_dump(data_dicts): for package_data in data_dicts: unaffected_package = Package.objects.create( - name=package_data['package_name'], - type='alpine', - version=package_data['fixed_version'] + name=package_data["package_name"], type="alpine", version=package_data["fixed_version"] ) - for vuln_groups in package_data['vuln_ids']: - if vuln_groups[0].startswith('CVE'): - vulnerability_obj, _ = Vulnerability.objects.get_or_create( - cve_id=vuln_groups[0] - ) + for vuln_groups in package_data["vuln_ids"]: + if vuln_groups[0].startswith("CVE"): + vulnerability_obj, _ = Vulnerability.objects.get_or_create(cve_id=vuln_groups[0]) if len(vuln_groups) == 2: # TODO: Deal with vulnerabilities without cves VulnerabilityReference.objects.get_or_create( - vulnerability=vulnerability_obj, - reference_id=vuln_groups[1] + vulnerability=vulnerability_obj, reference_id=vuln_groups[1] ) else: @@ -327,6 +239,28 @@ def alpine_linux_dump(data_dicts): continue ResolvedPackage.objects.create( - vulnerability=vulnerability_obj, - package=unaffected_package + vulnerability=vulnerability_obj, package=unaffected_package ) + + +def opensuse_dump(extract_data): + + for package_data in extract_data: + vulnerability, _ = Vulnerability.objects.get_or_create(cve_id=package_data["vuln_id"]) + for url in package_data["urls"]: + for suse_id in package_data["ref_ids"]: + # TODO: Enable VulnerabilityReference to store multiple reference_id and + # urls and remove these loops. + VulnerabilityReference.objects.get_or_create( + vulnerability=vulnerability, url=package_data["urls"], reference_id=suse_id + ) + # FIXME: Deal with duplicate package entries + affected_package = Package.objects.create( + name=package_data["package_name"], + type="rpm", + version=package_data["version"], + namespace="opensuse", + ) + # TODO: Add qualifiers of platform and distro once we start using + # JSONField to store qualifiers. + ImpactedPackage.objects.create(vulnerability=vulnerability, package=affected_package) diff --git a/vulnerabilities/management/commands/import.py b/vulnerabilities/management/commands/import.py index 9fabf8339..ffd0d1bf8 100644 --- a/vulnerabilities/management/commands/import.py +++ b/vulnerabilities/management/commands/import.py @@ -25,9 +25,10 @@ from vulnerabilities import data_dump as dd from vulnerabilities.scraper import ( - debian, ubuntu, archlinux, npm, ruby, rust, safety_db, alpine_linux) + debian, ubuntu, archlinux, npm, ruby, rust, safety_db, alpine_linux, opensuse) IMPORTERS = { + 'opensuse': lambda: dd.opensuse_dump(opensuse.import_vulnerabilities()), 'alpinelinux': lambda: dd.alpine_linux_dump(alpine_linux.import_vulnerabilities()), 'safetydb': lambda: dd.safetydb_dump(safety_db.import_vulnerabilities()), 'rust': lambda: dd.rust_dump(rust.import_vulnerabilities()), diff --git a/vulnerabilities/scraper/cvrf_parser/cvrf_parser.py b/vulnerabilities/scraper/cvrf_parser/cvrf_parser.py new file mode 100755 index 000000000..11424cc41 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/cvrf_parser.py @@ -0,0 +1,410 @@ +from argparse import Namespace +from lxml import etree + +class CVRF_Syntax(object): + # CVRF Elements and Namespaces. + CVRF_ARGS = [ + "all", + "DocumentTitle", + "DocumentType", + "DocumentPublisher", + "DocumentTracking", + "DocumentNotes", + "DocumentDistribution", + "AggregateSeverity", + "DocumentReferences", + "Acknowledgments", + ] + + cvrf_versions = ["1.1", "1.2"] + output_formats = ["csv", "html", "txt"] + related_product_tags = [ + "all", + "ProductID", + "Status", + "CVE", + "Title", + "BaseScore", + "Vector", + "TemporalScore", + "Note", + "FullProductName", + "Branch", + "Revision", + "Remediation", + "Acknowledgment", + "Threat", + ] + + VULN_ARGS = [ + "all", + "Title", + "ID", + "Notes", + "DiscoveryDate", + "ReleaseDate", + "Involvements", + "CVE", + "CWE", + "ProductID", + "ProductStatuses", + "Threats", + "CVSSScoreSets", + "Remediations", + "References", + "Acknowledgments", + "Vulnerability", + ] + + PROD_ARGS = [ + "all", + "Branch", + "FullProductName", + "Relationship", + "ProductGroups", + "ProductID", + ] + + def __init__(self, cvrf_version): + # defaults to current cvrf version 1.2 specification unless otherwise + # specified + self.CVRF_SCHEMA = "http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/cs01/schemas/cvrf.xsd" + self.NAMESPACES = { + x.upper(): "{http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/%s}" % x + for x in ("cvrf", "vuln", "prod") + } + self.CVRF_CATALOG = "schemata/catalog_1_2.xml" + self.CVRF_SCHEMA_FILE = "schemata/cvrf/1.2/cvrf.xsd" + + if cvrf_version == "1.1": + self.CVRF_SCHEMA = "http://www.icasi.org/CVRF/schema/cvrf/1.1/cvrf.xsd" + self.NAMESPACES = { + x.upper(): "{http://www.icasi.org/CVRF/schema/%s/1.1}" % x + for x in ("cvrf", "vuln", "prod") + } + self.CVRF_CATALOG = "schemata/catalog_1_1.xml" + self.CVRF_SCHEMA_FILE = "schemata/cvrf/1.1/cvrf.xsd" + + +def get_partial_key_in_dict(key, dict): + for k, v in dict.items(): + if k.startswith(key): + return k + return None + + +def chop_ns_prefix(element): + """ + Return the element of a fully qualified namespace URI + + element: a fully qualified ET element tag + """ + return element[element.rindex("}") + 1:] + + +def get_vulnerability_node(node): + while node is not None: + if chop_ns_prefix(node.tag) == "Vulnerability": + return node + node = node.getparent() + return node + + +def is_productid_node(node): + if node is not None: + tag = chop_ns_prefix(node.tag) + if tag == "ProductID": + return True + return False + + +def has_child_product_nodes(node): + # get the nodes children and check to see if it contains ProductID nodes + children = node.getchildren() + for child in children: + tag = chop_ns_prefix(child.tag) + if tag == "ProductID": + return True + return False + + +def has_child_product_node(node, current_node): + # get the nodes children and check to see if it contains the node matching + # specific ProductID + children = node.getchildren() + for child in children: + tag = chop_ns_prefix(child.tag) + if tag == "ProductID": + if child.text.strip() == current_node.text.strip(): + return True + return False + + +def is_vuln_ns(node, cvrf_version): + tag = chop_ns_prefix(node.tag) + ns = node.tag.replace(tag, "") + + if CVRF_Syntax(cvrf_version).NAMESPACES["VULN"] == ns: + return True + else: + return False + + +def get_product_name_node(cvrf_doc, cvrf_version, product_id): + # Constrain Xpath search to the ProductTree container + for node in cvrf_doc.findall( + ".//" + CVRF_Syntax(cvrf_version).NAMESPACES["PROD"] + "ProductTree" + ): + for child in node.iter(): + if child.attrib and "ProductID" in child.attrib: + if child.attrib["ProductID"] == product_id: + return child + return None + + +def get_related_producttree_values(node, values, current_product_node, cvrf_doc): + if node is not None: + + # climb the xpath node tree to the top capturing all the node values + while node.getparent() is not None: + + # add values for current node + if node.tag and node.text and node.attrib: + tag = chop_ns_prefix(node.tag) + + text = [] + for key in node.attrib: + text.append(key + ":" + node.attrib[key]) + + if node.text: + if len(node.text.strip()) > 0: + text.append(node.text.strip()) + + text = "|".join(text) + if text: + if tag in values: + if isinstance(values[tag], list): + values[tag].append(text) + else: + values[tag] = [values[tag], text] + else: + values[tag] = text + + # climb the tree + node = node.getparent() + + return values + + +def get_related_vulnerability_values(node, values, current_product_node, cvrf_doc): + if node is not None: + children = node.getchildren() + child_index = 0 + + for child in children: + child_index += 1 + + # skip productid nodes + if is_productid_node(child): + continue + + # process the child if no children or has children specific + # properties for product + process_child = False + if len(child.getchildren()) == 0: # element has no children, applies to all elements + process_child = True + + if has_child_product_nodes(child): + if has_child_product_node(child, current_product_node): + process_child = True # has children and applies to desired product id + else: + process_child = ( + True # has children but not for specific product, applies to all elements + ) + + if not process_child: + continue + + if child.tag and child.attrib: + tag = chop_ns_prefix(child.tag) + "_" + \ + chop_ns_prefix(child.getparent().tag) + + text = [] + for key in child.attrib: + text.append(key + ":" + child.attrib[key]) + + if child.text: + if len(child.text.strip()) > 0: + text.append(child.text.strip()) + + text = "|".join(text) + if text: + if tag in values: + if isinstance(values[tag], list): + values[tag].append(text) + else: + values[tag] = [values[tag], text] + else: + values[tag] = text + + if child.tag and child.text and not child.attrib: + tag = chop_ns_prefix(child.tag) + "_" + \ + chop_ns_prefix(child.getparent().tag) + child_tag = chop_ns_prefix(child.tag) + parent_tag = chop_ns_prefix(child.getparent().tag) + text = child.text.strip() + + if text: + # put all elements with same parent tag together + parent_key = get_partial_key_in_dict(parent_tag, values) + if parent_key is not None: + if not isinstance(values[parent_key], list): + values[parent_key] += "|" + child_tag + ":" + text + else: + values[parent_key][-1] += "|" + \ + child_tag + ":" + text + else: + # convert to list when multiple elements exist for same + # tag + if tag in values: + if isinstance(values[tag], list): + values[tag].append(text) + else: + values[tag] = [values[tag], text] + else: + values[tag] = text + + # recursively get the values for the child + values = get_related_vulnerability_values( + child, values, current_product_node, cvrf_doc) + + # include the current product id + if current_product_node.tag and current_product_node.text: + tag = chop_ns_prefix(current_product_node.tag) + text = current_product_node.text.strip() + values[tag] = text + + return values + + +def get_vulnerability_ordinal(node): + ordinal = 0 + while node is not None: + if chop_ns_prefix(node.tag) == "Vulnerability": + ordinal = node.attrib["Ordinal"] + node = node.getparent() + return ordinal + + +def post_process_arglist(arg, namespace, valid_args, cvrf_version): + parsables = [] + + if CVRF_Syntax(cvrf_version).NAMESPACES[namespace] + "all" in arg: + for element in valid_args: + parsables.append(CVRF_Syntax( + cvrf_version).NAMESPACES[namespace] + element) + parsables.remove(CVRF_Syntax( + cvrf_version).NAMESPACES[namespace] + "all") + else: + for element in arg: + parsables.append(element) + + return parsables + + +def cvrf_parse(cvrf_doc, parsables, args, cvrf_version): + """ + Parse a cvrf_doc and return a list of elements as determined by parsables + + cvrf_doc: the serialized CVRF ElementTree object + parsables: list of elements to parse from a CVRF doc + returns: a dictionary of the format {filename:[item, ...]} + """ + items = [] + ordinal_products = {} + + for element in parsables: + for node in cvrf_doc.iter(element): + for child in node.iter(): + + # process vuln productid elements uniquely by productid? + if is_vuln_ns(child, cvrf_version): + if is_productid_node(child) and args.unique_products: + ordinal = get_vulnerability_ordinal(child) + if ordinal not in ordinal_products: + ordinal_products[ordinal] = [] + + product_id = child.text.strip() if child.text else "" + if product_id not in ordinal_products[ordinal]: + ordinal_products[ordinal].append(product_id) + items.append(child) + else: + # capture all non-productid elements + items.append(child) + else: + # capture all non-vuln ns elements + items.append(child) + + # Hardcoded output for now, eventually make this user-tunable + return items # "stdout" + + +def get_data_from_node(cvrf_doc, cvrf_version, node): + """ + Print each XML node + + node: the ElementTree node to be printed + strip_ns: boolean that when true indicates the namespace prefix will be chomped + f: the file to print to (default is stdout) + """ + + related_values = {} + + # should we collect related product elements data? (for vuln prod + # elements only) + if is_vuln_ns(node, cvrf_version) and is_productid_node(node): + vuln_root_node = get_vulnerability_node(node) + related_values = get_related_vulnerability_values( + vuln_root_node, related_values, node, cvrf_doc + ) + product_node = get_product_name_node( + cvrf_doc, cvrf_version, node.text.strip()) + related_values = get_related_producttree_values( + product_node, related_values, node, cvrf_doc + ) + return related_values + + +def get_data_dict_from_url(url, cvrf_version="1.1"): + + file_name = url.split("/")[-1] + if cvrf_version == "1.1": + vuln = ["{http://www.icasi.org/CVRF/schema/vuln/1.1}all"] + + elif cvrf_version == "1.2": + vuln = ["{http://www.icasi.org/CVRF/schema/vuln/1.2}all"] + + schema = "schemata/cvrf/{}/cvrf.xsd".format(cvrf_version) + args = Namespace( + cvrf_version=cvrf_version, + file=file_name, + include_related_product_elements=True, + related_product_tags=["all"], + schema=schema, + unique_products=True, + vuln=vuln, + ) + try: + doc = etree.parse(url, etree.XMLParser(encoding="utf-8")) + parsables = list( + post_process_arglist( + args.vuln, "VULN", CVRF_Syntax( + cvrf_version).VULN_ARGS, cvrf_version + ) + ) + results = cvrf_parse(doc, parsables, args, cvrf_version) + for result in results: + if get_data_from_node(doc, cvrf_version, result): + yield get_data_from_node(doc, cvrf_version, result) + except BaseException: + pass diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/catalog_1_1.xml b/vulnerabilities/scraper/cvrf_parser/schemata/catalog_1_1.xml new file mode 100755 index 000000000..a2b81bee6 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/catalog_1_1.xml @@ -0,0 +1,15 @@ + + + + + + + + + + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/catalog_1_2.xml b/vulnerabilities/scraper/cvrf_parser/schemata/catalog_1_2.xml new file mode 100755 index 000000000..9830047eb --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/catalog_1_2.xml @@ -0,0 +1,16 @@ + + + + + + + + + + + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/common/.svn/all-wcprops b/vulnerabilities/scraper/cvrf_parser/schemata/common/.svn/all-wcprops new file mode 100755 index 000000000..4a73a5f31 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/common/.svn/all-wcprops @@ -0,0 +1,5 @@ +K 25 +svn:wc:ra_dav:version-url +V 49 +/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/common +END diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/common/.svn/entries b/vulnerabilities/scraper/cvrf_parser/schemata/common/.svn/entries new file mode 100755 index 000000000..bf80768c1 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/common/.svn/entries @@ -0,0 +1,31 @@ +10 + +dir +91 +https://subversion.assembla.com/svn/icasi-cvrf/trunk/schemata/common +https://subversion.assembla.com/svn/icasi-cvrf + + + +2012-05-07T17:25:01.568574Z +82 +xorrkaz + + + + + + + + + + + + + + +085eb5b6-75e8-47bc-a513-804b55a9b1a4 + +1.1 +dir + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/all-wcprops b/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/all-wcprops new file mode 100755 index 000000000..39d14f7f6 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/all-wcprops @@ -0,0 +1,11 @@ +K 25 +svn:wc:ra_dav:version-url +V 53 +/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/common/1.1 +END +common.xsd +K 25 +svn:wc:ra_dav:version-url +V 64 +/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/common/1.1/common.xsd +END diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/entries b/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/entries new file mode 100755 index 000000000..ed8027b73 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/entries @@ -0,0 +1,62 @@ +10 + +dir +91 +https://subversion.assembla.com/svn/icasi-cvrf/trunk/schemata/common/1.1 +https://subversion.assembla.com/svn/icasi-cvrf + + + +2012-05-07T17:25:01.568574Z +82 +xorrkaz + + + + + + + + + + + + + + +085eb5b6-75e8-47bc-a513-804b55a9b1a4 + +common.xsd +file + + + + +2012-05-07T19:31:33.000000Z +147cabf59262af5377f122b3103b8e31 +2012-05-07T17:25:01.568574Z +82 +xorrkaz + + + + + + + + + + + + + + + + + + + + + +8547 + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/text-base/common.xsd.svn-base b/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/text-base/common.xsd.svn-base new file mode 100755 index 000000000..df7457546 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/text-base/common.xsd.svn-base @@ -0,0 +1,176 @@ + + + + + + + + + + + + This is the XML schema for the Common Vulerability Reporting Framework's common data types. + + Brian Schafer <bschafer@microsoft.com> + Joe Clarke <jclarke@cisco.com> + Joe Hemmerlein <Joe.Hemmerlein@microsoft.com> + 2012-05-07 + CVRF Common Data Types + 1.1 + + + + + + + + A normalized string type that cannot be empty. + + + + + + + + A string type that cannot be empty. + + + + + + + + String type with an optional language attribute. The default language is English. + + + + + + Locale code used for the string value. The default is "en". + + + + + + + + Normalized string type with an optional language attribute. The default language is English. This string cannot be empty. + + + + + + Locale code used for the string value. The default is "en". + + + + + + + + Dotted string representing the document revision + + + + + + + + Types enumerating the type of reference document + + + + + This document is an external reference to the current vulnerability. + + + + + This document is a reference to this same vulnerability. + + + + + + + Types enumerating the various publishers of a document. + + + + + Developers or maintainers of information system products or services. + + + + + Individuals or organizations that find vulnerabilities or security weaknesses. + + + + + Individuals or organizations that manage a single vendor's response or multiple vendors' responses to a vulnerability, a security flaw, or an incident. + + + + + Everyone using a vendor's product. + + + + + Catchall for everyone else. Currently this includes forwarders, re-publishers, language translators and miscellaneous contributors. + + + + + + + Allowed type values for CVRF notes. + + + + + A general, high-level note (Title may have more information). + + + + + A low-level detailed discussion (Title may have more information). + + + + + A description of something (Title may have more information). + + + + + A summary of something (Title may have more information). + + + + + A list of frequently asked questions. + + + + + Any possible legal discussion, including constraints, surrounding the document. + + + + + Something that doesn’t fit (Title should have more information). + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/common.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/common.xsd new file mode 100755 index 000000000..df7457546 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/common.xsd @@ -0,0 +1,176 @@ + + + + + + + + + + + + This is the XML schema for the Common Vulerability Reporting Framework's common data types. + + Brian Schafer <bschafer@microsoft.com> + Joe Clarke <jclarke@cisco.com> + Joe Hemmerlein <Joe.Hemmerlein@microsoft.com> + 2012-05-07 + CVRF Common Data Types + 1.1 + + + + + + + + A normalized string type that cannot be empty. + + + + + + + + A string type that cannot be empty. + + + + + + + + String type with an optional language attribute. The default language is English. + + + + + + Locale code used for the string value. The default is "en". + + + + + + + + Normalized string type with an optional language attribute. The default language is English. This string cannot be empty. + + + + + + Locale code used for the string value. The default is "en". + + + + + + + + Dotted string representing the document revision + + + + + + + + Types enumerating the type of reference document + + + + + This document is an external reference to the current vulnerability. + + + + + This document is a reference to this same vulnerability. + + + + + + + Types enumerating the various publishers of a document. + + + + + Developers or maintainers of information system products or services. + + + + + Individuals or organizations that find vulnerabilities or security weaknesses. + + + + + Individuals or organizations that manage a single vendor's response or multiple vendors' responses to a vulnerability, a security flaw, or an incident. + + + + + Everyone using a vendor's product. + + + + + Catchall for everyone else. Currently this includes forwarders, re-publishers, language translators and miscellaneous contributors. + + + + + + + Allowed type values for CVRF notes. + + + + + A general, high-level note (Title may have more information). + + + + + A low-level detailed discussion (Title may have more information). + + + + + A description of something (Title may have more information). + + + + + A summary of something (Title may have more information). + + + + + A list of frequently asked questions. + + + + + Any possible legal discussion, including constraints, surrounding the document. + + + + + Something that doesn’t fit (Title should have more information). + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/common/1.2/common.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/common/1.2/common.xsd new file mode 100755 index 000000000..a6342cdd7 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/common/1.2/common.xsd @@ -0,0 +1,206 @@ + + + + + + + + + + + + + This is the XML schema for data types shared by the domain + specific schemas of the OASIS Common Security Advisory Framework (CSAF) TC's + CVRF (Common Vulnerability Reporting Framework). + + Feng Cao (feng.cao@oracle.com) + Stefan Hagen (stefan@hagen.link) + 2017-05-24 + CSAF CVRF Common Data Types + 1.2 + + + + + + + + A normalized string type that cannot be + empty. + + + + + + + + A string type that cannot be empty. + + + + + + + + String type with an optional language attribute. The default + language is English. + + + + + + Locale code used for the string value. The default is + "en". + + + + + + + + Normalized string type with an optional language attribute. + The default language is English. This string cannot be empty. + + + + + + Locale code used for the string value. The default is + "en". + + + + + + + + Dotted string representing the document + revision + + + + + + + + Types enumerating the type of reference + document + + + + + This document is an external reference to the current + vulnerability. + + + + + This document is a reference to this same + vulnerability. + + + + + + + Types enumerating the various publishers of a + document. + + + + + Developers or maintainers of information system products + or services. + + + + + Individuals or organizations that find vulnerabilities or + security weaknesses. + + + + + Individuals or organizations that manage a single vendor's + response or multiple vendors' responses to a vulnerability, a security flaw, or an + incident. + + + + + Everyone using a vendor's product. + + + + + Catchall for everyone else. Currently this includes + forwarders, re-publishers, language translators and miscellaneous + contributors. + + + + + + + Allowed type values for CSAF CVRF notes. + + + + + A general, high-level note (Title may have more + information). + + + + + A low-level detailed discussion (Title may have more + information). + + + + + A description of something (Title may have more + information). + + + + + A summary of something (Title may have more + information). + + + + + A list of frequently asked questions. + + + + + Any possible legal discussion, including constraints, + surrounding the document. + + + + + Something that doesnt fit (Title should have more + information). + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/.svn/all-wcprops b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/.svn/all-wcprops new file mode 100755 index 000000000..9443e9aca --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/.svn/all-wcprops @@ -0,0 +1,5 @@ +K 25 +svn:wc:ra_dav:version-url +V 47 +/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/cvrf +END diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/.svn/entries b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/.svn/entries new file mode 100755 index 000000000..e7bf1ead4 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/.svn/entries @@ -0,0 +1,31 @@ +10 + +dir +91 +https://subversion.assembla.com/svn/icasi-cvrf/trunk/schemata/cvrf +https://subversion.assembla.com/svn/icasi-cvrf + + + +2012-05-07T17:25:01.568574Z +82 +xorrkaz + + + + + + + + + + + + + + +085eb5b6-75e8-47bc-a513-804b55a9b1a4 + +1.1 +dir + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/all-wcprops b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/all-wcprops new file mode 100755 index 000000000..ed7fb2a6c --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/all-wcprops @@ -0,0 +1,11 @@ +K 25 +svn:wc:ra_dav:version-url +V 51 +/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/cvrf/1.1 +END +cvrf.xsd +K 25 +svn:wc:ra_dav:version-url +V 60 +/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/cvrf/1.1/cvrf.xsd +END diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/entries b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/entries new file mode 100755 index 000000000..7d99cfda3 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/entries @@ -0,0 +1,62 @@ +10 + +dir +91 +https://subversion.assembla.com/svn/icasi-cvrf/trunk/schemata/cvrf/1.1 +https://subversion.assembla.com/svn/icasi-cvrf + + + +2012-05-07T17:25:01.568574Z +82 +xorrkaz + + + + + + + + + + + + + + +085eb5b6-75e8-47bc-a513-804b55a9b1a4 + +cvrf.xsd +file + + + + +2012-05-07T19:31:33.000000Z +ef42ad30fddcf86a18ad5833962d5011 +2012-05-07T17:25:01.568574Z +82 +xorrkaz + + + + + + + + + + + + + + + + + + + + + +27764 + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/text-base/cvrf.xsd.svn-base b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/text-base/cvrf.xsd.svn-base new file mode 100755 index 000000000..b4153b9fe --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/text-base/cvrf.xsd.svn-base @@ -0,0 +1,487 @@ + + + + + + + + + + + + + + This is the XML schema for the Common Vulnerability Reporting Framework. For more information, see the CVRF whitepaper. + + Brian Schafer <bschafer@microsoft.com> + Joe Clarke <jclarke@cisco.com> + Joe Hemmerlein <Joe.Hemmerlein@microsoft.com> + 2012-05-07 + CVRF Dictionary + 1.1 + + + + + + + + Types enumerating the status of the document. + + + + + Pre-release, intended for issuing party’s internal use only, or possibly used externally when the party is seeking feedback or indicating its intentions regarding a specific issue. + + + + + The issuing party believes the content is subject to change. + + + + + The issuing party asserts the content is unlikely to change. + + + + + + + Floating point number representing the CVRF specification version + + + + + + + + + + + Root element of a CVRF document. + + + + + + A definitive canonical name for the document, providing enough descriptive content to differentiate from other similar documents, ideally providing a unique “handle”. + + + + + + + + + + A short canonical name, chosen by the document producer, which will inform the consumer about the type of the document. + + + + + + + + + + A container holding all information about the publisher of the CVRF document. + + + + + + Author contact information such as address, phone number, email, etc. + + + + + + + + + + The name of the issuing party and their authority to release the document, in particular, the party's constituency and responsibilities or other obligations. + + + + + + + + + + + Type is an enumerated list containing an array of different document publisher types. + + + + + Vendor ID is a unique identifier (OID) that a vendor uses as issued by FIRST under the auspices of IETF. + + + + + + + The Document Tracking meta-container contains all of the attributes necessary to track a CVRF document. + + + + + + Contains document ID and optional document aliases + + + + + + Short unique identifier used to refer to the document unambiguously in any context. + + + + + + + + + + Optional alternative ID for document + + + + + + + + + + + + + The condition of the document with regard to completeness and the likelihood of future editions. + + + + + Document Version is a simple counter to track the version of the document. + + + + + The Document Revision History contains one entry for each substantive version of the document, including the initial version and entries for each subsequent update. + + + + + + A set of Version, Date, and Description elements describing one iteration of this document + + + + + + Revision number of this iteration of the document. + + + + + Date when this iteration of the document was released. + + + + + Description of this iteration of the document. + + + + + + + + + + + + + + + + The initial date (and time, optionally) that the document was initially released by the issuing party. + + + + + The current date (and time, optionally) that the document was released by the issuing party. + + + + + The Document Generator meta-container contains all of the elements related to the generation of the document. + + + + + + The name and version of the engine that generated the CVRF document. + + + + + + + + + + The date the CVRF document was generated. + + + + + + + + + + + The Document Notes text contains all of the individual notes necessary to provide different types of low-level discussions of a CVRF document to various audiences. + + + + + + A individual note in freeform text. + + + + + + + Title should be a concise description of what is contained in this specific note. + + + + + Audience will indicate who is intended to read the note. + + + + + Type of content within this note. + + + + + Ordinal is a locally significant integral counter indexed from 1 used to track notes. + + + + + + + + + + + + The Document Distribution string should contain details on constraints, if any, about sharing this CVRF Document with additional recipients. + + + + + + + + + + Aggregate Severity is provided by the producer of the document to convey the urgency and criticality with which the vulnerability or vulnerabilities should be addressed. + + + + + + + URL of the namespace from which the Aggregate Severity is taken. + + + + + + + + + This meta-container should include references to any conferences, papers, advisories, and other resources that are related and considered to be of value to the document consumer. + + + + + + Related documents to the CVRF document. + + + + + + The URL of the related document. + + + + + The description of the related document. + + + + + + + + + + + Enumerated type value of reference relative to this document. + + + + + + + + + + The Acknowledgments container holds one or more Acknowledgement containers for document-level acknowledgements. + + + + + + The Acknowledgment container holds recognition details for external parties, specific to the document as a whole rather than individual vulnerabilities. + + + + + + The name (i.e., individual name) of the party being acknowledged. + + + + + + + + + + The organization of the party being acknowledged or the organization itself being acknowledged. + + + + + + + + + + The details of the acknowledgment that address the recognition of external parties who were instrumental in the discovery, reporting and response of this document. + + + + + + + + + + The optional URL to the person, place, or thing being acknowledged. + + + + + + + + + + + + + + + This is to ensure that each Vulnerability's Ordinal uses a unique value. + + + + + + + This is to ensure that each note has a unique ordinal value. + + + + + + + A key to reference a specific product defined in a referenced product schema. + + + + + + + An instance of the ProductKey to be used in the ProductID element for affected products. + + + + + + + An instance of the ProductKey to be used in the CVSS ScoreSet product references. + + + + + + + An instance of the ProductKey to be used in the Threat product references. + + + + + + + An instance of the ProductKey to be used in the Remediation product references. + + + + + + + A key to reference a specific product group defined in a referenced product schema. + + + + + + + An instance of the GroupKey to be used in the Threat product references. + + + + + + + An instance of the GroupKey to be used in the Remediation product references. + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/cvrf-rhsa-2012-1591.xml b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/cvrf-rhsa-2012-1591.xml new file mode 100755 index 000000000..3be7aaafc --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/cvrf-rhsa-2012-1591.xml @@ -0,0 +1,3963 @@ + + + Red Hat Security Advisory: JBoss Enterprise Application Platform 6.0.1 update + Security Advisory + + secalert@redhat.com + Red Hat Security Response Team + + + RHSA-2012:1591 + Final + 1 + + + 1 + 2012-12-18T21:29:00Z + Current version + + + 2012-12-18T21:30:00Z + 2012-12-18T21:29:00Z + + Red Hat rhsa-to-cvrf 1.0.1484 + 2012-12-18T22:22:02Z + + + + +Updated JBoss Enterprise Application Platform 6.0.1 packages that fix +multiple security issues, various bugs, and add enhancements are now +available for Red Hat Enterprise Linux 5. + +The Red Hat Security Response Team has rated this update as having +important security impact. Common Vulnerability Scoring System (CVSS) base +scores, which give detailed severity ratings, are available for each +vulnerability from the CVE links in the References section. + +JBoss Enterprise Application Platform 6 is a platform for Java applications +based on JBoss Application Server 7. + +This release serves as a replacement for JBoss Enterprise Application +Platform 6.0.0, and includes bug fixes and enhancements. Refer to the 6.0.1 +Release Notes for information on the most significant of these changes, +available shortly from https://access.redhat.com/knowledge/docs/ + +This update removes unused signed JARs; unused SHA1 checksums from JAR +MANIFEST.MF files to reduce the Server memory footprint; adds MANIFEST.MF +to JAR files where it was previously missing; and removes redundant Javadoc +files from the main packages. (BZ#853551) + +Security fixes: + +Apache CXF checked to ensure XML elements were signed or encrypted by a +Supporting Token, but not whether the correct token was used. A remote +attacker could transmit confidential information without the appropriate +security, and potentially circumvent access controls on web services +exposed via Apache CXF. (CVE-2012-2379) + +When using role-based authorization to configure EJB access, JACC +permissions should be used to determine access; however, due to a flaw the +configured authorization modules (JACC, XACML, etc.) were not called, and +the JACC permissions were not used to determine access to an EJB. +(CVE-2012-4550) + +A flaw in the way Apache CXF enforced child policies of WS-SecurityPolicy +1.1 on the client side could, in certain cases, lead to a client failing to +sign or encrypt certain elements as directed by the security policy, +leading to information disclosure and insecure information transmission. +(CVE-2012-2378) + +A flaw was found in the way IronJacamar authenticated credentials and +returned a valid datasource connection when configured to +"allow-multiple-users". A remote attacker, provided the correct subject, +could obtain a datasource connection that might belong to a privileged +user. (CVE-2012-3428) + +It was found that Apache CXF was vulnerable to SOAPAction spoofing attacks +under certain conditions. Note that WS-Policy validation is performed +against the operation being invoked, and an attack must pass validation to +be successful. (CVE-2012-3451) + +When there are no allowed roles for an EJB method invocation, the +invocation should be denied for all users. It was found that the +processInvocation() method in +org.jboss.as.ejb3.security.AuthorizationInterceptor incorrectly authorizes +all method invocations to proceed when the list of allowed roles is empty. +(CVE-2012-4549) + +It was found that in Mojarra, the FacesContext that is made available +during application startup is held in a ThreadLocal. The reference is not +properly cleaned up in all cases. As a result, if a JavaServer Faces (JSF) +WAR calls FacesContext.getCurrentInstance() during application startup, +another WAR can get access to the leftover context and thus get access to +the other WAR's resources. A local attacker could use this flaw to access +another WAR's resources using a crafted, deployed application. +(CVE-2012-2672) + +An input sanitization flaw was found in the mod_negotiation Apache HTTP +Server module. A remote attacker able to upload or create files with +arbitrary names in a directory that has the MultiViews options enabled, +could use this flaw to conduct cross-site scripting attacks against users +visiting the site. (CVE-2008-0455, CVE-2012-2687) + +Red Hat would like to thank the Apache CXF project for reporting +CVE-2012-2379, CVE-2012-2378, and CVE-2012-3451. The CVE-2012-4550 issue +was discovered by Josef Cacek of the Red Hat JBoss EAP Quality Engineering +team; CVE-2012-3428 and CVE-2012-4549 were discovered by Arun Neelicattu of +the Red Hat Security Response Team; and CVE-2012-2672 was discovered by +Marek Schmidt and Stan Silvert of Red Hat. + +Warning: Before applying this update, back up your existing JBoss +Enterprise Application Platform installation and deployed applications. +Refer to the Solution section for further details. + Please see https://www.redhat.com/footer/terms-of-use.html + + Copyright © 2012 Red Hat, Inc. All rights reserved. + Important + + + https://rhn.redhat.com/errata/RHSA-2012-1591.html + https://rhn.redhat.com/errata/RHSA-2012-1591.html + + + https://access.redhat.com/security/updates/classification/#important + https://access.redhat.com/security/updates/classification/#important + + + https://access.redhat.com/knowledge/docs/ + https://access.redhat.com/knowledge/docs/ + + + + + + JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + + antlr-eap6-2.7.7-15_redhat_2.ep6.el5.src.rpm + + + apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5.src.rpm + + + apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4.src.rpm + + + apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1.src.rpm + + + apache-commons-collections-3.2.1-10.redhat_2.ep6.el5.src.rpm + + + apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1.src.rpm + + + apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5.src.rpm + + + apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5.src.rpm + + + apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1.src.rpm + + + apache-commons-lang-2.6-3.redhat_2.ep6.el5.src.rpm + + + apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1.src.rpm + + + apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1.src.rpm + + + apache-cxf-2.4.9-4.redhat_2.ep6.el5.src.rpm + + + apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4.src.rpm + + + apache-mime4j-0.6-7.redhat_2.ep6.el5.5.src.rpm + + + atinject-1-8.2_redhat_2.ep6.el5.5.src.rpm + + + cal10n-0.7.3-8.redhat_2.ep6.el5.5.src.rpm + + + codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5.src.rpm + + + dom4j-1.6.1-14_redhat_3.ep6.el5.src.rpm + + + glassfish-jaf-1.1.1-16.redhat_2.ep6.el5.src.rpm + + + glassfish-javamail-1.4.4-16.redhat_2.ep6.el5.src.rpm + + + glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5.src.rpm + + + glassfish-jsf-2.1.13-1_redhat_1.ep6.el5.src.rpm + + + glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5.src.rpm + + + gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5.src.rpm + + + guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6.src.rpm + + + h2database-1.3.168-2_redhat_1.ep6.el5.src.rpm + + + hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3.src.rpm + + + hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4.src.rpm + + + hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3.src.rpm + + + hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5.src.rpm + + + hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4.src.rpm + + + hornetq-2.2.23-1.Final_redhat_1.ep6.el5.src.rpm + + + hornetq-native-2.2.21-1.1.Final.ep6.el5.src.rpm + + + httpcomponents-5-4_redhat_2.ep6.el5.src.rpm + + + httpd-2.2.22-14.ep6.el5.src.rpm + + + httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3.src.rpm + + + infinispan-5.1.8-1.Final_redhat_1.ep6.el5.src.rpm + + + ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5.src.rpm + + + jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3.src.rpm + + + jandex-1.0.3-7.Final_redhat_2.ep6.el5.2.src.rpm + + + javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3.src.rpm + + + jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3.src.rpm + + + jaxen-1.1.3-8.redhat_2.ep6.el5.4.src.rpm + + + jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3.src.rpm + + + jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3.src.rpm + + + jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5.src.rpm + + + jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3.src.rpm + + + jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2.src.rpm + + + jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3.src.rpm + + + jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5.src.rpm + + + jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2.src.rpm + + + jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5.src.rpm + + + jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5.src.rpm + + + jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5.src.rpm + + + jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5.src.rpm + + + jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5.src.rpm + + + jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5.src.rpm + + + jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5.src.rpm + + + jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5.src.rpm + + + jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5.src.rpm + + + jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5.src.rpm + + + jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5.src.rpm + + + jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5.src.rpm + + + jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5.src.rpm + + + jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4.src.rpm + + + jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5.src.rpm + + + jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5.src.rpm + + + jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5.src.rpm + + + jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5.src.rpm + + + jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1.src.rpm + + + jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5.src.rpm + + + jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5.src.rpm + + + jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5.src.rpm + + + jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5.src.rpm + + + jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5.src.rpm + + + jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5.src.rpm + + + jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5.src.rpm + + + jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5.src.rpm + + + jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5.src.rpm + + + jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5.src.rpm + + + jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5.src.rpm + + + jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5.src.rpm + + + jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1.src.rpm + + + jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5.src.rpm + + + jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2.src.rpm + + + jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1.src.rpm + + + jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5.src.rpm + + + jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7.src.rpm + + + jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5.src.rpm + + + jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5.src.rpm + + + jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5.src.rpm + + + jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5.src.rpm + + + jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5.src.rpm + + + jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5.src.rpm + + + jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5.src.rpm + + + jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5.src.rpm + + + jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5.src.rpm + + + jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5.src.rpm + + + jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5.src.rpm + + + jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5.src.rpm + + + jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5.src.rpm + + + jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5.src.rpm + + + jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1.src.rpm + + + jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5.src.rpm + + + jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5.src.rpm + + + jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5.src.rpm + + + jbossts-4.16.6-1.Final_redhat_1.ep6.el5.src.rpm + + + jbossweb-7.0.17-1.Final_redhat_1.ep6.el5.src.rpm + + + jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3.src.rpm + + + jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5.src.rpm + + + jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5.src.rpm + + + jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5.src.rpm + + + jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5.src.rpm + + + jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5.src.rpm + + + jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3.src.rpm + + + jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5.src.rpm + + + jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5.src.rpm + + + jettison-1.3.1-7_redhat_2.ep6.el5.src.rpm + + + jgroups-3.0.14-2.Final_redhat_1.ep6.el5.src.rpm + + + jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4.src.rpm + + + joda-time-1.6.2-5.redhat_3.ep6.el5.4.src.rpm + + + jtype-0.1.1-9_redhat_2.3.ep6.el5.4.src.rpm + + + juddi-3.1.3-3_redhat_2.1.ep6.el5.3.src.rpm + + + jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2.src.rpm + + + jython-eap6-2.5.2-5.redhat_2.ep6.el5.4.src.rpm + + + log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4.src.rpm + + + log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5.src.rpm + + + mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5.src.rpm + + + mod_cluster-native-1.2.3-3.Final.ep6.el5.src.rpm + + + mod_jk-1.2.36-5.1.ep6.el5.src.rpm + + + netty-3.2.6-2_redhat_2.2.ep6.el5.4.src.rpm + + + objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3.src.rpm + + + org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5.src.rpm + + + org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5.src.rpm + + + org.osgi-4.2.0-4.redhat_2.ep6.el5.3.src.rpm + + + picketbox-4.0.14-2.Final_redhat_2.ep6.el5.src.rpm + + + picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3.src.rpm + + + picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5.src.rpm + + + relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4.src.rpm + + + resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3.src.rpm + + + rngom-201103-0.5.redhat_2.ep6.el5.4.src.rpm + + + scannotation-1.0.2-8.redhat_2.ep6.el5.2.src.rpm + + + shrinkwrap-1.0.0-16.redhat_2.ep6.el5.src.rpm + + + slf4j-eap6-1.6.1-23.redhat_2.ep6.el5.src.rpm + + + slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2.src.rpm + + + snakeyaml-1.8-8.redhat_2.ep6.el5.2.src.rpm + + + staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2.src.rpm + + + stilts-0.1.26-6.GA.redhat_2.ep6.el5.4.src.rpm + + + sun-codemodel-2.6-3_redhat_2.ep6.el5.3.src.rpm + + + sun-istack-commons-2.6.1-9_redhat_2.ep6.el5.src.rpm + + + sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3.src.rpm + + + sun-txw2-20110809-6_redhat_2.ep6.el5.4.src.rpm + + + sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4.src.rpm + + + sun-xsom-20110809-5_redhat_3.ep6.el5.3.src.rpm + + + tomcat-native-1.1.24-1.1.ep6.el5.src.rpm + + + velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4.src.rpm + + + weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5.src.rpm + + + weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1.src.rpm + + + woodstox-core-4.1.1-1.redhat_2.ep6.el5.4.src.rpm + + + ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5.src.rpm + + + ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5.src.rpm + + + ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5.src.rpm + + + wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5.src.rpm + + + wss4j-1.6.7-1.redhat_1.ep6.el5.src.rpm + + + xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2.src.rpm + + + xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5.src.rpm + + + xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3.src.rpm + + + xml-security-1.5.2-2.redhat_1.ep6.el5.src.rpm + + + xom-1.2.7-1._redhat_3.1.ep6.el5.6.src.rpm + + + antlr-eap6-2.7.7-15_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-collections-3.2.1-10.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-lang-2.6-3.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-cxf-2.4.9-4.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + apache-mime4j-0.6-7.redhat_2.ep6.el5.5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + atinject-1-8.2_redhat_2.ep6.el5.5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + cal10n-0.7.3-8.redhat_2.ep6.el5.5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + dom4j-1.6.1-14_redhat_3.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + glassfish-jaf-1.1.1-16.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + glassfish-javamail-1.4.4-16.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + glassfish-jsf-2.1.13-1_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + h2database-1.3.168-2_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + hornetq-2.2.23-1.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + hornetq-native-2.2.21-1.1.Final.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + httpcomponents-5-4_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + httpd-2.2.22-14.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + infinispan-5.1.8-1.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jandex-1.0.3-7.Final_redhat_2.ep6.el5.2 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jaxen-1.1.3-8.redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossts-4.16.6-1.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossweb-7.0.17-1.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jettison-1.3.1-7_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jgroups-3.0.14-2.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + joda-time-1.6.2-5.redhat_3.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jtype-0.1.1-9_redhat_2.3.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + juddi-3.1.3-3_redhat_2.1.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + jython-eap6-2.5.2-5.redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + mod_cluster-native-1.2.3-3.Final.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + mod_jk-1.2.36-5.1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + netty-3.2.6-2_redhat_2.2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + org.osgi-4.2.0-4.redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + picketbox-4.0.14-2.Final_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + rngom-201103-0.5.redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + scannotation-1.0.2-8.redhat_2.ep6.el5.2 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + shrinkwrap-1.0.0-16.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + slf4j-eap6-1.6.1-23.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + snakeyaml-1.8-8.redhat_2.ep6.el5.2 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + stilts-0.1.26-6.GA.redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + sun-codemodel-2.6-3_redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + sun-istack-commons-2.6.1-9_redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + sun-txw2-20110809-6_redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + sun-xsom-20110809-5_redhat_3.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + tomcat-native-1.1.24-1.1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + woodstox-core-4.1.1-1.redhat_2.ep6.el5.4 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + wss4j-1.6.7-1.redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + xml-security-1.5.2-2.redhat_1.ep6.el5 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + xom-1.2.7-1._redhat_3.1.ep6.el5.6 as a component of JBoss Enterprise Application Platform 6 for RHEL 5 Server + + + + + An input sanitization flaw was found in the mod_negotiation Apache HTTP Server module. A remote attacker able to upload or create files with arbitrary names in a directory that has the MultiViews options enabled, could use this flaw to conduct cross-site scripting attacks against users visiting the site. + 2012-08-21T00:00:00Z + 2012-06-13T00:00:00Z + + CVE-2008-0455 + + 5Server-JBEAP-6:antlr-eap6-2.7.7-15_redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-collections-3.2.1-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5 + 5Server-JBEAP-6:apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-lang-2.6-3.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-cxf-2.4.9-4.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-mime4j-0.6-7.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:atinject-1-8.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:cal10n-0.7.3-8.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:dom4j-1.6.1-14_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jaf-1.1.1-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-javamail-1.4.4-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf-2.1.13-1_redhat_1.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5 + 5Server-JBEAP-6:gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6 + 5Server-JBEAP-6:h2database-1.3.168-2_redhat_1.ep6.el5 + 5Server-JBEAP-6:hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hornetq-2.2.23-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:hornetq-native-2.2.21-1.1.Final.ep6.el5 + 5Server-JBEAP-6:httpcomponents-5-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:httpd-2.2.22-14.ep6.el5 + 5Server-JBEAP-6:httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:infinispan-5.1.8-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jandex-1.0.3-7.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxen-1.1.3-8.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5 + 5Server-JBEAP-6:jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1 + 5Server-JBEAP-6:jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5 + 5Server-JBEAP-6:jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7 + 5Server-JBEAP-6:jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1 + 5Server-JBEAP-6:jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossts-4.16.6-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossweb-7.0.17-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5 + 5Server-JBEAP-6:jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jettison-1.3.1-7_redhat_2.ep6.el5 + 5Server-JBEAP-6:jgroups-3.0.14-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:joda-time-1.6.2-5.redhat_3.ep6.el5.4 + 5Server-JBEAP-6:jtype-0.1.1-9_redhat_2.3.ep6.el5.4 + 5Server-JBEAP-6:juddi-3.1.3-3_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jython-eap6-2.5.2-5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:mod_cluster-native-1.2.3-3.Final.ep6.el5 + 5Server-JBEAP-6:mod_jk-1.2.36-5.1.ep6.el5 + 5Server-JBEAP-6:netty-3.2.6-2_redhat_2.2.ep6.el5.4 + 5Server-JBEAP-6:objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:org.osgi-4.2.0-4.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketbox-4.0.14-2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5 + 5Server-JBEAP-6:relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4 + 5Server-JBEAP-6:resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:rngom-201103-0.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:scannotation-1.0.2-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:shrinkwrap-1.0.0-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-eap6-1.6.1-23.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2 + 5Server-JBEAP-6:snakeyaml-1.8-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:stilts-0.1.26-6.GA.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-codemodel-2.6-3_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-istack-commons-2.6.1-9_redhat_2.ep6.el5 + 5Server-JBEAP-6:sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-txw2-20110809-6_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-xsom-20110809-5_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:tomcat-native-1.1.24-1.1.ep6.el5 + 5Server-JBEAP-6:velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:woodstox-core-4.1.1-1.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5 + 5Server-JBEAP-6:wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5 + 5Server-JBEAP-6:wss4j-1.6.7-1.redhat_1.ep6.el5 + 5Server-JBEAP-6:xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2 + 5Server-JBEAP-6:xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5 + 5Server-JBEAP-6:xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:xml-security-1.5.2-2.redhat_1.ep6.el5 + 5Server-JBEAP-6:xom-1.2.7-1._redhat_3.1.ep6.el5.6 + + Low + + 2.6 + AV:N/AC:H/Au:N/C:N/I:P/A:N + + + +All users of JBoss Enterprise Application Platform 6.0.0 on Red Hat +Enterprise Linux 5 are advised to upgrade to these updated packages. The +JBoss server process must be restarted for the update to take effect. + +Before applying this update, make sure all previously released errata +relevant to your system have been applied. Also, back up any customized +JBoss Enterprise Application Platform 6 configuration files. On update, the +configuration files that have been locally modified will not be updated. +The updated version of such files will be stored as the rpmnew files. Make +sure to locate any such files after the update and merge any changes +manually. + +For more details, refer to the Release Notes for JBoss Enterprise +Application Platform 6.0.1, available shortly from +https://access.redhat.com/knowledge/docs/ + +This update is available via the Red Hat Network. Details on how to use the +Red Hat Network to apply this update are available at +https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2012-1591.html + + + + https://www.redhat.com/security/data/cve/CVE-2008-0455.html + CVE-2008-0455 + + + https://bugzilla.redhat.com/show_bug.cgi?id=850794 + bz#850794: CVE-2012-2687 CVE-2008-0455 httpd: mod_negotiation XSS via untrusted file names in directories with MultiViews enabled + + + + + + A flaw in the way Apache CXF enforced child policies of WS-SecurityPolicy 1.1 on the client side could, in certain cases, lead to a client failing to sign or encrypt certain elements as directed by the security policy, leading to information disclosure and insecure information transmission. + 2012-05-28T00:00:00Z + 2012-06-07T00:00:00Z + + CVE-2012-2378 + + 5Server-JBEAP-6:antlr-eap6-2.7.7-15_redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-collections-3.2.1-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5 + 5Server-JBEAP-6:apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-lang-2.6-3.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-cxf-2.4.9-4.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-mime4j-0.6-7.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:atinject-1-8.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:cal10n-0.7.3-8.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:dom4j-1.6.1-14_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jaf-1.1.1-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-javamail-1.4.4-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf-2.1.13-1_redhat_1.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5 + 5Server-JBEAP-6:gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6 + 5Server-JBEAP-6:h2database-1.3.168-2_redhat_1.ep6.el5 + 5Server-JBEAP-6:hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hornetq-2.2.23-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:hornetq-native-2.2.21-1.1.Final.ep6.el5 + 5Server-JBEAP-6:httpcomponents-5-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:httpd-2.2.22-14.ep6.el5 + 5Server-JBEAP-6:httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:infinispan-5.1.8-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jandex-1.0.3-7.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxen-1.1.3-8.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5 + 5Server-JBEAP-6:jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1 + 5Server-JBEAP-6:jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5 + 5Server-JBEAP-6:jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7 + 5Server-JBEAP-6:jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1 + 5Server-JBEAP-6:jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossts-4.16.6-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossweb-7.0.17-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5 + 5Server-JBEAP-6:jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jettison-1.3.1-7_redhat_2.ep6.el5 + 5Server-JBEAP-6:jgroups-3.0.14-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:joda-time-1.6.2-5.redhat_3.ep6.el5.4 + 5Server-JBEAP-6:jtype-0.1.1-9_redhat_2.3.ep6.el5.4 + 5Server-JBEAP-6:juddi-3.1.3-3_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jython-eap6-2.5.2-5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:mod_cluster-native-1.2.3-3.Final.ep6.el5 + 5Server-JBEAP-6:mod_jk-1.2.36-5.1.ep6.el5 + 5Server-JBEAP-6:netty-3.2.6-2_redhat_2.2.ep6.el5.4 + 5Server-JBEAP-6:objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:org.osgi-4.2.0-4.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketbox-4.0.14-2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5 + 5Server-JBEAP-6:relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4 + 5Server-JBEAP-6:resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:rngom-201103-0.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:scannotation-1.0.2-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:shrinkwrap-1.0.0-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-eap6-1.6.1-23.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2 + 5Server-JBEAP-6:snakeyaml-1.8-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:stilts-0.1.26-6.GA.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-codemodel-2.6-3_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-istack-commons-2.6.1-9_redhat_2.ep6.el5 + 5Server-JBEAP-6:sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-txw2-20110809-6_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-xsom-20110809-5_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:tomcat-native-1.1.24-1.1.ep6.el5 + 5Server-JBEAP-6:velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:woodstox-core-4.1.1-1.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5 + 5Server-JBEAP-6:wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5 + 5Server-JBEAP-6:wss4j-1.6.7-1.redhat_1.ep6.el5 + 5Server-JBEAP-6:xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2 + 5Server-JBEAP-6:xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5 + 5Server-JBEAP-6:xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:xml-security-1.5.2-2.redhat_1.ep6.el5 + 5Server-JBEAP-6:xom-1.2.7-1._redhat_3.1.ep6.el5.6 + + Moderate + + 4.3 + AV:N/AC:M/Au:N/C:P/I:N/A:N + + + +All users of JBoss Enterprise Application Platform 6.0.0 on Red Hat +Enterprise Linux 5 are advised to upgrade to these updated packages. The +JBoss server process must be restarted for the update to take effect. + +Before applying this update, make sure all previously released errata +relevant to your system have been applied. Also, back up any customized +JBoss Enterprise Application Platform 6 configuration files. On update, the +configuration files that have been locally modified will not be updated. +The updated version of such files will be stored as the rpmnew files. Make +sure to locate any such files after the update and merge any changes +manually. + +For more details, refer to the Release Notes for JBoss Enterprise +Application Platform 6.0.1, available shortly from +https://access.redhat.com/knowledge/docs/ + +This update is available via the Red Hat Network. Details on how to use the +Red Hat Network to apply this update are available at +https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2012-1591.html + + + + http://cxf.apache.org/cve-2012-2378.html + http://cxf.apache.org/cve-2012-2378.html + + + https://www.redhat.com/security/data/cve/CVE-2012-2378.html + CVE-2012-2378 + + + https://bugzilla.redhat.com/show_bug.cgi?id=826533 + bz#826533: CVE-2012-2378 jbossws-cxf, apache-cxf: Certain child policies of WS-SecurityPolicy 1.1 SupportingToken policy not applied on the client side + + + Red Hat would like to thank the Apache CXF project for reporting this issue. + + + + Apache CXF checked to ensure XML elements were signed or encrypted by a Supporting Token, but not whether the correct token was used. A remote attacker could transmit confidential information without the appropriate security, and potentially circumvent access controls on web services exposed via Apache CXF. + 2012-05-28T00:00:00Z + 2012-06-07T00:00:00Z + + CVE-2012-2379 + + 5Server-JBEAP-6:antlr-eap6-2.7.7-15_redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-collections-3.2.1-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5 + 5Server-JBEAP-6:apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-lang-2.6-3.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-cxf-2.4.9-4.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-mime4j-0.6-7.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:atinject-1-8.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:cal10n-0.7.3-8.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:dom4j-1.6.1-14_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jaf-1.1.1-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-javamail-1.4.4-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf-2.1.13-1_redhat_1.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5 + 5Server-JBEAP-6:gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6 + 5Server-JBEAP-6:h2database-1.3.168-2_redhat_1.ep6.el5 + 5Server-JBEAP-6:hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hornetq-2.2.23-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:hornetq-native-2.2.21-1.1.Final.ep6.el5 + 5Server-JBEAP-6:httpcomponents-5-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:httpd-2.2.22-14.ep6.el5 + 5Server-JBEAP-6:httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:infinispan-5.1.8-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jandex-1.0.3-7.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxen-1.1.3-8.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5 + 5Server-JBEAP-6:jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1 + 5Server-JBEAP-6:jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5 + 5Server-JBEAP-6:jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7 + 5Server-JBEAP-6:jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1 + 5Server-JBEAP-6:jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossts-4.16.6-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossweb-7.0.17-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5 + 5Server-JBEAP-6:jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jettison-1.3.1-7_redhat_2.ep6.el5 + 5Server-JBEAP-6:jgroups-3.0.14-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:joda-time-1.6.2-5.redhat_3.ep6.el5.4 + 5Server-JBEAP-6:jtype-0.1.1-9_redhat_2.3.ep6.el5.4 + 5Server-JBEAP-6:juddi-3.1.3-3_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jython-eap6-2.5.2-5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:mod_cluster-native-1.2.3-3.Final.ep6.el5 + 5Server-JBEAP-6:mod_jk-1.2.36-5.1.ep6.el5 + 5Server-JBEAP-6:netty-3.2.6-2_redhat_2.2.ep6.el5.4 + 5Server-JBEAP-6:objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:org.osgi-4.2.0-4.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketbox-4.0.14-2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5 + 5Server-JBEAP-6:relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4 + 5Server-JBEAP-6:resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:rngom-201103-0.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:scannotation-1.0.2-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:shrinkwrap-1.0.0-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-eap6-1.6.1-23.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2 + 5Server-JBEAP-6:snakeyaml-1.8-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:stilts-0.1.26-6.GA.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-codemodel-2.6-3_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-istack-commons-2.6.1-9_redhat_2.ep6.el5 + 5Server-JBEAP-6:sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-txw2-20110809-6_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-xsom-20110809-5_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:tomcat-native-1.1.24-1.1.ep6.el5 + 5Server-JBEAP-6:velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:woodstox-core-4.1.1-1.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5 + 5Server-JBEAP-6:wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5 + 5Server-JBEAP-6:wss4j-1.6.7-1.redhat_1.ep6.el5 + 5Server-JBEAP-6:xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2 + 5Server-JBEAP-6:xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5 + 5Server-JBEAP-6:xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:xml-security-1.5.2-2.redhat_1.ep6.el5 + 5Server-JBEAP-6:xom-1.2.7-1._redhat_3.1.ep6.el5.6 + + Important + + 5.8 + AV:N/AC:M/Au:N/C:P/I:P/A:N + + + +All users of JBoss Enterprise Application Platform 6.0.0 on Red Hat +Enterprise Linux 5 are advised to upgrade to these updated packages. The +JBoss server process must be restarted for the update to take effect. + +Before applying this update, make sure all previously released errata +relevant to your system have been applied. Also, back up any customized +JBoss Enterprise Application Platform 6 configuration files. On update, the +configuration files that have been locally modified will not be updated. +The updated version of such files will be stored as the rpmnew files. Make +sure to locate any such files after the update and merge any changes +manually. + +For more details, refer to the Release Notes for JBoss Enterprise +Application Platform 6.0.1, available shortly from +https://access.redhat.com/knowledge/docs/ + +This update is available via the Red Hat Network. Details on how to use the +Red Hat Network to apply this update are available at +https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2012-1591.html + + + + http://cxf.apache.org/cve-2012-2379.html + http://cxf.apache.org/cve-2012-2379.html + + + https://www.redhat.com/security/data/cve/CVE-2012-2379.html + CVE-2012-2379 + + + https://bugzilla.redhat.com/show_bug.cgi?id=826534 + bz#826534: CVE-2012-2379 jbossws-cxf, apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token + + + Red Hat would like to thank the Apache CXF project for reporting this issue. + + + + It was found that in Mojarra, the FacesContext that is made available during application startup is held in a ThreadLocal. The reference is not properly cleaned up in all cases. As a result, if a JavaServer Faces (JSF) WAR calls FacesContext.getCurrentInstance() during application startup, another WAR can get access to the leftover context and thus get access to the other WAR's resources. A local attacker could use this flaw to access another WAR's resources using a crafted, deployed application. + 2012-06-01T00:00:00Z + 2012-06-01T00:00:00Z + + CVE-2012-2672 + + 5Server-JBEAP-6:antlr-eap6-2.7.7-15_redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-collections-3.2.1-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5 + 5Server-JBEAP-6:apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-lang-2.6-3.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-cxf-2.4.9-4.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-mime4j-0.6-7.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:atinject-1-8.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:cal10n-0.7.3-8.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:dom4j-1.6.1-14_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jaf-1.1.1-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-javamail-1.4.4-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf-2.1.13-1_redhat_1.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5 + 5Server-JBEAP-6:gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6 + 5Server-JBEAP-6:h2database-1.3.168-2_redhat_1.ep6.el5 + 5Server-JBEAP-6:hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hornetq-2.2.23-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:hornetq-native-2.2.21-1.1.Final.ep6.el5 + 5Server-JBEAP-6:httpcomponents-5-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:httpd-2.2.22-14.ep6.el5 + 5Server-JBEAP-6:httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:infinispan-5.1.8-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jandex-1.0.3-7.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxen-1.1.3-8.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5 + 5Server-JBEAP-6:jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1 + 5Server-JBEAP-6:jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5 + 5Server-JBEAP-6:jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7 + 5Server-JBEAP-6:jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1 + 5Server-JBEAP-6:jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossts-4.16.6-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossweb-7.0.17-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5 + 5Server-JBEAP-6:jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jettison-1.3.1-7_redhat_2.ep6.el5 + 5Server-JBEAP-6:jgroups-3.0.14-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:joda-time-1.6.2-5.redhat_3.ep6.el5.4 + 5Server-JBEAP-6:jtype-0.1.1-9_redhat_2.3.ep6.el5.4 + 5Server-JBEAP-6:juddi-3.1.3-3_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jython-eap6-2.5.2-5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:mod_cluster-native-1.2.3-3.Final.ep6.el5 + 5Server-JBEAP-6:mod_jk-1.2.36-5.1.ep6.el5 + 5Server-JBEAP-6:netty-3.2.6-2_redhat_2.2.ep6.el5.4 + 5Server-JBEAP-6:objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:org.osgi-4.2.0-4.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketbox-4.0.14-2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5 + 5Server-JBEAP-6:relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4 + 5Server-JBEAP-6:resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:rngom-201103-0.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:scannotation-1.0.2-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:shrinkwrap-1.0.0-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-eap6-1.6.1-23.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2 + 5Server-JBEAP-6:snakeyaml-1.8-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:stilts-0.1.26-6.GA.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-codemodel-2.6-3_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-istack-commons-2.6.1-9_redhat_2.ep6.el5 + 5Server-JBEAP-6:sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-txw2-20110809-6_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-xsom-20110809-5_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:tomcat-native-1.1.24-1.1.ep6.el5 + 5Server-JBEAP-6:velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:woodstox-core-4.1.1-1.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5 + 5Server-JBEAP-6:wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5 + 5Server-JBEAP-6:wss4j-1.6.7-1.redhat_1.ep6.el5 + 5Server-JBEAP-6:xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2 + 5Server-JBEAP-6:xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5 + 5Server-JBEAP-6:xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:xml-security-1.5.2-2.redhat_1.ep6.el5 + 5Server-JBEAP-6:xom-1.2.7-1._redhat_3.1.ep6.el5.6 + + Low + + 1.9 + AV:L/AC:M/Au:N/C:P/I:N/A:N + + + +All users of JBoss Enterprise Application Platform 6.0.0 on Red Hat +Enterprise Linux 5 are advised to upgrade to these updated packages. The +JBoss server process must be restarted for the update to take effect. + +Before applying this update, make sure all previously released errata +relevant to your system have been applied. Also, back up any customized +JBoss Enterprise Application Platform 6 configuration files. On update, the +configuration files that have been locally modified will not be updated. +The updated version of such files will be stored as the rpmnew files. Make +sure to locate any such files after the update and merge any changes +manually. + +For more details, refer to the Release Notes for JBoss Enterprise +Application Platform 6.0.1, available shortly from +https://access.redhat.com/knowledge/docs/ + +This update is available via the Red Hat Network. Details on how to use the +Red Hat Network to apply this update are available at +https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2012-1591.html + + + + https://www.redhat.com/security/data/cve/CVE-2012-2672.html + CVE-2012-2672 + + + https://bugzilla.redhat.com/show_bug.cgi?id=829560 + bz#829560: CVE-2012-2672 Mojarra: deployed web applications can read FacesContext from other applications under certain conditions + + + This issue was discovered by Marek Schmidt and Stan Silvert of Red Hat. + + + + An input sanitization flaw was found in the mod_negotiation Apache HTTP Server module. A remote attacker able to upload or create files with arbitrary names in a directory that has the MultiViews options enabled, could use this flaw to conduct cross-site scripting attacks against users visiting the site. + 2012-08-21T00:00:00Z + 2012-06-13T00:00:00Z + + CVE-2012-2687 + + 5Server-JBEAP-6:antlr-eap6-2.7.7-15_redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-collections-3.2.1-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5 + 5Server-JBEAP-6:apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-lang-2.6-3.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-cxf-2.4.9-4.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-mime4j-0.6-7.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:atinject-1-8.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:cal10n-0.7.3-8.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:dom4j-1.6.1-14_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jaf-1.1.1-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-javamail-1.4.4-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf-2.1.13-1_redhat_1.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5 + 5Server-JBEAP-6:gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6 + 5Server-JBEAP-6:h2database-1.3.168-2_redhat_1.ep6.el5 + 5Server-JBEAP-6:hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hornetq-2.2.23-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:hornetq-native-2.2.21-1.1.Final.ep6.el5 + 5Server-JBEAP-6:httpcomponents-5-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:httpd-2.2.22-14.ep6.el5 + 5Server-JBEAP-6:httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:infinispan-5.1.8-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jandex-1.0.3-7.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxen-1.1.3-8.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5 + 5Server-JBEAP-6:jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1 + 5Server-JBEAP-6:jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5 + 5Server-JBEAP-6:jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7 + 5Server-JBEAP-6:jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1 + 5Server-JBEAP-6:jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossts-4.16.6-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossweb-7.0.17-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5 + 5Server-JBEAP-6:jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jettison-1.3.1-7_redhat_2.ep6.el5 + 5Server-JBEAP-6:jgroups-3.0.14-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:joda-time-1.6.2-5.redhat_3.ep6.el5.4 + 5Server-JBEAP-6:jtype-0.1.1-9_redhat_2.3.ep6.el5.4 + 5Server-JBEAP-6:juddi-3.1.3-3_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jython-eap6-2.5.2-5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:mod_cluster-native-1.2.3-3.Final.ep6.el5 + 5Server-JBEAP-6:mod_jk-1.2.36-5.1.ep6.el5 + 5Server-JBEAP-6:netty-3.2.6-2_redhat_2.2.ep6.el5.4 + 5Server-JBEAP-6:objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:org.osgi-4.2.0-4.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketbox-4.0.14-2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5 + 5Server-JBEAP-6:relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4 + 5Server-JBEAP-6:resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:rngom-201103-0.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:scannotation-1.0.2-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:shrinkwrap-1.0.0-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-eap6-1.6.1-23.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2 + 5Server-JBEAP-6:snakeyaml-1.8-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:stilts-0.1.26-6.GA.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-codemodel-2.6-3_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-istack-commons-2.6.1-9_redhat_2.ep6.el5 + 5Server-JBEAP-6:sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-txw2-20110809-6_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-xsom-20110809-5_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:tomcat-native-1.1.24-1.1.ep6.el5 + 5Server-JBEAP-6:velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:woodstox-core-4.1.1-1.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5 + 5Server-JBEAP-6:wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5 + 5Server-JBEAP-6:wss4j-1.6.7-1.redhat_1.ep6.el5 + 5Server-JBEAP-6:xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2 + 5Server-JBEAP-6:xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5 + 5Server-JBEAP-6:xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:xml-security-1.5.2-2.redhat_1.ep6.el5 + 5Server-JBEAP-6:xom-1.2.7-1._redhat_3.1.ep6.el5.6 + + Low + + 2.6 + AV:N/AC:H/Au:N/C:N/I:P/A:N + + + +All users of JBoss Enterprise Application Platform 6.0.0 on Red Hat +Enterprise Linux 5 are advised to upgrade to these updated packages. The +JBoss server process must be restarted for the update to take effect. + +Before applying this update, make sure all previously released errata +relevant to your system have been applied. Also, back up any customized +JBoss Enterprise Application Platform 6 configuration files. On update, the +configuration files that have been locally modified will not be updated. +The updated version of such files will be stored as the rpmnew files. Make +sure to locate any such files after the update and merge any changes +manually. + +For more details, refer to the Release Notes for JBoss Enterprise +Application Platform 6.0.1, available shortly from +https://access.redhat.com/knowledge/docs/ + +This update is available via the Red Hat Network. Details on how to use the +Red Hat Network to apply this update are available at +https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2012-1591.html + + + + https://www.redhat.com/security/data/cve/CVE-2012-2687.html + CVE-2012-2687 + + + + + + A flaw was found in the way IronJacamar authenticated credentials and returned a valid datasource connection when configured to "allow-multiple-users". A remote attacker, provided the correct subject, could obtain a datasource connection that might belong to a privileged user. + 2012-07-25T00:00:00Z + 2012-12-18T00:00:00Z + + CVE-2012-3428 + + 5Server-JBEAP-6:antlr-eap6-2.7.7-15_redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-collections-3.2.1-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5 + 5Server-JBEAP-6:apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-lang-2.6-3.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-cxf-2.4.9-4.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-mime4j-0.6-7.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:atinject-1-8.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:cal10n-0.7.3-8.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:dom4j-1.6.1-14_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jaf-1.1.1-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-javamail-1.4.4-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf-2.1.13-1_redhat_1.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5 + 5Server-JBEAP-6:gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6 + 5Server-JBEAP-6:h2database-1.3.168-2_redhat_1.ep6.el5 + 5Server-JBEAP-6:hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hornetq-2.2.23-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:hornetq-native-2.2.21-1.1.Final.ep6.el5 + 5Server-JBEAP-6:httpcomponents-5-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:httpd-2.2.22-14.ep6.el5 + 5Server-JBEAP-6:httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:infinispan-5.1.8-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jandex-1.0.3-7.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxen-1.1.3-8.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5 + 5Server-JBEAP-6:jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1 + 5Server-JBEAP-6:jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5 + 5Server-JBEAP-6:jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7 + 5Server-JBEAP-6:jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1 + 5Server-JBEAP-6:jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossts-4.16.6-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossweb-7.0.17-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5 + 5Server-JBEAP-6:jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jettison-1.3.1-7_redhat_2.ep6.el5 + 5Server-JBEAP-6:jgroups-3.0.14-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:joda-time-1.6.2-5.redhat_3.ep6.el5.4 + 5Server-JBEAP-6:jtype-0.1.1-9_redhat_2.3.ep6.el5.4 + 5Server-JBEAP-6:juddi-3.1.3-3_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jython-eap6-2.5.2-5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:mod_cluster-native-1.2.3-3.Final.ep6.el5 + 5Server-JBEAP-6:mod_jk-1.2.36-5.1.ep6.el5 + 5Server-JBEAP-6:netty-3.2.6-2_redhat_2.2.ep6.el5.4 + 5Server-JBEAP-6:objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:org.osgi-4.2.0-4.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketbox-4.0.14-2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5 + 5Server-JBEAP-6:relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4 + 5Server-JBEAP-6:resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:rngom-201103-0.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:scannotation-1.0.2-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:shrinkwrap-1.0.0-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-eap6-1.6.1-23.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2 + 5Server-JBEAP-6:snakeyaml-1.8-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:stilts-0.1.26-6.GA.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-codemodel-2.6-3_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-istack-commons-2.6.1-9_redhat_2.ep6.el5 + 5Server-JBEAP-6:sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-txw2-20110809-6_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-xsom-20110809-5_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:tomcat-native-1.1.24-1.1.ep6.el5 + 5Server-JBEAP-6:velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:woodstox-core-4.1.1-1.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5 + 5Server-JBEAP-6:wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5 + 5Server-JBEAP-6:wss4j-1.6.7-1.redhat_1.ep6.el5 + 5Server-JBEAP-6:xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2 + 5Server-JBEAP-6:xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5 + 5Server-JBEAP-6:xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:xml-security-1.5.2-2.redhat_1.ep6.el5 + 5Server-JBEAP-6:xom-1.2.7-1._redhat_3.1.ep6.el5.6 + + Moderate + + 4.3 + AV:N/AC:M/Au:N/C:N/I:P/A:N + + + +All users of JBoss Enterprise Application Platform 6.0.0 on Red Hat +Enterprise Linux 5 are advised to upgrade to these updated packages. The +JBoss server process must be restarted for the update to take effect. + +Before applying this update, make sure all previously released errata +relevant to your system have been applied. Also, back up any customized +JBoss Enterprise Application Platform 6 configuration files. On update, the +configuration files that have been locally modified will not be updated. +The updated version of such files will be stored as the rpmnew files. Make +sure to locate any such files after the update and merge any changes +manually. + +For more details, refer to the Release Notes for JBoss Enterprise +Application Platform 6.0.1, available shortly from +https://access.redhat.com/knowledge/docs/ + +This update is available via the Red Hat Network. Details on how to use the +Red Hat Network to apply this update are available at +https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2012-1591.html + + + + https://www.redhat.com/security/data/cve/CVE-2012-3428.html + CVE-2012-3428 + + + https://bugzilla.redhat.com/show_bug.cgi?id=843358 + bz#843358: CVE-2012-3428 JBoss: Datasource connection manager returns valid connection for wrong credentials when using security-domains + + + This issue was discovered by Arun Neelicattu of the Red Hat Security Response Team. + + + + It was found that Apache CXF was vulnerable to SOAPAction spoofing attacks under certain conditions. Note that WS-Policy validation is performed against the operation being invoked, and an attack must pass validation to be successful. + 2012-08-25T00:00:00Z + 2012-09-19T00:00:00Z + + CVE-2012-3451 + + 5Server-JBEAP-6:antlr-eap6-2.7.7-15_redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-collections-3.2.1-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5 + 5Server-JBEAP-6:apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-lang-2.6-3.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-cxf-2.4.9-4.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-mime4j-0.6-7.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:atinject-1-8.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:cal10n-0.7.3-8.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:dom4j-1.6.1-14_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jaf-1.1.1-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-javamail-1.4.4-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf-2.1.13-1_redhat_1.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5 + 5Server-JBEAP-6:gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6 + 5Server-JBEAP-6:h2database-1.3.168-2_redhat_1.ep6.el5 + 5Server-JBEAP-6:hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hornetq-2.2.23-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:hornetq-native-2.2.21-1.1.Final.ep6.el5 + 5Server-JBEAP-6:httpcomponents-5-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:httpd-2.2.22-14.ep6.el5 + 5Server-JBEAP-6:httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:infinispan-5.1.8-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jandex-1.0.3-7.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxen-1.1.3-8.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5 + 5Server-JBEAP-6:jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1 + 5Server-JBEAP-6:jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5 + 5Server-JBEAP-6:jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7 + 5Server-JBEAP-6:jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1 + 5Server-JBEAP-6:jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossts-4.16.6-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossweb-7.0.17-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5 + 5Server-JBEAP-6:jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jettison-1.3.1-7_redhat_2.ep6.el5 + 5Server-JBEAP-6:jgroups-3.0.14-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:joda-time-1.6.2-5.redhat_3.ep6.el5.4 + 5Server-JBEAP-6:jtype-0.1.1-9_redhat_2.3.ep6.el5.4 + 5Server-JBEAP-6:juddi-3.1.3-3_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jython-eap6-2.5.2-5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:mod_cluster-native-1.2.3-3.Final.ep6.el5 + 5Server-JBEAP-6:mod_jk-1.2.36-5.1.ep6.el5 + 5Server-JBEAP-6:netty-3.2.6-2_redhat_2.2.ep6.el5.4 + 5Server-JBEAP-6:objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:org.osgi-4.2.0-4.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketbox-4.0.14-2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5 + 5Server-JBEAP-6:relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4 + 5Server-JBEAP-6:resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:rngom-201103-0.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:scannotation-1.0.2-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:shrinkwrap-1.0.0-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-eap6-1.6.1-23.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2 + 5Server-JBEAP-6:snakeyaml-1.8-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:stilts-0.1.26-6.GA.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-codemodel-2.6-3_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-istack-commons-2.6.1-9_redhat_2.ep6.el5 + 5Server-JBEAP-6:sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-txw2-20110809-6_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-xsom-20110809-5_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:tomcat-native-1.1.24-1.1.ep6.el5 + 5Server-JBEAP-6:velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:woodstox-core-4.1.1-1.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5 + 5Server-JBEAP-6:wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5 + 5Server-JBEAP-6:wss4j-1.6.7-1.redhat_1.ep6.el5 + 5Server-JBEAP-6:xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2 + 5Server-JBEAP-6:xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5 + 5Server-JBEAP-6:xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:xml-security-1.5.2-2.redhat_1.ep6.el5 + 5Server-JBEAP-6:xom-1.2.7-1._redhat_3.1.ep6.el5.6 + + Moderate + + 4.3 + AV:N/AC:M/Au:N/C:N/I:P/A:N + + + +All users of JBoss Enterprise Application Platform 6.0.0 on Red Hat +Enterprise Linux 5 are advised to upgrade to these updated packages. The +JBoss server process must be restarted for the update to take effect. + +Before applying this update, make sure all previously released errata +relevant to your system have been applied. Also, back up any customized +JBoss Enterprise Application Platform 6 configuration files. On update, the +configuration files that have been locally modified will not be updated. +The updated version of such files will be stored as the rpmnew files. Make +sure to locate any such files after the update and merge any changes +manually. + +For more details, refer to the Release Notes for JBoss Enterprise +Application Platform 6.0.1, available shortly from +https://access.redhat.com/knowledge/docs/ + +This update is available via the Red Hat Network. Details on how to use the +Red Hat Network to apply this update are available at +https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2012-1591.html + + + + https://www.redhat.com/security/data/cve/CVE-2012-3451.html + CVE-2012-3451 + + + https://bugzilla.redhat.com/show_bug.cgi?id=851896 + bz#851896: CVE-2012-3451 jbossws-cxf, apache-cxf: SOAPAction spoofing on document literal web services + + + Red Hat would like to thank the Apache CXF project for reporting this issue. + + + + When there are no allowed roles for an EJB method invocation, the invocation should be denied for all users. It was found that the processInvocation() method in org.jboss.as.ejb3.security.AuthorizationInterceptor incorrectly authorizes all method invocations to proceed when the list of allowed roles is empty. + 2012-10-29T00:00:00Z + 2012-12-18T00:00:00Z + + CVE-2012-4549 + + 5Server-JBEAP-6:antlr-eap6-2.7.7-15_redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-collections-3.2.1-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5 + 5Server-JBEAP-6:apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-lang-2.6-3.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-cxf-2.4.9-4.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-mime4j-0.6-7.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:atinject-1-8.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:cal10n-0.7.3-8.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:dom4j-1.6.1-14_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jaf-1.1.1-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-javamail-1.4.4-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf-2.1.13-1_redhat_1.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5 + 5Server-JBEAP-6:gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6 + 5Server-JBEAP-6:h2database-1.3.168-2_redhat_1.ep6.el5 + 5Server-JBEAP-6:hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hornetq-2.2.23-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:hornetq-native-2.2.21-1.1.Final.ep6.el5 + 5Server-JBEAP-6:httpcomponents-5-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:httpd-2.2.22-14.ep6.el5 + 5Server-JBEAP-6:httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:infinispan-5.1.8-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jandex-1.0.3-7.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxen-1.1.3-8.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5 + 5Server-JBEAP-6:jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1 + 5Server-JBEAP-6:jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5 + 5Server-JBEAP-6:jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7 + 5Server-JBEAP-6:jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1 + 5Server-JBEAP-6:jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossts-4.16.6-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossweb-7.0.17-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5 + 5Server-JBEAP-6:jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jettison-1.3.1-7_redhat_2.ep6.el5 + 5Server-JBEAP-6:jgroups-3.0.14-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:joda-time-1.6.2-5.redhat_3.ep6.el5.4 + 5Server-JBEAP-6:jtype-0.1.1-9_redhat_2.3.ep6.el5.4 + 5Server-JBEAP-6:juddi-3.1.3-3_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jython-eap6-2.5.2-5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:mod_cluster-native-1.2.3-3.Final.ep6.el5 + 5Server-JBEAP-6:mod_jk-1.2.36-5.1.ep6.el5 + 5Server-JBEAP-6:netty-3.2.6-2_redhat_2.2.ep6.el5.4 + 5Server-JBEAP-6:objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:org.osgi-4.2.0-4.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketbox-4.0.14-2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5 + 5Server-JBEAP-6:relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4 + 5Server-JBEAP-6:resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:rngom-201103-0.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:scannotation-1.0.2-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:shrinkwrap-1.0.0-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-eap6-1.6.1-23.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2 + 5Server-JBEAP-6:snakeyaml-1.8-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:stilts-0.1.26-6.GA.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-codemodel-2.6-3_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-istack-commons-2.6.1-9_redhat_2.ep6.el5 + 5Server-JBEAP-6:sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-txw2-20110809-6_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-xsom-20110809-5_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:tomcat-native-1.1.24-1.1.ep6.el5 + 5Server-JBEAP-6:velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:woodstox-core-4.1.1-1.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5 + 5Server-JBEAP-6:wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5 + 5Server-JBEAP-6:wss4j-1.6.7-1.redhat_1.ep6.el5 + 5Server-JBEAP-6:xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2 + 5Server-JBEAP-6:xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5 + 5Server-JBEAP-6:xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:xml-security-1.5.2-2.redhat_1.ep6.el5 + 5Server-JBEAP-6:xom-1.2.7-1._redhat_3.1.ep6.el5.6 + + Moderate + + 5.8 + AV:N/AC:M/Au:N/C:P/I:P/A:N + + + +All users of JBoss Enterprise Application Platform 6.0.0 on Red Hat +Enterprise Linux 5 are advised to upgrade to these updated packages. The +JBoss server process must be restarted for the update to take effect. + +Before applying this update, make sure all previously released errata +relevant to your system have been applied. Also, back up any customized +JBoss Enterprise Application Platform 6 configuration files. On update, the +configuration files that have been locally modified will not be updated. +The updated version of such files will be stored as the rpmnew files. Make +sure to locate any such files after the update and merge any changes +manually. + +For more details, refer to the Release Notes for JBoss Enterprise +Application Platform 6.0.1, available shortly from +https://access.redhat.com/knowledge/docs/ + +This update is available via the Red Hat Network. Details on how to use the +Red Hat Network to apply this update are available at +https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2012-1591.html + + + + https://www.redhat.com/security/data/cve/CVE-2012-4549.html + CVE-2012-4549 + + + https://bugzilla.redhat.com/show_bug.cgi?id=870868 + bz#870868: CVE-2012-4549 JBoss AS: EJB authorization succeeds for any role when allowed roles list is empty + + + This issue was discovered by Arun Neelicattu of the Red Hat Security Response Team. + + + + When using role-based authorization to configure EJB access, JACC permissions should be used to determine access; however, due to a flaw the configured authorization modules (JACC, XACML, etc.) were not called, and the JACC permissions were not used to determine access to an EJB. + 2012-10-24T00:00:00Z + 2012-04-19T00:00:00Z + + CVE-2012-4550 + + 5Server-JBEAP-6:antlr-eap6-2.7.7-15_redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-commons-codec-eap6-1.4-14.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-collections-3.2.1-10.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-collections-eap6-3.2.1-13.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-configuration-1.6-7.2.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:apache-commons-daemon-jsvc-eap6-1.0.10-3.ep6.el5 + 5Server-JBEAP-6:apache-commons-io-eap6-2.1-6.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-lang-2.6-3.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-commons-lang-eap6-2.6-5redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-commons-pool-eap6-1.5.6-8.redhat_2.ep6.el5.1 + 5Server-JBEAP-6:apache-cxf-2.4.9-4.redhat_2.ep6.el5 + 5Server-JBEAP-6:apache-cxf-xjc-utils-2.4.0-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:apache-mime4j-0.6-7.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:atinject-1-8.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:cal10n-0.7.3-8.redhat_2.ep6.el5.5 + 5Server-JBEAP-6:codehaus-jackson-1.9.2-6_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:dom4j-1.6.1-14_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jaf-1.1.1-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-javamail-1.4.4-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:glassfish-jaxb-2.2.5-10_redhat_3.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf-2.1.13-1_redhat_1.ep6.el5 + 5Server-JBEAP-6:glassfish-jsf12-1.2_15-9_b01_redhat_2.ep6.el5 + 5Server-JBEAP-6:gnu-getopt-1.0.13-1.2_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:guava-libraries-11.0.2-0.5.redhat_2.ep6.el5.6 + 5Server-JBEAP-6:h2database-1.3.168-2_redhat_1.ep6.el5 + 5Server-JBEAP-6:hibernate-beanvalidation-api-1.0.0-4.7.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:hibernate-jpa-2.0-api-1.0.1-5.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hibernate3-commons-annotations-4.0.1-5.Final_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:hibernate4-4.1.6-3.5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:hibernate4-validator-4.2.0-7.Final_redhat_2.1.ep6.el5.4 + 5Server-JBEAP-6:hornetq-2.2.23-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:hornetq-native-2.2.21-1.1.Final.ep6.el5 + 5Server-JBEAP-6:httpcomponents-5-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:httpd-2.2.22-14.ep6.el5 + 5Server-JBEAP-6:httpserver-1.0.1-3.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:infinispan-5.1.8-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:ironjacamar-1.0.13-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jacorb-jboss-2.3.2-3.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jandex-1.0.3-7.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:javassist-eap6-3.15.0-5.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxbintros-1.0.2-11.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jaxen-1.1.3-8.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jaxws-jboss-httpserver-httpspi-1.0.1-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-deployment-1.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-framework-core-1.3.1-3.CR1_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbosgi-metadata-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-repository-1.2.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jbosgi-resolver-2.1.0-2.Final_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:jbosgi-spi-3.1.0-3.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbosgi-vfs-1.1.0-2.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:jboss-annotations-api_1.1_spec-1.0.1-3.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-as-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cli-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-client-all-7.1.3-4.1.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-clustering-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-cmp-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-connector-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-console-1.4.2-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-controller-client-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-repository-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-deployment-scanner-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-http-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-domain-management-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ee-deployment-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-ejb3-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-embedded-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-host-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jacorb-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jaxrs-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jdr-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jmx-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jpa-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsf-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-jsr77-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-logging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-mail-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-management-client-content-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-messaging-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-modcluster-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-naming-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-network-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-configadmin-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-osgi-service-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-platform-mbean-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-pojo-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-process-controller-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-protocol-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-remoting-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-sar-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-security-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-server-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-threads-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-transactions-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-web-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-webservices-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-weld-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-as-xts-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jboss-classfilewriter-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-common-beans-1.0.0-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-common-core-2.2.17-10.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-connector-api_1.6_spec-1.0.1-3.3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-dmr-1.1.1-8.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-api_3.1_spec-1.0.2-10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-ejb-client-1.0.11-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-ejb3-ext-api-2.0.0-9.redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-el-api_2.2_spec-1.0.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-iiop-client-1.0.0-4.Final_redhat_2.1.ep6.el5 + 5Server-JBEAP-6:jboss-interceptors-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-invocation-1.1.1-5.Final_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:jboss-j2eemgmt-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jacc-api_1.4_spec-1.0.2-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jad-api_1.2_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaspi-api_1.0_spec-1.0.1-6.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxb-api_2.2_spec-1.0.4-3.Final_redhat_2.1.ep6.el5.1 + 5Server-JBEAP-6:jboss-jaxr-api_1.0_spec-1.0.2-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrpc-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxrs-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jaxws-api_2.2_spec-2.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jms-api_1.1_spec-1.0.1-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jsf-api_2.1_spec-2.0.7-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-jsp-api_2.2_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-jstl-api_1.2_spec-1.0.3-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-logging-3.1.2-3.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-logmanager-1.3.2-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-marshalling-1.3.15-2.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-metadata-7.0.4-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-modules-1.1.3-2.GA_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-msc-1.0.2-3.GA_redhat_2.2.ep6.el5 + 5Server-JBEAP-6:jboss-osgi-logging-1.0.0-5._redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jboss-remote-naming-1.0.4-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:jboss-remoting3-3.2.14-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-remoting3-jmx-1.0.4-2.Final_redhat_1.ep6.el5.7 + 5Server-JBEAP-6:jboss-rmi-api_1.0_spec-1.0.4-9.2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-saaj-api_1.3_spec-1.0.2-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-sasl-1.0.3-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-seam-int-6.0.0-8.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-security-negotiation-2.2.1-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jboss-security-xacml-2.0.8-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_2.5_spec-1.0.1-9.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-servlet-api_3.0_spec-1.0.1-11.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-specs-parent-1.0.0-5.Beta2_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-stdio-1.0.1-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-threads-2.0.0-7.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-api_1.1_spec-1.0.1-5.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-transaction-spi-7.0.0-0.10.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-vfs2-3.1.0-4.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:jboss-weld-1.1-api-1.1-6.Final_redhat_2.ep6.el5.1 + 5Server-JBEAP-6:jboss-xnio-base-3.0.7-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossas-appclient-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-bundles-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-core-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-domain-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-javadocs-7.1.3-4.Final_redhat_3.ep6.el5 + 5Server-JBEAP-6:jbossas-modules-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-product-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-standalone-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossas-welcome-content-eap-7.1.3-4.Final_redhat_4.ep6.el5 + 5Server-JBEAP-6:jbossts-4.16.6-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossweb-7.0.17-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-api-1.0.0-3.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jbossws-common-2.0.4-5.GA_redhat_3.ep6.el5.5 + 5Server-JBEAP-6:jbossws-common-tools-1.0.2-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-cxf-4.0.6-2.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jbossws-native-4.0.6-1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossws-spi-2.0.4-3.1.GA_redhat_1.ep6.el5 + 5Server-JBEAP-6:jbossxb2-2.0.3-13.GA_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:jcip-annotations-1.0-2.2.3_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:jdom-eap6-1.1.2-4.GA_redhat_2.ep6.el5 + 5Server-JBEAP-6:jettison-1.3.1-7_redhat_2.ep6.el5 + 5Server-JBEAP-6:jgroups-3.0.14-2.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:jline-eap6-0.9.94-10.GA_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:joda-time-1.6.2-5.redhat_3.ep6.el5.4 + 5Server-JBEAP-6:jtype-0.1.1-9_redhat_2.3.ep6.el5.4 + 5Server-JBEAP-6:juddi-3.1.3-3_redhat_2.1.ep6.el5.3 + 5Server-JBEAP-6:jul-to-slf4j-stub-1.0.0-4.Final_redhat_2.1.ep6.el5.2 + 5Server-JBEAP-6:jython-eap6-2.5.2-5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-eap6-1.2.16-11.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:log4j-jboss-logmanager-1.0.1-3.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:mod_cluster-1.2.3-1.Final_redhat_1.ep6.el5 + 5Server-JBEAP-6:mod_cluster-native-1.2.3-3.Final.ep6.el5 + 5Server-JBEAP-6:mod_jk-1.2.36-5.1.ep6.el5 + 5Server-JBEAP-6:netty-3.2.6-2_redhat_2.2.ep6.el5.4 + 5Server-JBEAP-6:objectweb-asm-eap6-3.3.1-5_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:org.apache.felix.configadmin-1.2.8-4_redhat_2.ep6.el5 + 5Server-JBEAP-6:org.apache.felix.log-1.0.0-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:org.osgi-4.2.0-4.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketbox-4.0.14-2.Final_redhat_2.ep6.el5 + 5Server-JBEAP-6:picketbox-commons-1.0.0-0.8.final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:picketlink-federation-2.1.3.1-3.redhat_1.ep6.el5 + 5Server-JBEAP-6:relaxngDatatype-2011.1-0.1_redhat_3.ep6.el5.4 + 5Server-JBEAP-6:resteasy-2.3.4-4.Final_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:rngom-201103-0.5.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:scannotation-1.0.2-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:shrinkwrap-1.0.0-16.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-eap6-1.6.1-23.redhat_2.ep6.el5 + 5Server-JBEAP-6:slf4j-jboss-logmanager-1.0.0-7.GA_redhat_2.3.ep6.el5.2 + 5Server-JBEAP-6:snakeyaml-1.8-8.redhat_2.ep6.el5.2 + 5Server-JBEAP-6:staxmapper-1.1.0-6.Final_redhat_2.ep6.el5.2 + 5Server-JBEAP-6:stilts-0.1.26-6.GA.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-codemodel-2.6-3_redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-istack-commons-2.6.1-9_redhat_2.ep6.el5 + 5Server-JBEAP-6:sun-saaj-1.3-impl-1.3.16-9.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:sun-txw2-20110809-6_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-ws-metadata-2.0-api-1.0.MR1-12_MR1_redhat_2.ep6.el5.4 + 5Server-JBEAP-6:sun-xsom-20110809-5_redhat_3.ep6.el5.3 + 5Server-JBEAP-6:tomcat-native-1.1.24-1.1.ep6.el5 + 5Server-JBEAP-6:velocity-eap6-1.6.3-7.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:weld-cdi-1.0-api-1.0-6.SP4_redhat_2.ep6.el5.5 + 5Server-JBEAP-6:weld-core-1.1.10-2.Final_redhat_1.ep6.el5.1 + 5Server-JBEAP-6:woodstox-core-4.1.1-1.redhat_2.ep6.el5.4 + 5Server-JBEAP-6:ws-commons-XmlSchema-2.0.2-7.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-commons-neethi-3.0.2-5.redhat_2.ep6.el5 + 5Server-JBEAP-6:ws-scout-1.2.6-3.redhat_2.2.ep6.el5.5 + 5Server-JBEAP-6:wsdl4j-eap6-1.6.2-11.redhat_2.ep6.el5 + 5Server-JBEAP-6:wss4j-1.6.7-1.redhat_1.ep6.el5 + 5Server-JBEAP-6:xalan-j2-eap6-2.7.1-6.12.redhat_3.ep6.el5.2 + 5Server-JBEAP-6:xerces-j2-eap6-2.9.1-13_redhat_3.ep6.el5 + 5Server-JBEAP-6:xml-commons-resolver-eap6-1.2-10.redhat_2.ep6.el5.3 + 5Server-JBEAP-6:xml-security-1.5.2-2.redhat_1.ep6.el5 + 5Server-JBEAP-6:xom-1.2.7-1._redhat_3.1.ep6.el5.6 + + Important + + 6.8 + AV:N/AC:L/Au:N/C:P/I:P/A:N + + + +All users of JBoss Enterprise Application Platform 6.0.0 on Red Hat +Enterprise Linux 5 are advised to upgrade to these updated packages. The +JBoss server process must be restarted for the update to take effect. + +Before applying this update, make sure all previously released errata +relevant to your system have been applied. Also, back up any customized +JBoss Enterprise Application Platform 6 configuration files. On update, the +configuration files that have been locally modified will not be updated. +The updated version of such files will be stored as the rpmnew files. Make +sure to locate any such files after the update and merge any changes +manually. + +For more details, refer to the Release Notes for JBoss Enterprise +Application Platform 6.0.1, available shortly from +https://access.redhat.com/knowledge/docs/ + +This update is available via the Red Hat Network. Details on how to use the +Red Hat Network to apply this update are available at +https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2012-1591.html + + + + https://www.redhat.com/security/data/cve/CVE-2012-4550.html + CVE-2012-4550 + + + https://bugzilla.redhat.com/show_bug.cgi?id=870871 + bz#870871: CVE-2012-4550 JBoss JACC: Security constraints configured for EJBs are incorrectly interpreted and not applied + + + This issue was discovered by Josef Cacek of the Red Hat JBoss EAP Quality Engineering team. + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/cvrf.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/cvrf.xsd new file mode 100755 index 000000000..b4153b9fe --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/cvrf.xsd @@ -0,0 +1,487 @@ + + + + + + + + + + + + + + This is the XML schema for the Common Vulnerability Reporting Framework. For more information, see the CVRF whitepaper. + + Brian Schafer <bschafer@microsoft.com> + Joe Clarke <jclarke@cisco.com> + Joe Hemmerlein <Joe.Hemmerlein@microsoft.com> + 2012-05-07 + CVRF Dictionary + 1.1 + + + + + + + + Types enumerating the status of the document. + + + + + Pre-release, intended for issuing party’s internal use only, or possibly used externally when the party is seeking feedback or indicating its intentions regarding a specific issue. + + + + + The issuing party believes the content is subject to change. + + + + + The issuing party asserts the content is unlikely to change. + + + + + + + Floating point number representing the CVRF specification version + + + + + + + + + + + Root element of a CVRF document. + + + + + + A definitive canonical name for the document, providing enough descriptive content to differentiate from other similar documents, ideally providing a unique “handle”. + + + + + + + + + + A short canonical name, chosen by the document producer, which will inform the consumer about the type of the document. + + + + + + + + + + A container holding all information about the publisher of the CVRF document. + + + + + + Author contact information such as address, phone number, email, etc. + + + + + + + + + + The name of the issuing party and their authority to release the document, in particular, the party's constituency and responsibilities or other obligations. + + + + + + + + + + + Type is an enumerated list containing an array of different document publisher types. + + + + + Vendor ID is a unique identifier (OID) that a vendor uses as issued by FIRST under the auspices of IETF. + + + + + + + The Document Tracking meta-container contains all of the attributes necessary to track a CVRF document. + + + + + + Contains document ID and optional document aliases + + + + + + Short unique identifier used to refer to the document unambiguously in any context. + + + + + + + + + + Optional alternative ID for document + + + + + + + + + + + + + The condition of the document with regard to completeness and the likelihood of future editions. + + + + + Document Version is a simple counter to track the version of the document. + + + + + The Document Revision History contains one entry for each substantive version of the document, including the initial version and entries for each subsequent update. + + + + + + A set of Version, Date, and Description elements describing one iteration of this document + + + + + + Revision number of this iteration of the document. + + + + + Date when this iteration of the document was released. + + + + + Description of this iteration of the document. + + + + + + + + + + + + + + + + The initial date (and time, optionally) that the document was initially released by the issuing party. + + + + + The current date (and time, optionally) that the document was released by the issuing party. + + + + + The Document Generator meta-container contains all of the elements related to the generation of the document. + + + + + + The name and version of the engine that generated the CVRF document. + + + + + + + + + + The date the CVRF document was generated. + + + + + + + + + + + The Document Notes text contains all of the individual notes necessary to provide different types of low-level discussions of a CVRF document to various audiences. + + + + + + A individual note in freeform text. + + + + + + + Title should be a concise description of what is contained in this specific note. + + + + + Audience will indicate who is intended to read the note. + + + + + Type of content within this note. + + + + + Ordinal is a locally significant integral counter indexed from 1 used to track notes. + + + + + + + + + + + + The Document Distribution string should contain details on constraints, if any, about sharing this CVRF Document with additional recipients. + + + + + + + + + + Aggregate Severity is provided by the producer of the document to convey the urgency and criticality with which the vulnerability or vulnerabilities should be addressed. + + + + + + + URL of the namespace from which the Aggregate Severity is taken. + + + + + + + + + This meta-container should include references to any conferences, papers, advisories, and other resources that are related and considered to be of value to the document consumer. + + + + + + Related documents to the CVRF document. + + + + + + The URL of the related document. + + + + + The description of the related document. + + + + + + + + + + + Enumerated type value of reference relative to this document. + + + + + + + + + + The Acknowledgments container holds one or more Acknowledgement containers for document-level acknowledgements. + + + + + + The Acknowledgment container holds recognition details for external parties, specific to the document as a whole rather than individual vulnerabilities. + + + + + + The name (i.e., individual name) of the party being acknowledged. + + + + + + + + + + The organization of the party being acknowledged or the organization itself being acknowledged. + + + + + + + + + + The details of the acknowledgment that address the recognition of external parties who were instrumental in the discovery, reporting and response of this document. + + + + + + + + + + The optional URL to the person, place, or thing being acknowledged. + + + + + + + + + + + + + + + This is to ensure that each Vulnerability's Ordinal uses a unique value. + + + + + + + This is to ensure that each note has a unique ordinal value. + + + + + + + A key to reference a specific product defined in a referenced product schema. + + + + + + + An instance of the ProductKey to be used in the ProductID element for affected products. + + + + + + + An instance of the ProductKey to be used in the CVSS ScoreSet product references. + + + + + + + An instance of the ProductKey to be used in the Threat product references. + + + + + + + An instance of the ProductKey to be used in the Remediation product references. + + + + + + + A key to reference a specific product group defined in a referenced product schema. + + + + + + + An instance of the GroupKey to be used in the Threat product references. + + + + + + + An instance of the GroupKey to be used in the Remediation product references. + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.2/cvrf.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.2/cvrf.xsd new file mode 100755 index 000000000..dedcb7c76 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.2/cvrf.xsd @@ -0,0 +1,501 @@ + + + + + + + + + + + + + + + + + + + + + This is the XML schema for the main frame model of the OASIS Common Security Advisory Framework (CSAF) TC's CVRF (Common Vulnerability Reporting Framework). + + Feng Cao (feng.cao@oracle.com) + Stefan Hagen (stefan@hagen.link) + 2017-05-24 + CSAF CVRF main frame model + 1.2 + + + + + + + + Types enumerating the status of the document. + + + + + Pre-release, intended for issuing partys internal use only, or possibly used externally when the party is seeking feedback or indicating its intentions regarding a specific issue. + + + + + The issuing party believes the content is subject to change. + + + + + The issuing party asserts the content is unlikely to change. + + + + + + + Floating point number representing the CSAF CVRF specification version + + + + + + + + + + + Root element of a CSAF CVRF document. + + + + + + A definitive canonical name for the document, providing enough descriptive content to differentiate from other similar documents, ideally providing a unique handle. + + + + + + + + + + A short canonical name, chosen by the document producer, which will inform the consumer about the type of the document. + + + + + + + + + + A container holding all information about the publisher of the CSAF CVRF document. + + + + + + Author contact information such as address, phone number, email, etc. + + + + + + + + + + The name of the issuing party and their authority to release the document, in particular, the party's constituency and responsibilities or other obligations. + + + + + + + + + + + Type is an enumerated list containing an array of different document publisher types. + + + + + Vendor ID is a unique identifier (OID) that a vendor uses as issued by FIRST under the auspices of IETF. + + + + + + + The Document Tracking meta-container contains all of the attributes necessary to track a CSAF CVRF document. + + + + + + Contains document ID and optional document aliases + + + + + + Short unique identifier used to refer to the document unambiguously in any context. + + + + + + + + + + Optional alternative ID for document + + + + + + + + + + + + + The condition of the document with regard to completeness and the likelihood of future editions. + + + + + Document Version is a simple counter to track the version of the document. + + + + + The Document Revision History contains one entry for each substantive version of the document, including the initial version and entries for each subsequent update. + + + + + + A set of Version, Date, and Description elements describing one iteration of this document + + + + + + Revision number of this iteration of the document. + + + + + Date when this iteration of the document was released. + + + + + Description of this iteration of the document. + + + + + + + + + + + + + + + + The initial date (and time, optionally) that the document was initially released by the issuing party. + + + + + The current date (and time, optionally) that the document was released by the issuing party. + + + + + The Document Generator meta-container contains all of the elements related to the generation of the document. + + + + + + The name and version of the engine that generated the CSAF CVRF document. + + + + + + + + + + The date the CSAF CVRF document was generated. + + + + + + + + + + + The Document Notes text contains all of the individual notes necessary to provide different types of low-level discussions of a CSAF CVRF document to various audiences. + + + + + + A individual note in freeform text. + + + + + + + Title should be a concise description of what is contained in this specific note. + + + + + Audience will indicate who is intended to read the note. + + + + + Type of content within this note. + + + + + Ordinal is a locally significant integral counter indexed from 1 used to track notes. + + + + + + + + + + + + The Document Distribution string should contain details on constraints, if any, about sharing this CSAF CVRF Document with additional recipients. + + + + + + + + + + Aggregate Severity is provided by the producer of the document to convey the urgency and criticality with which the vulnerability or vulnerabilities should be addressed. + + + + + + + URL of the namespace from which the Aggregate Severity is taken. + + + + + + + + + This meta-container should include references to any conferences, papers, advisories, and other resources that are related and considered to be of value to the document consumer. + + + + + + Related documents to the CSAF CVRF document. + + + + + + The URL of the related document. + + + + + The description of the related document. + + + + + + + + + + + Enumerated type value of reference relative to this document. + + + + + + + + + + The Acknowledgments container holds one or more Acknowledgement containers for document-level acknowledgements. + + + + + + The Acknowledgment container holds recognition details for external parties, specific to the document as a whole rather than individual vulnerabilities. + + + + + + The name (i.e., individual name) of the party being acknowledged. + + + + + + + + + + The organization of the party being acknowledged or the organization itself being acknowledged. + + + + + + + + + + The details of the acknowledgment that address the recognition of external parties who were instrumental in the discovery, reporting and response of this document. + + + + + + + + + + The optional URL to the person, place, or thing being acknowledged. + + + + + + + + + + + + + + + This is to ensure that each Vulnerability's Ordinal uses a unique value. + + + + + + + This is to ensure that each note has a unique ordinal value. + + + + + + + A key to reference a specific product defined in a referenced product schema. + + + + + + + An instance of the ProductKey to be used in the ProductID element for affected products. + + + + + + + An instance of the ProductKey to be used in the CVSS ScoreSet product references. + + + + + + + An instance of the ProductKey to be used in the Threat product references. + + + + + + + An instance of the ProductKey to be used in the Remediation product references. + + + + + + + A key to reference a specific product group defined in a referenced product schema. + + + + + + + An instance of the GroupKey to be used in the Threat product references. + + + + + + + An instance of the GroupKey to be used in the Remediation product references. + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/dublincore/dc.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/dublincore/dc.xsd new file mode 100755 index 000000000..29d64a5b2 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/dublincore/dc.xsd @@ -0,0 +1,118 @@ + + + + + + DCMES 1.1 XML Schema + XML Schema for http://purl.org/dc/elements/1.1/ namespace + + Created 2008-02-11 + + Created by + + Tim Cole (t-cole3@uiuc.edu) + Tom Habing (thabing@uiuc.edu) + Jane Hunter (jane@dstc.edu.au) + Pete Johnston (p.johnston@ukoln.ac.uk), + Carl Lagoze (lagoze@cs.cornell.edu) + + This schema declares XML elements for the 15 DC elements from the + http://purl.org/dc/elements/1.1/ namespace. + + It defines a complexType SimpleLiteral which permits mixed content + and makes the xml:lang attribute available. It disallows child elements by + use of minOcccurs/maxOccurs. + + However, this complexType does permit the derivation of other complexTypes + which would permit child elements. + + All elements are declared as substitutable for the abstract element any, + which means that the default type for all elements is dc:SimpleLiteral. + + + + + + + + + + + + + This is the default type for all of the DC elements. + It permits text content only with optional + xml:lang attribute. + Text is allowed because mixed="true", but sub-elements + are disallowed because minOccurs="0" and maxOccurs="0" + are on the xs:any tag. + + This complexType allows for restriction or extension permitting + child elements. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + This group is included as a convenience for schema authors + who need to refer to all the elements in the + http://purl.org/dc/elements/1.1/ namespace. + + + + + + + + + + + + + + This complexType is included as a convenience for schema authors who need to define a root + or container element for all of the DC elements. + + + + + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/prod/.svn/all-wcprops b/vulnerabilities/scraper/cvrf_parser/schemata/prod/.svn/all-wcprops new file mode 100755 index 000000000..ed7742176 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/prod/.svn/all-wcprops @@ -0,0 +1,5 @@ +K 25 +svn:wc:ra_dav:version-url +V 47 +/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/prod +END diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/prod/.svn/entries b/vulnerabilities/scraper/cvrf_parser/schemata/prod/.svn/entries new file mode 100755 index 000000000..154f4940a --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/prod/.svn/entries @@ -0,0 +1,31 @@ +10 + +dir +91 +https://subversion.assembla.com/svn/icasi-cvrf/trunk/schemata/prod +https://subversion.assembla.com/svn/icasi-cvrf + + + +2012-05-07T17:25:01.568574Z +82 +xorrkaz + + + + + + + + + + + + + + +085eb5b6-75e8-47bc-a513-804b55a9b1a4 + +1.1 +dir + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/all-wcprops b/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/all-wcprops new file mode 100755 index 000000000..82e3603a8 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/all-wcprops @@ -0,0 +1,11 @@ +K 25 +svn:wc:ra_dav:version-url +V 51 +/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/prod/1.1 +END +prod.xsd +K 25 +svn:wc:ra_dav:version-url +V 60 +/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/prod/1.1/prod.xsd +END diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/entries b/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/entries new file mode 100755 index 000000000..b39f9dd22 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/entries @@ -0,0 +1,62 @@ +10 + +dir +91 +https://subversion.assembla.com/svn/icasi-cvrf/trunk/schemata/prod/1.1 +https://subversion.assembla.com/svn/icasi-cvrf + + + +2012-05-07T17:25:01.568574Z +82 +xorrkaz + + + + + + + + + + + + + + +085eb5b6-75e8-47bc-a513-804b55a9b1a4 + +prod.xsd +file + + + + +2012-05-07T19:31:33.000000Z +af4c32fc699ecfd62880f88ccddf3208 +2012-05-07T17:25:01.568574Z +82 +xorrkaz +has-props + + + + + + + + + + + + + + + + + + + + +15519 + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/prop-base/prod.xsd.svn-base b/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/prop-base/prod.xsd.svn-base new file mode 100755 index 000000000..869ac71cf --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/prop-base/prod.xsd.svn-base @@ -0,0 +1,5 @@ +K 14 +svn:executable +V 1 +* +END diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/text-base/prod.xsd.svn-base b/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/text-base/prod.xsd.svn-base new file mode 100755 index 000000000..4feb771c6 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/text-base/prod.xsd.svn-base @@ -0,0 +1,292 @@ + + + + + + + + + + + + + + + This is the XML schema for the Common Vulnerability Reporting Framework's Product model. For more information, see the CVRF whitepaper. + + Joe Hemmerlein <joe.hemmerlein@microsoft.com> + Joe Clarke <jclarke@cisco.com> + 2012-05-07 + CVRF Product Dictionary + 1.1 + + + + + + + + Types enumerating the individual parts (stubs) that comprise a product name. + + + + + The name of the vendor or manufacturer that makes the product . + + + + + The product family that the product falls into. + + + + + The name of the product. + + + + + The version of the product. This can be a numeric or other descriptor. + + + + + The patch level of the product. + + + + + The service pack of the product. + + + + + The architecture for which the product is intended. + + + + + The language of the product. + + + + + A non-specific legacy entry. + + + + + A specification such as a standard, best common practice, etc. + + + + + The host name of a system/service. + + + + + The URI component of a system/service. + + + + + The file name component of a system/service. + + + + + + + Types enumerating the ways products can be related to each other. + + + + + This product is a default component of the referenced product. + + + + + This product is an optional component of the referenced product. + + + + + This product is an external component of the referenced product. + + + + + This product is installed on the referenced product. + + + + + This product is installed with the referenced product. + + + + + + + + + + + + + + + + + + Neutral product tree to streamline product entries that can be referenced elsewhere in the document. The end of each branch ("FullProductName") represents a referrenceable product. + + + + + + + + Defines how this product is related to another product. + + + + + + + + The ProductReference refers to the unique ProductID of the product that is to which another product will be related. + + + + + The RelationType attribute defines how the two products are related. + + + + + RelatesToProductReference refers to the unique ProductID of the product to which the ProductReference attribute value relates. + + + + + + + Container for grouping products to be used in vulnerabilities. + + + + + + A named container to associate two or more product IDs together for use in vulnerabilities. + + + + + + Optional textual description for this group. + + + + + + + + + + The ID of an existing product in this tree that is to be a member of this group. + + + + + + The unique identifier used to reference this group. + + + + + + + + + + + + This is to ensure that each FullProductName uses a unique ProductID value. + + + + + + + This is to ensure that each Group uses a unique GroupID value. + + + + + + + A key to reference a specific product. + + + + + + + An instance of the ProductKey used to define a relationship product. + + + + + + + An instance of the ProductKey used to define a related product. + + + + + + + An instance of the ProductKey used to define a product group membership list. + + + + + + + + Endpoint of product tree - this is an actual product entry. The string represents the friendly product name (i.e. the way it would be printed in other publications) + + + + + + + A value that uniquely identifies this Product entry in the scope of this document. Whenever a reference to this Product entry is needed anywhere in this document, its unique ID will be referenced. + + + + + The Common Platform Enumeration (CPE) attribute refers to a method for naming platforms. The structure for CPE is described at http://cpe.mitre.org. + + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/prod.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/prod.xsd new file mode 100755 index 000000000..4feb771c6 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/prod.xsd @@ -0,0 +1,292 @@ + + + + + + + + + + + + + + + This is the XML schema for the Common Vulnerability Reporting Framework's Product model. For more information, see the CVRF whitepaper. + + Joe Hemmerlein <joe.hemmerlein@microsoft.com> + Joe Clarke <jclarke@cisco.com> + 2012-05-07 + CVRF Product Dictionary + 1.1 + + + + + + + + Types enumerating the individual parts (stubs) that comprise a product name. + + + + + The name of the vendor or manufacturer that makes the product . + + + + + The product family that the product falls into. + + + + + The name of the product. + + + + + The version of the product. This can be a numeric or other descriptor. + + + + + The patch level of the product. + + + + + The service pack of the product. + + + + + The architecture for which the product is intended. + + + + + The language of the product. + + + + + A non-specific legacy entry. + + + + + A specification such as a standard, best common practice, etc. + + + + + The host name of a system/service. + + + + + The URI component of a system/service. + + + + + The file name component of a system/service. + + + + + + + Types enumerating the ways products can be related to each other. + + + + + This product is a default component of the referenced product. + + + + + This product is an optional component of the referenced product. + + + + + This product is an external component of the referenced product. + + + + + This product is installed on the referenced product. + + + + + This product is installed with the referenced product. + + + + + + + + + + + + + + + + + + Neutral product tree to streamline product entries that can be referenced elsewhere in the document. The end of each branch ("FullProductName") represents a referrenceable product. + + + + + + + + Defines how this product is related to another product. + + + + + + + + The ProductReference refers to the unique ProductID of the product that is to which another product will be related. + + + + + The RelationType attribute defines how the two products are related. + + + + + RelatesToProductReference refers to the unique ProductID of the product to which the ProductReference attribute value relates. + + + + + + + Container for grouping products to be used in vulnerabilities. + + + + + + A named container to associate two or more product IDs together for use in vulnerabilities. + + + + + + Optional textual description for this group. + + + + + + + + + + The ID of an existing product in this tree that is to be a member of this group. + + + + + + The unique identifier used to reference this group. + + + + + + + + + + + + This is to ensure that each FullProductName uses a unique ProductID value. + + + + + + + This is to ensure that each Group uses a unique GroupID value. + + + + + + + A key to reference a specific product. + + + + + + + An instance of the ProductKey used to define a relationship product. + + + + + + + An instance of the ProductKey used to define a related product. + + + + + + + An instance of the ProductKey used to define a product group membership list. + + + + + + + + Endpoint of product tree - this is an actual product entry. The string represents the friendly product name (i.e. the way it would be printed in other publications) + + + + + + + A value that uniquely identifies this Product entry in the scope of this document. Whenever a reference to this Product entry is needed anywhere in this document, its unique ID will be referenced. + + + + + The Common Platform Enumeration (CPE) attribute refers to a method for naming platforms. The structure for CPE is described at http://cpe.mitre.org. + + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.2/prod.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.2/prod.xsd new file mode 100755 index 000000000..547fc57e6 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.2/prod.xsd @@ -0,0 +1,343 @@ + + + + + + + + + + + + + + + + + + + This is the XML schema for the Product Tree + sub model of the OASIS Common Security Advisory Framework (CSAF) TC's + CVRF (Common Vulnerability Reporting Framework). + + Feng Cao (feng.cao@oracle.com) + Stefan Hagen (stefan@hagen.link() + 2017-05-24 + CSAF CVRF Product Tree sub model + 1.2 + + + + + + + + Types enumerating the individual parts (stubs) that comprise a + product name. + + + + + The name of the vendor or manufacturer that makes the + product . + + + + + The product family that the product falls + into. + + + + + The name of the product. + + + + + The version of the product. This can be a numeric or other + descriptor. + + + + + The patch level of the product. + + + + + The service pack of the product. + + + + + The architecture for which the product is + intended. + + + + + The language of the product. + + + + + A non-specific legacy entry. + + + + + A specification such as a standard, best common practice, + etc. + + + + + The host name of a system/service. + + + + + The URI component of a system/service. + + + + + The file name component of a + system/service. + + + + + + + Types enumerating the ways products can be related to each + other. + + + + + This product is a default component of the referenced + product. + + + + + This product is an optional component of the referenced + product. + + + + + This product is an external component of the referenced + product. + + + + + This product is installed on the referenced + product. + + + + + This product is installed with the referenced + product. + + + + + + + + + + + + + + + + + + Neutral product tree to streamline product entries that can be + referenced elsewhere in the document. The end of each branch ("FullProductName") represents + a referrenceable product. + + + + + + + + Defines how this product is related to another + product. + + + + + + + + The ProductReference refers to the unique ProductID + of the product that is to which another product will be + related. + + + + + The RelationType attribute defines how the two + products are related. + + + + + RelatesToProductReference refers to the unique + ProductID of the product to which the ProductReference attribute value + relates. + + + + + + + Container for grouping products to be used in + vulnerabilities. + + + + + + A named container to associate two or more product + IDs together for use in vulnerabilities. + + + + + + Optional textual description for this + group. + + + + + + + + + + The ID of an existing product in this tree + that is to be a member of this group. + + + + + + The unique identifier used to reference this + group. + + + + + + + + + + + + This is to ensure that each FullProductName uses a unique + ProductID value. + + + + + + + This is to ensure that each Group uses a unique GroupID + value. + + + + + + + A key to reference a specific product. + + + + + + + An instance of the ProductKey used to define a relationship + product. + + + + + + + An instance of the ProductKey used to define a related + product. + + + + + + + An instance of the ProductKey used to define a product group + membership list. + + + + + + + + Endpoint of product tree - this is an actual product entry. + The string represents the friendly product name (i.e. the way it would be printed in other + publications) + + + + + + + A value that uniquely identifies this Product entry in + the scope of this document. Whenever a reference to this Product entry is needed + anywhere in this document, its unique ID will be referenced. + + + + + The Common Platform Enumeration (CPE) attribute refers + to a method for naming platforms. The structure for CPE is described at + http://cpe.mitre.org. + + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/scap/cpe-language_2.2a.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/scap/cpe-language_2.2a.xsd new file mode 100755 index 000000000..8b50a820e --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/scap/cpe-language_2.2a.xsd @@ -0,0 +1,182 @@ + + + + + This XML Schema defines the CPE Language. An individual + CPE Name addresses a single part of an actual system. To identify more complex + platform types, there needs to be a way to combine different CPE Names using + logical operators. For example, there may be a need to identify a platform with a + particular operating system AND a certain application. The CPE Language exists to + satisfy this need, enabling the CPE Name for the operating system to be combined + with the CPE Name for the application. For more information, consult the CPE + Specification document. + + CPE Language + Neal Ziring, Andrew Buttner, David Waltermire + 2.2 + 10/27/2008 10:00:00 AM + + + + + + + + + This element is the root element of a CPE + Language XML documents and therefore acts as a container for child platform + definitions. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The platform element represents the description + or qualifications of a particular IT platform type. The platform is defined + by the logical-test child element. + + + + + The optional title element may appear as a child + to a platform element. It provides a human-readable title for it. To support + uses intended for multiple languages, this element supports the ‘xml:lang’ + attribute. At most one title element can appear for each language. + + + + + The optional remark element may appear as a child + of a platform element. It provides some additional description. Zero or more + remark elements may appear. To support uses intended for multiple languages, + this element supports the ‘xml:lang’ attribute. There can be multiple + remarks for a single language. + + + + + + + + + + + The id attribute holds a locally unique + name for the platform. There is no defined format for this id, it just has + to be unique to the containing language document. + + + + + + + + The logical-test element appears as a child of a + platform element, and may also be nested to create more complex logical + tests. The content consists of one or more elements: fact-ref, and + logical-test children are permitted. The operator to be applied, and + optional negation of the test, are given as attributes. + + + + + + + + + + + + + + + The fact-ref element appears as a + child of a logical-test element. It is simply a reference to a CPE Name that + always evaluates to a Boolean result. + + + + + + + + + + The OperatorEnumeration simple type defines + acceptable operators. Each operator defines how to evaluate multiple + arguments. + + + + + + + + + + + + This type allows the xml:lang attribute to + associate a specific language with an element's string + content. + + + + + + + + + + + + + Define the format for acceptable CPE Names. A URN + format is used with the id starting with the word cpe followed by :/ and + then some number of individual components separated by + colons. + + + + + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/scap/cvss-v2_0.9.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/scap/cvss-v2_0.9.xsd new file mode 100755 index 000000000..f68fb81cf --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/scap/cvss-v2_0.9.xsd @@ -0,0 +1,415 @@ + + + + + + + + + + + + Value restriction to single decimal values from 0.0 to 10.0, as used in CVSS scores + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Indicates if the vector has been approximated as the result of an upgrade from a previous CVSS version + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + "This schema was intentionally designed to avoid mixing classes and attributes between CVSS version 1, CVSS version 2, and future versions. Scores in the CVSS system are interdependent. The temporal score is a multiplier of the base score. The environmental score, in turn, is a multiplier of the temporal score. The ability to transfer these scores independently is provided on the assumption that the user understands the business logic. For any given metric, it is preferred that the score, as a minimum is provided, however the score can be re-created from the metrics or the multiplier and any scores they are dependent on." + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Base type for metrics that defines common attributes of all metrics. + + + + Indicates if the metrics have been upgraded from a previous version of CVSS. If fields that were approximated will have an approximated attribute set to 'true'. + + + + + + + + + + + + + Base severity score assigned to a vulnerability by a source + + + + + Base exploit sub-score assigned to a vulnerability by a source + + + + + Base impact sub-score assigned to a vulnerability by a source + + + + + + Data source the vector was obtained from. Example: http://nvd.nist.gov or com.symantec.deepsight + + + + + + + + + + + + + + + + + + + Data source the vector was obtained from. Example: gov.nist.nvd or com.symantec.deepsight + + + + + + + + + + + + + + + + + The temporal score is the temporal multiplier times the base score. + + + + + The temporal multiplier is a number between zero and one. Reference the CVSS standard for computation. + + + + + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/scap/cvss-v3.0.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/scap/cvss-v3.0.xsd new file mode 100755 index 000000000..b36e0ce7d --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/scap/cvss-v3.0.xsd @@ -0,0 +1,285 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Value restriction to single decimal values from 0.0 to 10.0, as used in CVSS scores + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/scap/scap-core_0.9.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/scap/scap-core_0.9.xsd new file mode 100755 index 000000000..19a91c8d7 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/scap/scap-core_0.9.xsd @@ -0,0 +1,170 @@ + + + + + + + + + + + + + + + Data type for the check element, a checking system specification URI, string content, and an optional external file reference. The checking system specification should be the URI for a particular version of OVAL or a related system testing language, and the content will be an identifier of a test written in that language. The external file reference could be used to point to the file in which the content test identifier is defined. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Denotes a scanner and required configuration that is capable of detecting the referenced vulnerability. May also be an OVAL definition and omit scanner name. + Identifies a tool and any associated information about the tool, such as signature versions, that indicate the tool is capable or properly detecting and/or remdiating the vulnerability or misconfiguration + + + + + Identifies a check that can be used to detect the vulnerability or misconfiguration + + + + + The CPE name of the scanning tool. A value must be supplied for this element. The CPE name can be used for a CPE from the NVD. The CPE title attribute can be used for internal naming conventions. (or both, if possible) + + + + + + + + + + + + + + + + + + + + Define the format for acceptable CPE Names. An urn format is used with the id starting with the word oval followed by a unique string, followed by the three letter code 'def', and ending with an integer. + + + + + + + + + Define the format for acceptable CPE Names. A URN format is used with the id starting with the word cpe followed by :/ and then some number of individual components separated by colons. + + + + + + + + + Define the format for acceptable + searchableCPE Names. The URI escaped code '%25' may be used + to represent the character '%' which will be interpreted as a + wildcard. + + + + + + + + + The name pattern of a CPE component. + + + + + + + + + The name pattern of the CPE part component. + + + + + + + + + + + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/vuln/.svn/all-wcprops b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/.svn/all-wcprops new file mode 100755 index 000000000..d0161ea70 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/.svn/all-wcprops @@ -0,0 +1,5 @@ +K 25 +svn:wc:ra_dav:version-url +V 47 +/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/vuln +END diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/vuln/.svn/entries b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/.svn/entries new file mode 100755 index 000000000..88b5c04ed --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/.svn/entries @@ -0,0 +1,31 @@ +10 + +dir +91 +https://subversion.assembla.com/svn/icasi-cvrf/trunk/schemata/vuln +https://subversion.assembla.com/svn/icasi-cvrf + + + +2012-05-07T17:25:01.568574Z +82 +xorrkaz + + + + + + + + + + + + + + +085eb5b6-75e8-47bc-a513-804b55a9b1a4 + +1.1 +dir + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/all-wcprops b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/all-wcprops new file mode 100755 index 000000000..455c82a85 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/all-wcprops @@ -0,0 +1,11 @@ +K 25 +svn:wc:ra_dav:version-url +V 51 +/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/vuln/1.1 +END +vuln.xsd +K 25 +svn:wc:ra_dav:version-url +V 60 +/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/vuln/1.1/vuln.xsd +END diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/entries b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/entries new file mode 100755 index 000000000..52d8c07a8 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/entries @@ -0,0 +1,62 @@ +10 + +dir +91 +https://subversion.assembla.com/svn/icasi-cvrf/trunk/schemata/vuln/1.1 +https://subversion.assembla.com/svn/icasi-cvrf + + + +2012-05-07T17:25:01.568574Z +82 +xorrkaz + + + + + + + + + + + + + + +085eb5b6-75e8-47bc-a513-804b55a9b1a4 + +vuln.xsd +file + + + + +2012-05-07T19:31:33.000000Z +af8dd0239812a299f8ad2501d6c1d254 +2012-05-07T17:25:01.568574Z +82 +xorrkaz + + + + + + + + + + + + + + + + + + + + + +35659 + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/text-base/vuln.xsd.svn-base b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/text-base/vuln.xsd.svn-base new file mode 100755 index 000000000..7e3a1e013 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/text-base/vuln.xsd.svn-base @@ -0,0 +1,631 @@ + + + + + + + + + + + + + + + + This is the XML schema for the Common Vulnerability Reporting Framework's Vulnerability model. For more information, see the CVRF whitepaper. + + Brian Schafer <bschafer@microsoft.com> + Joe Clarke <jclarke@cisco.com> + Joe Hemmerlein <Joe.Hemmerlein@microsoft.com> + 2012-05-07 + CVRF Vulnerability Dictionary + 1.1 + + + + + + + + Types enumerating a party's current engagement status for this vulnerability. + + + + + The party has acknowledged that they are aware of the vulnerability report. + + + + + The party disputes the vulnerability report in its entirety + + + + + Some hot-fixes, permanent fixes, or patches have been made available by the party, but more fixes or patches are going to be released in the future. + + + + + The party asserts that they have completed remediation of the vulnerability. + + + + + The party has been contacted, but was unresponsive or unavailable. + + + + + No contact has been attempted with the party. + + + + + + + String type to match CVE IDs + + + + + + + + String type to match CWE IDs + + + + + + + + String representing the components needed to compute the various CVSS scores + + + + + + + + Types enumerating the affected statuses described by a vulnerability + + + + + The first version known to be affected by this vulnerability. + + + + + This version is the first fixed version for the vulnerability but may not be the recommended fixed version. + + + + + This version is contains a fix for the vulnerability but may not be the recommended fixed version. + + + + + This version is known to be affected by the vulnerability. + + + + + This version is known NOT to be affected by the vulnerability. + + + + + This is the last version in a train known to be affected. Versions released after this would contain a fix for this vulnerability. + + + + + This version has a fix for the vulnerability and is the vendor-recommended version for fixing the vulnerability. + + + + + + + Types enumerating the Threat type described by the vulnerability + + + + + Impact contains an assessment of the impact on the user or the target set if the vulnerability is successful exploited. + + + + + Exploit Status contains a description of the degree to which an exploit for the vulnerability is known. + + + + + Target Set contains a description of the currently known victim population in whatever terms are appropriate. + + + + + + + Types enumerating the Remedy type described by the vulnerability. + + + + + Workaround contains information about a configuration or specific deployment scenario that can be used to avoid exposure to the vulnerability. + + + + + Mitigation contains information about a configuration or deployment scenario that helps to reduce the risk of the vulnerability but that does not resolve the vulnerability on the affected product. + + + + + Vendor Fix contains information about an official fix that is issued by the original author of the affected product. + + + + + Currently there is no fix available. + + + + + There is no fix for the vulnerability and there never will be one. + + + + + + + Existing product ID from the product tree. + + + + + Existing product group ID from the product tree. + + + + + + + + This is a meta-container for the aggregation of all fields that are related to a single vulnerability within the document. + + + + + + Vulnerability Title gives the document producer the ability to apply a canonical name or title to the vulnerability. + + + + + + + + + + Vulnerability ID gives the document producer a place to publish a unique label or tracking ID for the vulnerability (if such information exists). + + + + + + + System Name indicates the name of the vulnerability tracking or numbering system that this vulnerability ID comes from. + + + + + + + + + The Notes container holds all individual notes concerning this vulnerability. + + + + + + The Notes text contains all of the content necessary to provide different types of low-level discussions of a given vulnerability to various audiences. + + + + + + + Title should be a concise description of what is contained in Vulnerability Notes. + + + + + Audience will indicate who is intended to read the note. + + + + + Type of content within this note. + + + + + Ordinal is a locally significant integral counter indexed from 1 used to track notes. + + + + + + + + + + + + Date vulnerability was initially discovered by its original discoverer. + + + + + Date vulnerability was initially released to the public. + + + + + The Involvements container lists any number of vendor or third party interactions related to this vulnerability. + + + + + + Involvement contains a specific set of interaction details. + + + + + + The description of the Involvement. + + + + + + + + + + + Type of party with whom the involvement is taking place. + + + + + Status of the involvement with the specified party. + + + + + + + + + + The CVE string refers to the MITRE standard Common Vulnerabilities Enumeration (CVE) tracking number for the vulnerability. + + + + + Detailed description of the referrenced Common Weakness Enumeration (CWE) identifier. + + + + + + + The MITRE-assigned CWE identifier. + + + + + + + + + The ProductStatuses container holds the list of all the products affected by the vulnerability in question. + + + + + + The Status element holds an enumerated value based on available Product Name Entry items as constructed from the Product Tree container. + + + + + + + + Affected status for the product or products defined in this container. + + + + + + + + + + Contains all Threat containers + + + + + + Threat contains the "kinetic" information associated with a vulnerability. + + + + + + The description of the Threat. + + + + + + + + + + + + + The type of the Threat. + + + + + The date this Threat item was last updated; if omitted it is deemed to be unknown, irrelevant, or unimportant. + + + + + + + + + + The CVSS Score Set meta-container holds one or more CVSS score sets to describe vulnerable products. + + + + + + CVSS scores for a given product ID.  If the ProductID attribute is omitted, the score applies to all vulnerable products. + + + + + + The CVSS Base Score is the numeric value of the computed CVSS Base Score which should be a float from 0 – 10.0. + + + + + The CVSS Base Score is the numeric value of the computed CVSS Temporal Score which should be a float from 0 – 10.0. + + + + + The CVSS Base Score is the numeric value of the computed CVSS Environmental Score which should be a float from 0 – 10.0. + + + + + The CVSS Vector string is the official notation that contains all of the values used to compute the Base, Temporal, and Environmental scores. + + + + + + + + + + + + The Remediation meta-container tag holds all related Workaround, Mitigation, Vendor Fix, and Entitlement entries that are associated with the specific vulnerability. + + + + + + Holds all of the specific details on how to handle (and presumably, fix) the vulnerability, tied to Product ID. + + + + + + Textual description of this remedy. + + + + + + + + + + The Entitlement string will contain any possible vendor-defined constraints for obtaining fixed software or hardware that fully resolves the vulnerability. + + + + + + + + + + URL from which the remedy can be obtained. + + + + + + + + Specific type of remedy. + + + + + The date Remedy was last updated, if omitted it is deemed to be unknown, unimportant, or irrelevant. + + + + + + + + + + This meta-container should include references to any conferences, papers, advisories, and other resources that are related to this vulnerability. + + + + + + This meta-container contains an orthogonally related document, background info, whitepaper, etc. to the specific vulnerability. + + + + + + The URL of the related document. + + + + + The description of the related document. + + + + + + + + + + + Enumerated type value of reference relative to this document. + + + + + + + + + + The Acknowledgments container holds one or more Acknowledgement containers for vulnerability-level acknowledgements. + + + + + + The Acknowledgment container holds recognition for external parties who were instrumental in the discovery of, reporting of, and response to the vulnerability. + + + + + + The name (i.e., individual name) of the party being acknowledged. + + + + + + + + + + The organization of the party being acknowledged or the organization itself being acknowledged. + + + + + + + + + + The details of the acknowledgment that address the recognition of external parties who were instrumental in the discovery, reporting and response of this document. + + + + + + + + + + The optional URL to the person, place, or thing being acknowledged. + + + + + + + + + + + + Locally significant numeric value to track vulnerabilities within a CVRF document. This enables vulnerabilities to be referenced from elsewhere inside the document (often at the document-level) + + + + + + This is to ensure that each product mentions a given ProductID only one. + + + + + + + This is to ensure that each CVSS score set mentions a given ProductID only one. + + + + + + + This is to ensure that each note has a unique ordinal value. + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/vuln.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/vuln.xsd new file mode 100755 index 000000000..7e3a1e013 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/vuln.xsd @@ -0,0 +1,631 @@ + + + + + + + + + + + + + + + + This is the XML schema for the Common Vulnerability Reporting Framework's Vulnerability model. For more information, see the CVRF whitepaper. + + Brian Schafer <bschafer@microsoft.com> + Joe Clarke <jclarke@cisco.com> + Joe Hemmerlein <Joe.Hemmerlein@microsoft.com> + 2012-05-07 + CVRF Vulnerability Dictionary + 1.1 + + + + + + + + Types enumerating a party's current engagement status for this vulnerability. + + + + + The party has acknowledged that they are aware of the vulnerability report. + + + + + The party disputes the vulnerability report in its entirety + + + + + Some hot-fixes, permanent fixes, or patches have been made available by the party, but more fixes or patches are going to be released in the future. + + + + + The party asserts that they have completed remediation of the vulnerability. + + + + + The party has been contacted, but was unresponsive or unavailable. + + + + + No contact has been attempted with the party. + + + + + + + String type to match CVE IDs + + + + + + + + String type to match CWE IDs + + + + + + + + String representing the components needed to compute the various CVSS scores + + + + + + + + Types enumerating the affected statuses described by a vulnerability + + + + + The first version known to be affected by this vulnerability. + + + + + This version is the first fixed version for the vulnerability but may not be the recommended fixed version. + + + + + This version is contains a fix for the vulnerability but may not be the recommended fixed version. + + + + + This version is known to be affected by the vulnerability. + + + + + This version is known NOT to be affected by the vulnerability. + + + + + This is the last version in a train known to be affected. Versions released after this would contain a fix for this vulnerability. + + + + + This version has a fix for the vulnerability and is the vendor-recommended version for fixing the vulnerability. + + + + + + + Types enumerating the Threat type described by the vulnerability + + + + + Impact contains an assessment of the impact on the user or the target set if the vulnerability is successful exploited. + + + + + Exploit Status contains a description of the degree to which an exploit for the vulnerability is known. + + + + + Target Set contains a description of the currently known victim population in whatever terms are appropriate. + + + + + + + Types enumerating the Remedy type described by the vulnerability. + + + + + Workaround contains information about a configuration or specific deployment scenario that can be used to avoid exposure to the vulnerability. + + + + + Mitigation contains information about a configuration or deployment scenario that helps to reduce the risk of the vulnerability but that does not resolve the vulnerability on the affected product. + + + + + Vendor Fix contains information about an official fix that is issued by the original author of the affected product. + + + + + Currently there is no fix available. + + + + + There is no fix for the vulnerability and there never will be one. + + + + + + + Existing product ID from the product tree. + + + + + Existing product group ID from the product tree. + + + + + + + + This is a meta-container for the aggregation of all fields that are related to a single vulnerability within the document. + + + + + + Vulnerability Title gives the document producer the ability to apply a canonical name or title to the vulnerability. + + + + + + + + + + Vulnerability ID gives the document producer a place to publish a unique label or tracking ID for the vulnerability (if such information exists). + + + + + + + System Name indicates the name of the vulnerability tracking or numbering system that this vulnerability ID comes from. + + + + + + + + + The Notes container holds all individual notes concerning this vulnerability. + + + + + + The Notes text contains all of the content necessary to provide different types of low-level discussions of a given vulnerability to various audiences. + + + + + + + Title should be a concise description of what is contained in Vulnerability Notes. + + + + + Audience will indicate who is intended to read the note. + + + + + Type of content within this note. + + + + + Ordinal is a locally significant integral counter indexed from 1 used to track notes. + + + + + + + + + + + + Date vulnerability was initially discovered by its original discoverer. + + + + + Date vulnerability was initially released to the public. + + + + + The Involvements container lists any number of vendor or third party interactions related to this vulnerability. + + + + + + Involvement contains a specific set of interaction details. + + + + + + The description of the Involvement. + + + + + + + + + + + Type of party with whom the involvement is taking place. + + + + + Status of the involvement with the specified party. + + + + + + + + + + The CVE string refers to the MITRE standard Common Vulnerabilities Enumeration (CVE) tracking number for the vulnerability. + + + + + Detailed description of the referrenced Common Weakness Enumeration (CWE) identifier. + + + + + + + The MITRE-assigned CWE identifier. + + + + + + + + + The ProductStatuses container holds the list of all the products affected by the vulnerability in question. + + + + + + The Status element holds an enumerated value based on available Product Name Entry items as constructed from the Product Tree container. + + + + + + + + Affected status for the product or products defined in this container. + + + + + + + + + + Contains all Threat containers + + + + + + Threat contains the "kinetic" information associated with a vulnerability. + + + + + + The description of the Threat. + + + + + + + + + + + + + The type of the Threat. + + + + + The date this Threat item was last updated; if omitted it is deemed to be unknown, irrelevant, or unimportant. + + + + + + + + + + The CVSS Score Set meta-container holds one or more CVSS score sets to describe vulnerable products. + + + + + + CVSS scores for a given product ID.  If the ProductID attribute is omitted, the score applies to all vulnerable products. + + + + + + The CVSS Base Score is the numeric value of the computed CVSS Base Score which should be a float from 0 – 10.0. + + + + + The CVSS Base Score is the numeric value of the computed CVSS Temporal Score which should be a float from 0 – 10.0. + + + + + The CVSS Base Score is the numeric value of the computed CVSS Environmental Score which should be a float from 0 – 10.0. + + + + + The CVSS Vector string is the official notation that contains all of the values used to compute the Base, Temporal, and Environmental scores. + + + + + + + + + + + + The Remediation meta-container tag holds all related Workaround, Mitigation, Vendor Fix, and Entitlement entries that are associated with the specific vulnerability. + + + + + + Holds all of the specific details on how to handle (and presumably, fix) the vulnerability, tied to Product ID. + + + + + + Textual description of this remedy. + + + + + + + + + + The Entitlement string will contain any possible vendor-defined constraints for obtaining fixed software or hardware that fully resolves the vulnerability. + + + + + + + + + + URL from which the remedy can be obtained. + + + + + + + + Specific type of remedy. + + + + + The date Remedy was last updated, if omitted it is deemed to be unknown, unimportant, or irrelevant. + + + + + + + + + + This meta-container should include references to any conferences, papers, advisories, and other resources that are related to this vulnerability. + + + + + + This meta-container contains an orthogonally related document, background info, whitepaper, etc. to the specific vulnerability. + + + + + + The URL of the related document. + + + + + The description of the related document. + + + + + + + + + + + Enumerated type value of reference relative to this document. + + + + + + + + + + The Acknowledgments container holds one or more Acknowledgement containers for vulnerability-level acknowledgements. + + + + + + The Acknowledgment container holds recognition for external parties who were instrumental in the discovery of, reporting of, and response to the vulnerability. + + + + + + The name (i.e., individual name) of the party being acknowledged. + + + + + + + + + + The organization of the party being acknowledged or the organization itself being acknowledged. + + + + + + + + + + The details of the acknowledgment that address the recognition of external parties who were instrumental in the discovery, reporting and response of this document. + + + + + + + + + + The optional URL to the person, place, or thing being acknowledged. + + + + + + + + + + + + Locally significant numeric value to track vulnerabilities within a CVRF document. This enables vulnerabilities to be referenced from elsewhere inside the document (often at the document-level) + + + + + + This is to ensure that each product mentions a given ProductID only one. + + + + + + + This is to ensure that each CVSS score set mentions a given ProductID only one. + + + + + + + This is to ensure that each note has a unique ordinal value. + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.2/vuln.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.2/vuln.xsd new file mode 100755 index 000000000..3e39ecc69 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.2/vuln.xsd @@ -0,0 +1,812 @@ + + + + + + + + + + + + + + + + + + + + + + + This is the XML schema for the Vulnerability + sub model of the OASIS Common Security Advisory Framework (CSAF) TC's + CVRF (Common Vulnerability Reporting Framework). + + Art Manion (amanion@cert.org) + Feng Cao (feng.cao@oracle.com) + Harold Booth (harold.booth@nist.gov) + Stefan Hagen (stefan@hagen.link) + Troy Fridley (trfridle@cisco.com) + 2017-05-24 + CSAF CVRF Vulnerability sub model + 1.2 + + + + + + + + Types enumerating a party's current engagement status for this + vulnerability. + + + + + The party has acknowledged that they are aware of the + vulnerability report. + + + + + The party disputes the vulnerability report in its + entirety + + + + + Some hot-fixes, permanent fixes, or patches have been made + available by the party, but more fixes or patches are going to be released in the + future. + + + + + The party asserts that they have completed remediation of + the vulnerability. + + + + + The party has been contacted, but was unresponsive or + unavailable. + + + + + No contact has been attempted with the + party. + + + + + + + String type to match CVE IDs + + + + + + + + String type to match CWE IDs + + + + + + + + String representing the components needed to compute the + various CVSS scores + + + + + + + + String representing the components needed to compute the + various CVSS version 3 scores which can be longer than v2 scores (up to 138 characters). + + + + + + + + Types enumerating the affected statuses described by a + vulnerability + + + + + The first version known to be affected by this + vulnerability. + + + + + This version is the first fixed version for the + vulnerability but may not be the recommended fixed version. + + + + + This version is contains a fix for the vulnerability but + may not be the recommended fixed version. + + + + + This version is known to be affected by the + vulnerability. + + + + + This version is known NOT to be affected by the + vulnerability. + + + + + This is the last version in a train known to be affected. + Versions released after this would contain a fix for this + vulnerability. + + + + + This version has a fix for the vulnerability and is the + vendor-recommended version for fixing the vulnerability. + + + + + + + Types enumerating the Threat type described by the + vulnerability + + + + + Impact contains an assessment of the impact on the user or + the target set if the vulnerability is successful exploited. + + + + + Exploit Status contains a description of the degree to + which an exploit for the vulnerability is known. + + + + + Target Set contains a description of the currently known + victim population in whatever terms are appropriate. + + + + + + + Types enumerating the Remedy type described by the + vulnerability. + + + + + Workaround contains information about a configuration or + specific deployment scenario that can be used to avoid exposure to the + vulnerability. + + + + + Mitigation contains information about a configuration or + deployment scenario that helps to reduce the risk of the vulnerability but that does not + resolve the vulnerability on the affected product. + + + + + Vendor Fix contains information about an official fix that + is issued by the original author of the affected product. + + + + + Currently there is no fix available. + + + + + There is no fix for the vulnerability and there never will + be one. + + + + + + + Existing product ID from the product tree. + + + + + Existing product group ID from the product + tree. + + + + + + + + This is a meta-container for the aggregation of all fields + that are related to a single vulnerability within the document. + + + + + + Vulnerability Title gives the document producer the + ability to apply a canonical name or title to the vulnerability. + + + + + + + + + + Vulnerability ID gives the document producer a place to + publish a unique label or tracking ID for the vulnerability (if such information + exists). + + + + + + + System Name indicates the name of the + vulnerability tracking or numbering system that this vulnerability ID comes + from. + + + + + + + + + The Notes container holds all individual notes + concerning this vulnerability. + + + + + + The Notes text contains all of the content + necessary to provide different types of low-level discussions of a given + vulnerability to various audiences. + + + + + + + Title should be a concise description of + what is contained in Vulnerability Notes. + + + + + Audience will indicate who is intended to + read the note. + + + + + Type of content within this + note. + + + + + Ordinal is a locally significant integral + counter indexed from 1 used to track notes. + + + + + + + + + + + + Date vulnerability was initially discovered by its + original discoverer. + + + + + Date vulnerability was initially released to the + public. + + + + + The Involvements container lists any number of vendor or + third party interactions related to this vulnerability. + + + + + + Involvement contains a specific set of interaction + details. + + + + + + The description of the + Involvement. + + + + + + + + + + + Type of party with whom the involvement is + taking place. + + + + + Status of the involvement with the specified + party. + + + + + + + + + + The CVE string refers to the MITRE standard Common + Vulnerabilities Enumeration (CVE) tracking number for the + vulnerability. + + + + + Detailed description of the referrenced Common Weakness + Enumeration (CWE) identifier. + + + + + + + The MITRE-assigned CWE + identifier. + + + + + + + + + The ProductStatuses container holds the list of all the + products affected by the vulnerability in question. + + + + + + The Status element holds an enumerated value based + on available Product Name Entry items as constructed from the Product Tree + container. + + + + + + + + Affected status for the product or products + defined in this container. + + + + + + + + + + Contains all Threat containers + + + + + + Threat contains the "kinetic" information + associated with a vulnerability. + + + + + + The description of the + Threat. + + + + + + + + + + + + + The type of the Threat. + + + + + The date this Threat item was last updated; if + omitted it is deemed to be unknown, irrelevant, or + unimportant. + + + + + + + + + + The CVSS Score Set meta-container holds one or more CVSS + score sets to describe vulnerable products. + + + + + + + CVSS scores for a given product ID. If the + ProductID attribute is omitted, the score applies to all vulnerable + products. + + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Base Score which should be a float from 0 + 10.0. + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Temporal Score which should be a float from 0 + 10.0. + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Environmental Score which should be a float from 0 + 10.0. + + + + + The CVSS Vector string is the official + notation that contains all of the values used to compute the Base, + Temporal, and Environmental scores. + + + + + + + + + + CVSS scores for a given product ID. If the + ProductID attribute is omitted, the score applies to all vulnerable + products. + + + + + + The CVSS Base Score is the numeric value of the computed CVSS Base Score which should be a float from 0 to 10.0. + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Temporal Score which should be a float from 0 + 10.0. + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Environmental Score which should be a float from 0 + 10.0. + + + + + The CVSS Vector string is the official + notation that contains all of the values used to compute the Base, + Temporal, and Environmental scores. + + + + + + + + + + + + + The Remediation meta-container tag holds all related + Workaround, Mitigation, Vendor Fix, and Entitlement entries that are associated with + the specific vulnerability. + + + + + + Holds all of the specific details on how to handle + (and presumably, fix) the vulnerability, tied to Product ID. + + + + + + Textual description of this + remedy. + + + + + + + + + + The Entitlement string will contain any + possible vendor-defined constraints for obtaining fixed software or + hardware that fully resolves the vulnerability. + + + + + + + + + + URL from which the remedy can be + obtained. + + + + + + + + Specific type of remedy. + + + + + The date Remedy was last updated, if omitted + it is deemed to be unknown, unimportant, or irrelevant. + + + + + + + + + + This meta-container should include references to any + conferences, papers, advisories, and other resources that are related to this + vulnerability. + + + + + + This meta-container contains an orthogonally + related document, background info, whitepaper, etc. to the specific + vulnerability. + + + + + + The URL of the related + document. + + + + + The description of the related + document. + + + + + + + + + + + Enumerated type value of reference relative to + this document. + + + + + + + + + + The Acknowledgments container holds one or more + Acknowledgement containers for vulnerability-level + acknowledgements. + + + + + + The Acknowledgment container holds recognition for + external parties who were instrumental in the discovery of, reporting of, and + response to the vulnerability. + + + + + + The name (i.e., individual name) of the + party being acknowledged. + + + + + + + + + + The organization of the party being + acknowledged or the organization itself being + acknowledged. + + + + + + + + + + The details of the acknowledgment that + address the recognition of external parties who were instrumental in the + discovery, reporting and response of this document. + + + + + + + + + + The optional URL to the person, place, or + thing being acknowledged. + + + + + + + + + + + + Locally significant numeric value to track vulnerabilities + within a CSAF CVRF document. This enables vulnerabilities to be referenced from elsewhere + inside the document (often at the document-level) + + + + + + This is to ensure that each product mentions a given + ProductID only one. + + + + + + + This is to ensure that each CVSS score set mentions a given + ProductID only one per CVSS version 2. + + + + + + + This is to ensure that each CVSS score set mentions a given + ProductID only one per CVSS version 3. + + + + + + + This is to ensure that each note has a unique ordinal + value. + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/vuln/vuln.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/vuln.xsd new file mode 100755 index 000000000..6ec88b7a4 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/vuln.xsd @@ -0,0 +1,817 @@ + + + + + + + + + + + + + + + + + + This is the XML schema for the Vulnerability + sub model of the OASIS Common Security Advisory Framework (CSAF) TC's + CVRF (Common Vulnerability Reporting Framework). + + Art Manion (amanion@cert.org) + Feng Cao (feng.cao@oracle.com) + Harold Booth (harold.booth@nist.gov) + Stefan Hagen (stefan@hagen.link) + Troy Fridley (trfridle@cisco.com) + 2017-05-24 + CSAF CVRF Vulnerability sub model + 1.2 + + + + + + + + Types enumerating a party's current engagement status for this + vulnerability. + + + + + The party has acknowledged that they are aware of the + vulnerability report. + + + + + The party disputes the vulnerability report in its + entirety + + + + + Some hot-fixes, permanent fixes, or patches have been made + available by the party, but more fixes or patches are going to be released in the + future. + + + + + The party asserts that they have completed remediation of + the vulnerability. + + + + + The party has been contacted, but was unresponsive or + unavailable. + + + + + No contact has been attempted with the + party. + + + + + + + String type to match CVE IDs + + + + + + + + String type to match CWE IDs + + + + + + + + String representing the components needed to compute the + various CVSS scores + + + + + + + + String representing the components needed to compute the + various CVSS version 3 scores which can be longer than v2 scores (up to 138 characters). + + + + + + + + Types enumerating the affected statuses described by a + vulnerability + + + + + The first version known to be affected by this + vulnerability. + + + + + This version is the first fixed version for the + vulnerability but may not be the recommended fixed version. + + + + + This version is contains a fix for the vulnerability but + may not be the recommended fixed version. + + + + + This version is known to be affected by the + vulnerability. + + + + + This version is known NOT to be affected by the + vulnerability. + + + + + This is the last version in a train known to be affected. + Versions released after this would contain a fix for this + vulnerability. + + + + + This version has a fix for the vulnerability and is the + vendor-recommended version for fixing the vulnerability. + + + + + + + Types enumerating the Threat type described by the + vulnerability + + + + + Impact contains an assessment of the impact on the user or + the target set if the vulnerability is successful exploited. + + + + + Exploit Status contains a description of the degree to + which an exploit for the vulnerability is known. + + + + + Target Set contains a description of the currently known + victim population in whatever terms are appropriate. + + + + + + + Types enumerating the Remedy type described by the + vulnerability. + + + + + Workaround contains information about a configuration or + specific deployment scenario that can be used to avoid exposure to the + vulnerability. + + + + + Mitigation contains information about a configuration or + deployment scenario that helps to reduce the risk of the vulnerability but that does not + resolve the vulnerability on the affected product. + + + + + Vendor Fix contains information about an official fix that + is issued by the original author of the affected product. + + + + + Currently there is no fix available. + + + + + There is no fix for the vulnerability and there never will + be one. + + + + + + + Existing product ID from the product tree. + + + + + Existing product group ID from the product + tree. + + + + + + + + This is a meta-container for the aggregation of all fields + that are related to a single vulnerability within the document. + + + + + + Vulnerability Title gives the document producer the + ability to apply a canonical name or title to the vulnerability. + + + + + + + + + + Vulnerability ID gives the document producer a place to + publish a unique label or tracking ID for the vulnerability (if such information + exists). + + + + + + + System Name indicates the name of the + vulnerability tracking or numbering system that this vulnerability ID comes + from. + + + + + + + + + The Notes container holds all individual notes + concerning this vulnerability. + + + + + + The Notes text contains all of the content + necessary to provide different types of low-level discussions of a given + vulnerability to various audiences. + + + + + + + Title should be a concise description of + what is contained in Vulnerability Notes. + + + + + Audience will indicate who is intended to + read the note. + + + + + Type of content within this + note. + + + + + Ordinal is a locally significant integral + counter indexed from 1 used to track notes. + + + + + + + + + + + + Date vulnerability was initially discovered by its + original discoverer. + + + + + Date vulnerability was initially released to the + public. + + + + + The Involvements container lists any number of vendor or + third party interactions related to this vulnerability. + + + + + + Involvement contains a specific set of interaction + details. + + + + + + The description of the + Involvement. + + + + + + + + + + + Type of party with whom the involvement is + taking place. + + + + + Status of the involvement with the specified + party. + + + + + + + + + + The CVE string refers to the MITRE standard Common + Vulnerabilities Enumeration (CVE) tracking number for the + vulnerability. + + + + + Detailed description of the referrenced Common Weakness + Enumeration (CWE) identifier. + + + + + + + The MITRE-assigned CWE + identifier. + + + + + + + + + The ProductStatuses container holds the list of all the + products affected by the vulnerability in question. + + + + + + The Status element holds an enumerated value based + on available Product Name Entry items as constructed from the Product Tree + container. + + + + + + + + Affected status for the product or products + defined in this container. + + + + + + + + + + Contains all Threat containers + + + + + + Threat contains the "kinetic" information + associated with a vulnerability. + + + + + + The description of the + Threat. + + + + + + + + + + + + + The type of the Threat. + + + + + The date this Threat item was last updated; if + omitted it is deemed to be unknown, irrelevant, or + unimportant. + + + + + + + + + + The CVSS Score Set meta-container holds one or more CVSS + score sets to describe vulnerable products. + + + + + + + CVSS scores for a given product ID. If the + ProductID attribute is omitted, the score applies to all vulnerable + products. + + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Base Score which should be a float from 0 + 10.0. + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Temporal Score which should be a float from 0 + 10.0. + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Environmental Score which should be a float from 0 + 10.0. + + + + + The CVSS Vector string is the official + notation that contains all of the values used to compute the Base, + Temporal, and Environmental scores. + + + + + + + + + + CVSS scores for a given product ID. If the + ProductID attribute is omitted, the score applies to all vulnerable + products. + + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Base Score which should be a float from 0 + 10.0. + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Temporal Score which should be a float from 0 + 10.0. + + + + + The CVSS Base Score is the numeric value of + the computed CVSS Environmental Score which should be a float from 0 + 10.0. + + + + + The CVSS Vector string is the official + notation that contains all of the values used to compute the Base, + Temporal, and Environmental scores. + + + + + + + + + + + + + The Remediation meta-container tag holds all related + Workaround, Mitigation, Vendor Fix, and Entitlement entries that are associated with + the specific vulnerability. + + + + + + Holds all of the specific details on how to handle + (and presumably, fix) the vulnerability, tied to Product ID. + + + + + + Textual description of this + remedy. + + + + + + + + + + The Entitlement string will contain any + possible vendor-defined constraints for obtaining fixed software or + hardware that fully resolves the vulnerability. + + + + + + + + + + URL from which the remedy can be + obtained. + + + + + + + + Specific type of remedy. + + + + + The date Remedy was last updated, if omitted + it is deemed to be unknown, unimportant, or irrelevant. + + + + + + + + + + This meta-container should include references to any + conferences, papers, advisories, and other resources that are related to this + vulnerability. + + + + + + This meta-container contains an orthogonally + related document, background info, whitepaper, etc. to the specific + vulnerability. + + + + + + The URL of the related + document. + + + + + The description of the related + document. + + + + + + + + + + + Enumerated type value of reference relative to + this document. + + + + + + + + + + The Acknowledgments container holds one or more + Acknowledgement containers for vulnerability-level + acknowledgements. + + + + + + The Acknowledgment container holds recognition for + external parties who were instrumental in the discovery of, reporting of, and + response to the vulnerability. + + + + + + The name (i.e., individual name) of the + party being acknowledged. + + + + + + + + + + The organization of the party being + acknowledged or the organization itself being + acknowledged. + + + + + + + + + + The details of the acknowledgment that + address the recognition of external parties who were instrumental in the + discovery, reporting and response of this document. + + + + + + + + + + The optional URL to the person, place, or + thing being acknowledged. + + + + + + + + + + + + Locally significant numeric value to track vulnerabilities + within a CSAF CVRF document. This enables vulnerabilities to be referenced from elsewhere + inside the document (often at the document-level) + + + + + + This is to ensure that each product mentions a given + ProductID only one. + + + + + + + This is to ensure that each CVSS score set mentions a given + ProductID only one per CVSS version 2. + + + + + + + This is to ensure that each CVSS score set mentions a given + ProductID only one per CVSS version 3. + + + + + + + This is to ensure that each note has a unique ordinal + value. + + + + + + diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/w3.org/xml.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/w3.org/xml.xsd new file mode 100755 index 000000000..d662b4236 --- /dev/null +++ b/vulnerabilities/scraper/cvrf_parser/schemata/w3.org/xml.xsd @@ -0,0 +1,117 @@ + + + + + + + See http://www.w3.org/XML/1998/namespace.html and + http://www.w3.org/TR/REC-xml for information about this namespace. + + This schema document describes the XML namespace, in a form + suitable for import by other schema documents. + + Note that local names in this namespace are intended to be defined + only by the World Wide Web Consortium or its subgroups. The + following names are currently defined in this namespace and should + not be used with conflicting semantics by any Working Group, + specification, or document instance: + + base (as an attribute name): denotes an attribute whose value + provides a URI to be used as the base for interpreting any + relative URIs in the scope of the element on which it + appears; its value is inherited. This name is reserved + by virtue of its definition in the XML Base specification. + + lang (as an attribute name): denotes an attribute whose value + is a language code for the natural language of the content of + any element; its value is inherited. This name is reserved + by virtue of its definition in the XML specification. + + space (as an attribute name): denotes an attribute whose + value is a keyword indicating what whitespace processing + discipline is intended for the content of the element; its + value is inherited. This name is reserved by virtue of its + definition in the XML specification. + + Father (in any context at all): denotes Jon Bosak, the chair of + the original XML Working Group. This name is reserved by + the following decision of the W3C XML Plenary and + XML Coordination groups: + + In appreciation for his vision, leadership and dedication + the W3C XML Plenary on this 10th day of February, 2000 + reserves for Jon Bosak in perpetuity the XML name + xml:Father + + + + + This schema defines attributes and an attribute group + suitable for use by + schemas wishing to allow xml:base, xml:lang or xml:space attributes + on elements they define. + + To enable this, such a schema must import this schema + for the XML namespace, e.g. as follows: + <schema . . .> + . . . + <import namespace="http://www.w3.org/XML/1998/namespace" + schemaLocation="http://www.w3.org/2001/03/xml.xsd"/> + + Subsequently, qualified reference to any of the attributes + or the group defined below will have the desired effect, e.g. + + <type . . .> + . . . + <attributeGroup ref="xml:specialAttrs"/> + + will define a type which will schema-validate an instance + element with any of those attributes + + + + In keeping with the XML Schema WG's standard versioning + policy, this schema document will persist at + http://www.w3.org/2001/03/xml.xsd. + At the date of issue it can also be found at + http://www.w3.org/2001/xml.xsd. + The schema document at that URI may however change in the future, + in order to remain compatible with the latest version of XML Schema + itself. In other words, if the XML Schema namespace changes, the version + of this document at + http://www.w3.org/2001/xml.xsd will change + accordingly; the version at + http://www.w3.org/2001/03/xml.xsd will not change. + + + + + + In due course, we should install the relevant ISO 2- and 3-letter + codes as the enumerated possible values . . . + + + + + + + + + + + + + + + See http://www.w3.org/TR/xmlbase/ for + information about this attribute. + + + + + + + + + + diff --git a/vulnerabilities/scraper/opensuse.py b/vulnerabilities/scraper/opensuse.py new file mode 100755 index 000000000..4b29f9491 --- /dev/null +++ b/vulnerabilities/scraper/opensuse.py @@ -0,0 +1,56 @@ +import requests +from bs4 import BeautifulSoup + +from vulnerabilities.scraper.cvrf_parser import cvrf_parser + +base_url = "http://ftp.suse.com/pub/projects/security/cvrf/" + + +def name_version_split(pkg_name): + last_char = 0 + for i in range(len(pkg_name)): + if pkg_name[i] == "-": + if pkg_name[i + 1].isnumeric() and pkg_name[i - 1].isalpha(): + return (pkg_name[:i], pkg_name[i + 1:]) + + +def get_urls_of_xmls_from_page(base_url): + r = requests.get(base_url) + soup = BeautifulSoup(r.content, "lxml") + for a_tag in soup.find_all("a", href=True): + if a_tag["href"].endswith(".xml"): + yield base_url + a_tag["href"] + + +def import_vulnerabilities(): + vulnerabilities = [] + vulnerability_dicts = [] + for xml_url in get_urls_of_xmls_from_page(base_url): + vulnerabilities = cvrf_parser.get_data_dict_from_url(xml_url) + for vulnerability in vulnerabilities: + description = vulnerability["Note_Notes"].split("lang:en|")[1] + platform, package = vulnerability["ProductID"].split(":") + if not name_version_split(package): + continue + pkg_name, pkg_version = name_version_split(package) + cve_id = vulnerability["CVE_Vulnerability"] + ref_urls = vulnerability["URL_Reference"] + ref_ids = list( + filter(lambda x: not x.startswith("CVE"), + vulnerability["Description_Reference"]) + ) + ref_ids = list(map(lambda x: x.replace(" ", "-").upper(), ref_ids)) + vulnerability_dicts.append( + { + "description": description, + "platform": platform, + "vuln_id": cve_id, + "package_name": pkg_name, + "urls": ref_urls, + "ref_ids": ref_ids, + "version": pkg_version, + } + ) + print(vulnerability_dicts[0]) + + return vulnerability_dicts From fd6e9b9491bcb7e8d8e98cabd95cf2d007a32b5b Mon Sep 17 00:00:00 2001 From: Shivam Sandbhor Date: Wed, 15 Apr 2020 17:57:22 +0530 Subject: [PATCH 2/8] Remove unused imports and update requirements.txt Signed-off-by: Shivam Sandbhor --- requirements.txt | 2 +- vulnerabilities/scraper/cvrf_parser/cvrf_parser.py | 1 + vulnerabilities/scraper/opensuse.py | 1 - 3 files changed, 2 insertions(+), 2 deletions(-) diff --git a/requirements.txt b/requirements.txt index 357dfe633..6165c9b99 100644 --- a/requirements.txt +++ b/requirements.txt @@ -26,9 +26,9 @@ saneyaml==0.4 six==1.13.0 soupsieve==1.9.5 sqlparse==0.3.0 -tqdm==4.41.1 wcwidth==0.1.7 whitenoise==5.0.1 zipp==0.6.0 pytoml==0.1.21 schema==0.7.1 +requests==2.23.0 diff --git a/vulnerabilities/scraper/cvrf_parser/cvrf_parser.py b/vulnerabilities/scraper/cvrf_parser/cvrf_parser.py index 11424cc41..c63b4d6ef 100755 --- a/vulnerabilities/scraper/cvrf_parser/cvrf_parser.py +++ b/vulnerabilities/scraper/cvrf_parser/cvrf_parser.py @@ -1,6 +1,7 @@ from argparse import Namespace from lxml import etree + class CVRF_Syntax(object): # CVRF Elements and Namespaces. CVRF_ARGS = [ diff --git a/vulnerabilities/scraper/opensuse.py b/vulnerabilities/scraper/opensuse.py index 4b29f9491..7693e633c 100755 --- a/vulnerabilities/scraper/opensuse.py +++ b/vulnerabilities/scraper/opensuse.py @@ -51,6 +51,5 @@ def import_vulnerabilities(): "version": pkg_version, } ) - print(vulnerability_dicts[0]) return vulnerability_dicts From a96cc425aec632efaa83fc4bb8f609377791d04c Mon Sep 17 00:00:00 2001 From: Shivam Sandbhor Date: Wed, 15 Apr 2020 18:29:20 +0530 Subject: [PATCH 3/8] Replace double quotes with single quotes in importer Signed-off-by: Shivam Sandbhor --- vulnerabilities/scraper/opensuse.py | 40 ++++++++++++++--------------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/vulnerabilities/scraper/opensuse.py b/vulnerabilities/scraper/opensuse.py index 7693e633c..4af81a4df 100755 --- a/vulnerabilities/scraper/opensuse.py +++ b/vulnerabilities/scraper/opensuse.py @@ -3,23 +3,23 @@ from vulnerabilities.scraper.cvrf_parser import cvrf_parser -base_url = "http://ftp.suse.com/pub/projects/security/cvrf/" +base_url = 'http://ftp.suse.com/pub/projects/security/cvrf/' def name_version_split(pkg_name): last_char = 0 for i in range(len(pkg_name)): - if pkg_name[i] == "-": + if pkg_name[i] == '-': if pkg_name[i + 1].isnumeric() and pkg_name[i - 1].isalpha(): return (pkg_name[:i], pkg_name[i + 1:]) def get_urls_of_xmls_from_page(base_url): r = requests.get(base_url) - soup = BeautifulSoup(r.content, "lxml") - for a_tag in soup.find_all("a", href=True): - if a_tag["href"].endswith(".xml"): - yield base_url + a_tag["href"] + soup = BeautifulSoup(r.content, 'lxml') + for a_tag in soup.find_all('a', href=True): + if a_tag['href'].endswith('.xml'): + yield base_url + a_tag['href'] def import_vulnerabilities(): @@ -28,27 +28,27 @@ def import_vulnerabilities(): for xml_url in get_urls_of_xmls_from_page(base_url): vulnerabilities = cvrf_parser.get_data_dict_from_url(xml_url) for vulnerability in vulnerabilities: - description = vulnerability["Note_Notes"].split("lang:en|")[1] - platform, package = vulnerability["ProductID"].split(":") + description = vulnerability['Note_Notes'].split('lang:en|')[1] + platform, package = vulnerability['ProductID'].split(':') if not name_version_split(package): continue pkg_name, pkg_version = name_version_split(package) - cve_id = vulnerability["CVE_Vulnerability"] - ref_urls = vulnerability["URL_Reference"] + cve_id = vulnerability['CVE_Vulnerability'] + ref_urls = vulnerability['URL_Reference'] ref_ids = list( - filter(lambda x: not x.startswith("CVE"), - vulnerability["Description_Reference"]) + filter(lambda x: not x.startswith('CVE'), + vulnerability['Description_Reference']) ) - ref_ids = list(map(lambda x: x.replace(" ", "-").upper(), ref_ids)) + ref_ids = list(map(lambda x: x.replace(' ', '-').upper(), ref_ids)) vulnerability_dicts.append( { - "description": description, - "platform": platform, - "vuln_id": cve_id, - "package_name": pkg_name, - "urls": ref_urls, - "ref_ids": ref_ids, - "version": pkg_version, + 'description': description, + 'platform': platform, + 'vuln_id': cve_id, + 'package_name': pkg_name, + 'urls': ref_urls, + 'ref_ids': ref_ids, + 'version': pkg_version, } ) From 507d61a669b6ae8dfcdf66a8d8c9640d8a905090 Mon Sep 17 00:00:00 2001 From: Shivam Sandbhor Date: Fri, 17 Apr 2020 13:52:04 +0530 Subject: [PATCH 4/8] Remove unneccessary xds Signed-off-by: Shivam Sandbhor --- .../cvrf_parser/schemata/dublincore/dc.xsd | 118 ----- .../schemata/scap/cpe-language_2.2a.xsd | 182 -------- .../cvrf_parser/schemata/scap/cvss-v2_0.9.xsd | 415 ------------------ .../cvrf_parser/schemata/scap/cvss-v3.0.xsd | 285 ------------ .../schemata/scap/scap-core_0.9.xsd | 170 ------- .../cvrf_parser/schemata/w3.org/xml.xsd | 117 ----- 6 files changed, 1287 deletions(-) delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/dublincore/dc.xsd delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/scap/cpe-language_2.2a.xsd delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/scap/cvss-v2_0.9.xsd delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/scap/cvss-v3.0.xsd delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/scap/scap-core_0.9.xsd delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/w3.org/xml.xsd diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/dublincore/dc.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/dublincore/dc.xsd deleted file mode 100755 index 29d64a5b2..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/dublincore/dc.xsd +++ /dev/null @@ -1,118 +0,0 @@ - - - - - - DCMES 1.1 XML Schema - XML Schema for http://purl.org/dc/elements/1.1/ namespace - - Created 2008-02-11 - - Created by - - Tim Cole (t-cole3@uiuc.edu) - Tom Habing (thabing@uiuc.edu) - Jane Hunter (jane@dstc.edu.au) - Pete Johnston (p.johnston@ukoln.ac.uk), - Carl Lagoze (lagoze@cs.cornell.edu) - - This schema declares XML elements for the 15 DC elements from the - http://purl.org/dc/elements/1.1/ namespace. - - It defines a complexType SimpleLiteral which permits mixed content - and makes the xml:lang attribute available. It disallows child elements by - use of minOcccurs/maxOccurs. - - However, this complexType does permit the derivation of other complexTypes - which would permit child elements. - - All elements are declared as substitutable for the abstract element any, - which means that the default type for all elements is dc:SimpleLiteral. - - - - - - - - - - - - - This is the default type for all of the DC elements. - It permits text content only with optional - xml:lang attribute. - Text is allowed because mixed="true", but sub-elements - are disallowed because minOccurs="0" and maxOccurs="0" - are on the xs:any tag. - - This complexType allows for restriction or extension permitting - child elements. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - This group is included as a convenience for schema authors - who need to refer to all the elements in the - http://purl.org/dc/elements/1.1/ namespace. - - - - - - - - - - - - - - This complexType is included as a convenience for schema authors who need to define a root - or container element for all of the DC elements. - - - - - - - - - - diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/scap/cpe-language_2.2a.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/scap/cpe-language_2.2a.xsd deleted file mode 100755 index 8b50a820e..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/scap/cpe-language_2.2a.xsd +++ /dev/null @@ -1,182 +0,0 @@ - - - - - This XML Schema defines the CPE Language. An individual - CPE Name addresses a single part of an actual system. To identify more complex - platform types, there needs to be a way to combine different CPE Names using - logical operators. For example, there may be a need to identify a platform with a - particular operating system AND a certain application. The CPE Language exists to - satisfy this need, enabling the CPE Name for the operating system to be combined - with the CPE Name for the application. For more information, consult the CPE - Specification document. - - CPE Language - Neal Ziring, Andrew Buttner, David Waltermire - 2.2 - 10/27/2008 10:00:00 AM - - - - - - - - - This element is the root element of a CPE - Language XML documents and therefore acts as a container for child platform - definitions. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - The platform element represents the description - or qualifications of a particular IT platform type. The platform is defined - by the logical-test child element. - - - - - The optional title element may appear as a child - to a platform element. It provides a human-readable title for it. To support - uses intended for multiple languages, this element supports the ‘xml:lang’ - attribute. At most one title element can appear for each language. - - - - - The optional remark element may appear as a child - of a platform element. It provides some additional description. Zero or more - remark elements may appear. To support uses intended for multiple languages, - this element supports the ‘xml:lang’ attribute. There can be multiple - remarks for a single language. - - - - - - - - - - - The id attribute holds a locally unique - name for the platform. There is no defined format for this id, it just has - to be unique to the containing language document. - - - - - - - - The logical-test element appears as a child of a - platform element, and may also be nested to create more complex logical - tests. The content consists of one or more elements: fact-ref, and - logical-test children are permitted. The operator to be applied, and - optional negation of the test, are given as attributes. - - - - - - - - - - - - - - - The fact-ref element appears as a - child of a logical-test element. It is simply a reference to a CPE Name that - always evaluates to a Boolean result. - - - - - - - - - - The OperatorEnumeration simple type defines - acceptable operators. Each operator defines how to evaluate multiple - arguments. - - - - - - - - - - - - This type allows the xml:lang attribute to - associate a specific language with an element's string - content. - - - - - - - - - - - - - Define the format for acceptable CPE Names. A URN - format is used with the id starting with the word cpe followed by :/ and - then some number of individual components separated by - colons. - - - - - - - - - - diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/scap/cvss-v2_0.9.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/scap/cvss-v2_0.9.xsd deleted file mode 100755 index f68fb81cf..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/scap/cvss-v2_0.9.xsd +++ /dev/null @@ -1,415 +0,0 @@ - - - - - - - - - - - - Value restriction to single decimal values from 0.0 to 10.0, as used in CVSS scores - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Indicates if the vector has been approximated as the result of an upgrade from a previous CVSS version - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - "This schema was intentionally designed to avoid mixing classes and attributes between CVSS version 1, CVSS version 2, and future versions. Scores in the CVSS system are interdependent. The temporal score is a multiplier of the base score. The environmental score, in turn, is a multiplier of the temporal score. The ability to transfer these scores independently is provided on the assumption that the user understands the business logic. For any given metric, it is preferred that the score, as a minimum is provided, however the score can be re-created from the metrics or the multiplier and any scores they are dependent on." - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Base type for metrics that defines common attributes of all metrics. - - - - Indicates if the metrics have been upgraded from a previous version of CVSS. If fields that were approximated will have an approximated attribute set to 'true'. - - - - - - - - - - - - - Base severity score assigned to a vulnerability by a source - - - - - Base exploit sub-score assigned to a vulnerability by a source - - - - - Base impact sub-score assigned to a vulnerability by a source - - - - - - Data source the vector was obtained from. Example: http://nvd.nist.gov or com.symantec.deepsight - - - - - - - - - - - - - - - - - - - Data source the vector was obtained from. Example: gov.nist.nvd or com.symantec.deepsight - - - - - - - - - - - - - - - - - The temporal score is the temporal multiplier times the base score. - - - - - The temporal multiplier is a number between zero and one. Reference the CVSS standard for computation. - - - - - - - - - - diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/scap/cvss-v3.0.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/scap/cvss-v3.0.xsd deleted file mode 100755 index b36e0ce7d..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/scap/cvss-v3.0.xsd +++ /dev/null @@ -1,285 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Value restriction to single decimal values from 0.0 to 10.0, as used in CVSS scores - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/scap/scap-core_0.9.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/scap/scap-core_0.9.xsd deleted file mode 100755 index 19a91c8d7..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/scap/scap-core_0.9.xsd +++ /dev/null @@ -1,170 +0,0 @@ - - - - - - - - - - - - - - - Data type for the check element, a checking system specification URI, string content, and an optional external file reference. The checking system specification should be the URI for a particular version of OVAL or a related system testing language, and the content will be an identifier of a test written in that language. The external file reference could be used to point to the file in which the content test identifier is defined. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Denotes a scanner and required configuration that is capable of detecting the referenced vulnerability. May also be an OVAL definition and omit scanner name. - Identifies a tool and any associated information about the tool, such as signature versions, that indicate the tool is capable or properly detecting and/or remdiating the vulnerability or misconfiguration - - - - - Identifies a check that can be used to detect the vulnerability or misconfiguration - - - - - The CPE name of the scanning tool. A value must be supplied for this element. The CPE name can be used for a CPE from the NVD. The CPE title attribute can be used for internal naming conventions. (or both, if possible) - - - - - - - - - - - - - - - - - - - - Define the format for acceptable CPE Names. An urn format is used with the id starting with the word oval followed by a unique string, followed by the three letter code 'def', and ending with an integer. - - - - - - - - - Define the format for acceptable CPE Names. A URN format is used with the id starting with the word cpe followed by :/ and then some number of individual components separated by colons. - - - - - - - - - Define the format for acceptable - searchableCPE Names. The URI escaped code '%25' may be used - to represent the character '%' which will be interpreted as a - wildcard. - - - - - - - - - The name pattern of a CPE component. - - - - - - - - - The name pattern of the CPE part component. - - - - - - - - - - - - - - - - diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/w3.org/xml.xsd b/vulnerabilities/scraper/cvrf_parser/schemata/w3.org/xml.xsd deleted file mode 100755 index d662b4236..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/w3.org/xml.xsd +++ /dev/null @@ -1,117 +0,0 @@ - - - - - - - See http://www.w3.org/XML/1998/namespace.html and - http://www.w3.org/TR/REC-xml for information about this namespace. - - This schema document describes the XML namespace, in a form - suitable for import by other schema documents. - - Note that local names in this namespace are intended to be defined - only by the World Wide Web Consortium or its subgroups. The - following names are currently defined in this namespace and should - not be used with conflicting semantics by any Working Group, - specification, or document instance: - - base (as an attribute name): denotes an attribute whose value - provides a URI to be used as the base for interpreting any - relative URIs in the scope of the element on which it - appears; its value is inherited. This name is reserved - by virtue of its definition in the XML Base specification. - - lang (as an attribute name): denotes an attribute whose value - is a language code for the natural language of the content of - any element; its value is inherited. This name is reserved - by virtue of its definition in the XML specification. - - space (as an attribute name): denotes an attribute whose - value is a keyword indicating what whitespace processing - discipline is intended for the content of the element; its - value is inherited. This name is reserved by virtue of its - definition in the XML specification. - - Father (in any context at all): denotes Jon Bosak, the chair of - the original XML Working Group. This name is reserved by - the following decision of the W3C XML Plenary and - XML Coordination groups: - - In appreciation for his vision, leadership and dedication - the W3C XML Plenary on this 10th day of February, 2000 - reserves for Jon Bosak in perpetuity the XML name - xml:Father - - - - - This schema defines attributes and an attribute group - suitable for use by - schemas wishing to allow xml:base, xml:lang or xml:space attributes - on elements they define. - - To enable this, such a schema must import this schema - for the XML namespace, e.g. as follows: - <schema . . .> - . . . - <import namespace="http://www.w3.org/XML/1998/namespace" - schemaLocation="http://www.w3.org/2001/03/xml.xsd"/> - - Subsequently, qualified reference to any of the attributes - or the group defined below will have the desired effect, e.g. - - <type . . .> - . . . - <attributeGroup ref="xml:specialAttrs"/> - - will define a type which will schema-validate an instance - element with any of those attributes - - - - In keeping with the XML Schema WG's standard versioning - policy, this schema document will persist at - http://www.w3.org/2001/03/xml.xsd. - At the date of issue it can also be found at - http://www.w3.org/2001/xml.xsd. - The schema document at that URI may however change in the future, - in order to remain compatible with the latest version of XML Schema - itself. In other words, if the XML Schema namespace changes, the version - of this document at - http://www.w3.org/2001/xml.xsd will change - accordingly; the version at - http://www.w3.org/2001/03/xml.xsd will not change. - - - - - - In due course, we should install the relevant ISO 2- and 3-letter - codes as the enumerated possible values . . . - - - - - - - - - - - - - - - See http://www.w3.org/TR/xmlbase/ for - information about this attribute. - - - - - - - - - - From 4940f545c1092d192531d8a2cf2b59ce1617783b Mon Sep 17 00:00:00 2001 From: Shivam Sandbhor Date: Fri, 17 Apr 2020 13:56:41 +0530 Subject: [PATCH 5/8] Remove SVN directory Signed-off-by: Shivam Sandbhor --- .../schemata/common/.svn/all-wcprops | 5 --- .../cvrf_parser/schemata/common/.svn/entries | 31 ------------------- 2 files changed, 36 deletions(-) delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/common/.svn/all-wcprops delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/common/.svn/entries diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/common/.svn/all-wcprops b/vulnerabilities/scraper/cvrf_parser/schemata/common/.svn/all-wcprops deleted file mode 100755 index 4a73a5f31..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/common/.svn/all-wcprops +++ /dev/null @@ -1,5 +0,0 @@ -K 25 -svn:wc:ra_dav:version-url -V 49 -/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/common -END diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/common/.svn/entries b/vulnerabilities/scraper/cvrf_parser/schemata/common/.svn/entries deleted file mode 100755 index bf80768c1..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/common/.svn/entries +++ /dev/null @@ -1,31 +0,0 @@ -10 - -dir -91 -https://subversion.assembla.com/svn/icasi-cvrf/trunk/schemata/common -https://subversion.assembla.com/svn/icasi-cvrf - - - -2012-05-07T17:25:01.568574Z -82 -xorrkaz - - - - - - - - - - - - - - -085eb5b6-75e8-47bc-a513-804b55a9b1a4 - -1.1 -dir - From 8035483dff8d0239135c0969ba3b2d98162c3035 Mon Sep 17 00:00:00 2001 From: Shivam Sandbhor Date: Fri, 17 Apr 2020 13:59:24 +0530 Subject: [PATCH 6/8] Remove more SVN directories Signed-off-by: Shivam Sandbhor --- .../schemata/common/1.1/.svn/all-wcprops | 11 - .../schemata/common/1.1/.svn/entries | 62 -- .../1.1/.svn/text-base/common.xsd.svn-base | 176 ----- .../schemata/cvrf/.svn/all-wcprops | 5 - .../cvrf_parser/schemata/cvrf/.svn/entries | 31 - .../schemata/cvrf/1.1/.svn/all-wcprops | 11 - .../schemata/cvrf/1.1/.svn/entries | 62 -- .../cvrf/1.1/.svn/text-base/cvrf.xsd.svn-base | 487 -------------- .../schemata/prod/.svn/all-wcprops | 5 - .../cvrf_parser/schemata/prod/.svn/entries | 31 - .../schemata/prod/1.1/.svn/all-wcprops | 11 - .../schemata/prod/1.1/.svn/entries | 62 -- .../prod/1.1/.svn/prop-base/prod.xsd.svn-base | 5 - .../prod/1.1/.svn/text-base/prod.xsd.svn-base | 292 -------- .../schemata/vuln/.svn/all-wcprops | 5 - .../cvrf_parser/schemata/vuln/.svn/entries | 31 - .../schemata/vuln/1.1/.svn/all-wcprops | 11 - .../schemata/vuln/1.1/.svn/entries | 62 -- .../vuln/1.1/.svn/text-base/vuln.xsd.svn-base | 631 ------------------ 19 files changed, 1991 deletions(-) delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/all-wcprops delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/entries delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/text-base/common.xsd.svn-base delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/cvrf/.svn/all-wcprops delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/cvrf/.svn/entries delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/all-wcprops delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/entries delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/text-base/cvrf.xsd.svn-base delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/prod/.svn/all-wcprops delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/prod/.svn/entries delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/all-wcprops delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/entries delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/prop-base/prod.xsd.svn-base delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/text-base/prod.xsd.svn-base delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/vuln/.svn/all-wcprops delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/vuln/.svn/entries delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/all-wcprops delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/entries delete mode 100755 vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/text-base/vuln.xsd.svn-base diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/all-wcprops b/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/all-wcprops deleted file mode 100755 index 39d14f7f6..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/all-wcprops +++ /dev/null @@ -1,11 +0,0 @@ -K 25 -svn:wc:ra_dav:version-url -V 53 -/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/common/1.1 -END -common.xsd -K 25 -svn:wc:ra_dav:version-url -V 64 -/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/common/1.1/common.xsd -END diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/entries b/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/entries deleted file mode 100755 index ed8027b73..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/entries +++ /dev/null @@ -1,62 +0,0 @@ -10 - -dir -91 -https://subversion.assembla.com/svn/icasi-cvrf/trunk/schemata/common/1.1 -https://subversion.assembla.com/svn/icasi-cvrf - - - -2012-05-07T17:25:01.568574Z -82 -xorrkaz - - - - - - - - - - - - - - -085eb5b6-75e8-47bc-a513-804b55a9b1a4 - -common.xsd -file - - - - -2012-05-07T19:31:33.000000Z -147cabf59262af5377f122b3103b8e31 -2012-05-07T17:25:01.568574Z -82 -xorrkaz - - - - - - - - - - - - - - - - - - - - - -8547 - diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/text-base/common.xsd.svn-base b/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/text-base/common.xsd.svn-base deleted file mode 100755 index df7457546..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/common/1.1/.svn/text-base/common.xsd.svn-base +++ /dev/null @@ -1,176 +0,0 @@ - - - - - - - - - - - - This is the XML schema for the Common Vulerability Reporting Framework's common data types. - - Brian Schafer <bschafer@microsoft.com> - Joe Clarke <jclarke@cisco.com> - Joe Hemmerlein <Joe.Hemmerlein@microsoft.com> - 2012-05-07 - CVRF Common Data Types - 1.1 - - - - - - - - A normalized string type that cannot be empty. - - - - - - - - A string type that cannot be empty. - - - - - - - - String type with an optional language attribute. The default language is English. - - - - - - Locale code used for the string value. The default is "en". - - - - - - - - Normalized string type with an optional language attribute. The default language is English. This string cannot be empty. - - - - - - Locale code used for the string value. The default is "en". - - - - - - - - Dotted string representing the document revision - - - - - - - - Types enumerating the type of reference document - - - - - This document is an external reference to the current vulnerability. - - - - - This document is a reference to this same vulnerability. - - - - - - - Types enumerating the various publishers of a document. - - - - - Developers or maintainers of information system products or services. - - - - - Individuals or organizations that find vulnerabilities or security weaknesses. - - - - - Individuals or organizations that manage a single vendor's response or multiple vendors' responses to a vulnerability, a security flaw, or an incident. - - - - - Everyone using a vendor's product. - - - - - Catchall for everyone else. Currently this includes forwarders, re-publishers, language translators and miscellaneous contributors. - - - - - - - Allowed type values for CVRF notes. - - - - - A general, high-level note (Title may have more information). - - - - - A low-level detailed discussion (Title may have more information). - - - - - A description of something (Title may have more information). - - - - - A summary of something (Title may have more information). - - - - - A list of frequently asked questions. - - - - - Any possible legal discussion, including constraints, surrounding the document. - - - - - Something that doesn’t fit (Title should have more information). - - - - - diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/.svn/all-wcprops b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/.svn/all-wcprops deleted file mode 100755 index 9443e9aca..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/.svn/all-wcprops +++ /dev/null @@ -1,5 +0,0 @@ -K 25 -svn:wc:ra_dav:version-url -V 47 -/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/cvrf -END diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/.svn/entries b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/.svn/entries deleted file mode 100755 index e7bf1ead4..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/.svn/entries +++ /dev/null @@ -1,31 +0,0 @@ -10 - -dir -91 -https://subversion.assembla.com/svn/icasi-cvrf/trunk/schemata/cvrf -https://subversion.assembla.com/svn/icasi-cvrf - - - -2012-05-07T17:25:01.568574Z -82 -xorrkaz - - - - - - - - - - - - - - -085eb5b6-75e8-47bc-a513-804b55a9b1a4 - -1.1 -dir - diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/all-wcprops b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/all-wcprops deleted file mode 100755 index ed7fb2a6c..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/all-wcprops +++ /dev/null @@ -1,11 +0,0 @@ -K 25 -svn:wc:ra_dav:version-url -V 51 -/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/cvrf/1.1 -END -cvrf.xsd -K 25 -svn:wc:ra_dav:version-url -V 60 -/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/cvrf/1.1/cvrf.xsd -END diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/entries b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/entries deleted file mode 100755 index 7d99cfda3..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/entries +++ /dev/null @@ -1,62 +0,0 @@ -10 - -dir -91 -https://subversion.assembla.com/svn/icasi-cvrf/trunk/schemata/cvrf/1.1 -https://subversion.assembla.com/svn/icasi-cvrf - - - -2012-05-07T17:25:01.568574Z -82 -xorrkaz - - - - - - - - - - - - - - -085eb5b6-75e8-47bc-a513-804b55a9b1a4 - -cvrf.xsd -file - - - - -2012-05-07T19:31:33.000000Z -ef42ad30fddcf86a18ad5833962d5011 -2012-05-07T17:25:01.568574Z -82 -xorrkaz - - - - - - - - - - - - - - - - - - - - - -27764 - diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/text-base/cvrf.xsd.svn-base b/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/text-base/cvrf.xsd.svn-base deleted file mode 100755 index b4153b9fe..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/cvrf/1.1/.svn/text-base/cvrf.xsd.svn-base +++ /dev/null @@ -1,487 +0,0 @@ - - - - - - - - - - - - - - This is the XML schema for the Common Vulnerability Reporting Framework. For more information, see the CVRF whitepaper. - - Brian Schafer <bschafer@microsoft.com> - Joe Clarke <jclarke@cisco.com> - Joe Hemmerlein <Joe.Hemmerlein@microsoft.com> - 2012-05-07 - CVRF Dictionary - 1.1 - - - - - - - - Types enumerating the status of the document. - - - - - Pre-release, intended for issuing party’s internal use only, or possibly used externally when the party is seeking feedback or indicating its intentions regarding a specific issue. - - - - - The issuing party believes the content is subject to change. - - - - - The issuing party asserts the content is unlikely to change. - - - - - - - Floating point number representing the CVRF specification version - - - - - - - - - - - Root element of a CVRF document. - - - - - - A definitive canonical name for the document, providing enough descriptive content to differentiate from other similar documents, ideally providing a unique “handle”. - - - - - - - - - - A short canonical name, chosen by the document producer, which will inform the consumer about the type of the document. - - - - - - - - - - A container holding all information about the publisher of the CVRF document. - - - - - - Author contact information such as address, phone number, email, etc. - - - - - - - - - - The name of the issuing party and their authority to release the document, in particular, the party's constituency and responsibilities or other obligations. - - - - - - - - - - - Type is an enumerated list containing an array of different document publisher types. - - - - - Vendor ID is a unique identifier (OID) that a vendor uses as issued by FIRST under the auspices of IETF. - - - - - - - The Document Tracking meta-container contains all of the attributes necessary to track a CVRF document. - - - - - - Contains document ID and optional document aliases - - - - - - Short unique identifier used to refer to the document unambiguously in any context. - - - - - - - - - - Optional alternative ID for document - - - - - - - - - - - - - The condition of the document with regard to completeness and the likelihood of future editions. - - - - - Document Version is a simple counter to track the version of the document. - - - - - The Document Revision History contains one entry for each substantive version of the document, including the initial version and entries for each subsequent update. - - - - - - A set of Version, Date, and Description elements describing one iteration of this document - - - - - - Revision number of this iteration of the document. - - - - - Date when this iteration of the document was released. - - - - - Description of this iteration of the document. - - - - - - - - - - - - - - - - The initial date (and time, optionally) that the document was initially released by the issuing party. - - - - - The current date (and time, optionally) that the document was released by the issuing party. - - - - - The Document Generator meta-container contains all of the elements related to the generation of the document. - - - - - - The name and version of the engine that generated the CVRF document. - - - - - - - - - - The date the CVRF document was generated. - - - - - - - - - - - The Document Notes text contains all of the individual notes necessary to provide different types of low-level discussions of a CVRF document to various audiences. - - - - - - A individual note in freeform text. - - - - - - - Title should be a concise description of what is contained in this specific note. - - - - - Audience will indicate who is intended to read the note. - - - - - Type of content within this note. - - - - - Ordinal is a locally significant integral counter indexed from 1 used to track notes. - - - - - - - - - - - - The Document Distribution string should contain details on constraints, if any, about sharing this CVRF Document with additional recipients. - - - - - - - - - - Aggregate Severity is provided by the producer of the document to convey the urgency and criticality with which the vulnerability or vulnerabilities should be addressed. - - - - - - - URL of the namespace from which the Aggregate Severity is taken. - - - - - - - - - This meta-container should include references to any conferences, papers, advisories, and other resources that are related and considered to be of value to the document consumer. - - - - - - Related documents to the CVRF document. - - - - - - The URL of the related document. - - - - - The description of the related document. - - - - - - - - - - - Enumerated type value of reference relative to this document. - - - - - - - - - - The Acknowledgments container holds one or more Acknowledgement containers for document-level acknowledgements. - - - - - - The Acknowledgment container holds recognition details for external parties, specific to the document as a whole rather than individual vulnerabilities. - - - - - - The name (i.e., individual name) of the party being acknowledged. - - - - - - - - - - The organization of the party being acknowledged or the organization itself being acknowledged. - - - - - - - - - - The details of the acknowledgment that address the recognition of external parties who were instrumental in the discovery, reporting and response of this document. - - - - - - - - - - The optional URL to the person, place, or thing being acknowledged. - - - - - - - - - - - - - - - This is to ensure that each Vulnerability's Ordinal uses a unique value. - - - - - - - This is to ensure that each note has a unique ordinal value. - - - - - - - A key to reference a specific product defined in a referenced product schema. - - - - - - - An instance of the ProductKey to be used in the ProductID element for affected products. - - - - - - - An instance of the ProductKey to be used in the CVSS ScoreSet product references. - - - - - - - An instance of the ProductKey to be used in the Threat product references. - - - - - - - An instance of the ProductKey to be used in the Remediation product references. - - - - - - - A key to reference a specific product group defined in a referenced product schema. - - - - - - - An instance of the GroupKey to be used in the Threat product references. - - - - - - - An instance of the GroupKey to be used in the Remediation product references. - - - - - - diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/prod/.svn/all-wcprops b/vulnerabilities/scraper/cvrf_parser/schemata/prod/.svn/all-wcprops deleted file mode 100755 index ed7742176..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/prod/.svn/all-wcprops +++ /dev/null @@ -1,5 +0,0 @@ -K 25 -svn:wc:ra_dav:version-url -V 47 -/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/prod -END diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/prod/.svn/entries b/vulnerabilities/scraper/cvrf_parser/schemata/prod/.svn/entries deleted file mode 100755 index 154f4940a..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/prod/.svn/entries +++ /dev/null @@ -1,31 +0,0 @@ -10 - -dir -91 -https://subversion.assembla.com/svn/icasi-cvrf/trunk/schemata/prod -https://subversion.assembla.com/svn/icasi-cvrf - - - -2012-05-07T17:25:01.568574Z -82 -xorrkaz - - - - - - - - - - - - - - -085eb5b6-75e8-47bc-a513-804b55a9b1a4 - -1.1 -dir - diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/all-wcprops b/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/all-wcprops deleted file mode 100755 index 82e3603a8..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/all-wcprops +++ /dev/null @@ -1,11 +0,0 @@ -K 25 -svn:wc:ra_dav:version-url -V 51 -/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/prod/1.1 -END -prod.xsd -K 25 -svn:wc:ra_dav:version-url -V 60 -/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/prod/1.1/prod.xsd -END diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/entries b/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/entries deleted file mode 100755 index b39f9dd22..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/entries +++ /dev/null @@ -1,62 +0,0 @@ -10 - -dir -91 -https://subversion.assembla.com/svn/icasi-cvrf/trunk/schemata/prod/1.1 -https://subversion.assembla.com/svn/icasi-cvrf - - - -2012-05-07T17:25:01.568574Z -82 -xorrkaz - - - - - - - - - - - - - - -085eb5b6-75e8-47bc-a513-804b55a9b1a4 - -prod.xsd -file - - - - -2012-05-07T19:31:33.000000Z -af4c32fc699ecfd62880f88ccddf3208 -2012-05-07T17:25:01.568574Z -82 -xorrkaz -has-props - - - - - - - - - - - - - - - - - - - - -15519 - diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/prop-base/prod.xsd.svn-base b/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/prop-base/prod.xsd.svn-base deleted file mode 100755 index 869ac71cf..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/prop-base/prod.xsd.svn-base +++ /dev/null @@ -1,5 +0,0 @@ -K 14 -svn:executable -V 1 -* -END diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/text-base/prod.xsd.svn-base b/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/text-base/prod.xsd.svn-base deleted file mode 100755 index 4feb771c6..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/prod/1.1/.svn/text-base/prod.xsd.svn-base +++ /dev/null @@ -1,292 +0,0 @@ - - - - - - - - - - - - - - - This is the XML schema for the Common Vulnerability Reporting Framework's Product model. For more information, see the CVRF whitepaper. - - Joe Hemmerlein <joe.hemmerlein@microsoft.com> - Joe Clarke <jclarke@cisco.com> - 2012-05-07 - CVRF Product Dictionary - 1.1 - - - - - - - - Types enumerating the individual parts (stubs) that comprise a product name. - - - - - The name of the vendor or manufacturer that makes the product . - - - - - The product family that the product falls into. - - - - - The name of the product. - - - - - The version of the product. This can be a numeric or other descriptor. - - - - - The patch level of the product. - - - - - The service pack of the product. - - - - - The architecture for which the product is intended. - - - - - The language of the product. - - - - - A non-specific legacy entry. - - - - - A specification such as a standard, best common practice, etc. - - - - - The host name of a system/service. - - - - - The URI component of a system/service. - - - - - The file name component of a system/service. - - - - - - - Types enumerating the ways products can be related to each other. - - - - - This product is a default component of the referenced product. - - - - - This product is an optional component of the referenced product. - - - - - This product is an external component of the referenced product. - - - - - This product is installed on the referenced product. - - - - - This product is installed with the referenced product. - - - - - - - - - - - - - - - - - - Neutral product tree to streamline product entries that can be referenced elsewhere in the document. The end of each branch ("FullProductName") represents a referrenceable product. - - - - - - - - Defines how this product is related to another product. - - - - - - - - The ProductReference refers to the unique ProductID of the product that is to which another product will be related. - - - - - The RelationType attribute defines how the two products are related. - - - - - RelatesToProductReference refers to the unique ProductID of the product to which the ProductReference attribute value relates. - - - - - - - Container for grouping products to be used in vulnerabilities. - - - - - - A named container to associate two or more product IDs together for use in vulnerabilities. - - - - - - Optional textual description for this group. - - - - - - - - - - The ID of an existing product in this tree that is to be a member of this group. - - - - - - The unique identifier used to reference this group. - - - - - - - - - - - - This is to ensure that each FullProductName uses a unique ProductID value. - - - - - - - This is to ensure that each Group uses a unique GroupID value. - - - - - - - A key to reference a specific product. - - - - - - - An instance of the ProductKey used to define a relationship product. - - - - - - - An instance of the ProductKey used to define a related product. - - - - - - - An instance of the ProductKey used to define a product group membership list. - - - - - - - - Endpoint of product tree - this is an actual product entry. The string represents the friendly product name (i.e. the way it would be printed in other publications) - - - - - - - A value that uniquely identifies this Product entry in the scope of this document. Whenever a reference to this Product entry is needed anywhere in this document, its unique ID will be referenced. - - - - - The Common Platform Enumeration (CPE) attribute refers to a method for naming platforms. The structure for CPE is described at http://cpe.mitre.org. - - - - - - - diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/vuln/.svn/all-wcprops b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/.svn/all-wcprops deleted file mode 100755 index d0161ea70..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/vuln/.svn/all-wcprops +++ /dev/null @@ -1,5 +0,0 @@ -K 25 -svn:wc:ra_dav:version-url -V 47 -/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/vuln -END diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/vuln/.svn/entries b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/.svn/entries deleted file mode 100755 index 88b5c04ed..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/vuln/.svn/entries +++ /dev/null @@ -1,31 +0,0 @@ -10 - -dir -91 -https://subversion.assembla.com/svn/icasi-cvrf/trunk/schemata/vuln -https://subversion.assembla.com/svn/icasi-cvrf - - - -2012-05-07T17:25:01.568574Z -82 -xorrkaz - - - - - - - - - - - - - - -085eb5b6-75e8-47bc-a513-804b55a9b1a4 - -1.1 -dir - diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/all-wcprops b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/all-wcprops deleted file mode 100755 index 455c82a85..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/all-wcprops +++ /dev/null @@ -1,11 +0,0 @@ -K 25 -svn:wc:ra_dav:version-url -V 51 -/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/vuln/1.1 -END -vuln.xsd -K 25 -svn:wc:ra_dav:version-url -V 60 -/svn/icasi-cvrf/!svn/ver/84/trunk/schemata/vuln/1.1/vuln.xsd -END diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/entries b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/entries deleted file mode 100755 index 52d8c07a8..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/entries +++ /dev/null @@ -1,62 +0,0 @@ -10 - -dir -91 -https://subversion.assembla.com/svn/icasi-cvrf/trunk/schemata/vuln/1.1 -https://subversion.assembla.com/svn/icasi-cvrf - - - -2012-05-07T17:25:01.568574Z -82 -xorrkaz - - - - - - - - - - - - - - -085eb5b6-75e8-47bc-a513-804b55a9b1a4 - -vuln.xsd -file - - - - -2012-05-07T19:31:33.000000Z -af8dd0239812a299f8ad2501d6c1d254 -2012-05-07T17:25:01.568574Z -82 -xorrkaz - - - - - - - - - - - - - - - - - - - - - -35659 - diff --git a/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/text-base/vuln.xsd.svn-base b/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/text-base/vuln.xsd.svn-base deleted file mode 100755 index 7e3a1e013..000000000 --- a/vulnerabilities/scraper/cvrf_parser/schemata/vuln/1.1/.svn/text-base/vuln.xsd.svn-base +++ /dev/null @@ -1,631 +0,0 @@ - - - - - - - - - - - - - - - - This is the XML schema for the Common Vulnerability Reporting Framework's Vulnerability model. For more information, see the CVRF whitepaper. - - Brian Schafer <bschafer@microsoft.com> - Joe Clarke <jclarke@cisco.com> - Joe Hemmerlein <Joe.Hemmerlein@microsoft.com> - 2012-05-07 - CVRF Vulnerability Dictionary - 1.1 - - - - - - - - Types enumerating a party's current engagement status for this vulnerability. - - - - - The party has acknowledged that they are aware of the vulnerability report. - - - - - The party disputes the vulnerability report in its entirety - - - - - Some hot-fixes, permanent fixes, or patches have been made available by the party, but more fixes or patches are going to be released in the future. - - - - - The party asserts that they have completed remediation of the vulnerability. - - - - - The party has been contacted, but was unresponsive or unavailable. - - - - - No contact has been attempted with the party. - - - - - - - String type to match CVE IDs - - - - - - - - String type to match CWE IDs - - - - - - - - String representing the components needed to compute the various CVSS scores - - - - - - - - Types enumerating the affected statuses described by a vulnerability - - - - - The first version known to be affected by this vulnerability. - - - - - This version is the first fixed version for the vulnerability but may not be the recommended fixed version. - - - - - This version is contains a fix for the vulnerability but may not be the recommended fixed version. - - - - - This version is known to be affected by the vulnerability. - - - - - This version is known NOT to be affected by the vulnerability. - - - - - This is the last version in a train known to be affected. Versions released after this would contain a fix for this vulnerability. - - - - - This version has a fix for the vulnerability and is the vendor-recommended version for fixing the vulnerability. - - - - - - - Types enumerating the Threat type described by the vulnerability - - - - - Impact contains an assessment of the impact on the user or the target set if the vulnerability is successful exploited. - - - - - Exploit Status contains a description of the degree to which an exploit for the vulnerability is known. - - - - - Target Set contains a description of the currently known victim population in whatever terms are appropriate. - - - - - - - Types enumerating the Remedy type described by the vulnerability. - - - - - Workaround contains information about a configuration or specific deployment scenario that can be used to avoid exposure to the vulnerability. - - - - - Mitigation contains information about a configuration or deployment scenario that helps to reduce the risk of the vulnerability but that does not resolve the vulnerability on the affected product. - - - - - Vendor Fix contains information about an official fix that is issued by the original author of the affected product. - - - - - Currently there is no fix available. - - - - - There is no fix for the vulnerability and there never will be one. - - - - - - - Existing product ID from the product tree. - - - - - Existing product group ID from the product tree. - - - - - - - - This is a meta-container for the aggregation of all fields that are related to a single vulnerability within the document. - - - - - - Vulnerability Title gives the document producer the ability to apply a canonical name or title to the vulnerability. - - - - - - - - - - Vulnerability ID gives the document producer a place to publish a unique label or tracking ID for the vulnerability (if such information exists). - - - - - - - System Name indicates the name of the vulnerability tracking or numbering system that this vulnerability ID comes from. - - - - - - - - - The Notes container holds all individual notes concerning this vulnerability. - - - - - - The Notes text contains all of the content necessary to provide different types of low-level discussions of a given vulnerability to various audiences. - - - - - - - Title should be a concise description of what is contained in Vulnerability Notes. - - - - - Audience will indicate who is intended to read the note. - - - - - Type of content within this note. - - - - - Ordinal is a locally significant integral counter indexed from 1 used to track notes. - - - - - - - - - - - - Date vulnerability was initially discovered by its original discoverer. - - - - - Date vulnerability was initially released to the public. - - - - - The Involvements container lists any number of vendor or third party interactions related to this vulnerability. - - - - - - Involvement contains a specific set of interaction details. - - - - - - The description of the Involvement. - - - - - - - - - - - Type of party with whom the involvement is taking place. - - - - - Status of the involvement with the specified party. - - - - - - - - - - The CVE string refers to the MITRE standard Common Vulnerabilities Enumeration (CVE) tracking number for the vulnerability. - - - - - Detailed description of the referrenced Common Weakness Enumeration (CWE) identifier. - - - - - - - The MITRE-assigned CWE identifier. - - - - - - - - - The ProductStatuses container holds the list of all the products affected by the vulnerability in question. - - - - - - The Status element holds an enumerated value based on available Product Name Entry items as constructed from the Product Tree container. - - - - - - - - Affected status for the product or products defined in this container. - - - - - - - - - - Contains all Threat containers - - - - - - Threat contains the "kinetic" information associated with a vulnerability. - - - - - - The description of the Threat. - - - - - - - - - - - - - The type of the Threat. - - - - - The date this Threat item was last updated; if omitted it is deemed to be unknown, irrelevant, or unimportant. - - - - - - - - - - The CVSS Score Set meta-container holds one or more CVSS score sets to describe vulnerable products. - - - - - - CVSS scores for a given product ID.  If the ProductID attribute is omitted, the score applies to all vulnerable products. - - - - - - The CVSS Base Score is the numeric value of the computed CVSS Base Score which should be a float from 0 – 10.0. - - - - - The CVSS Base Score is the numeric value of the computed CVSS Temporal Score which should be a float from 0 – 10.0. - - - - - The CVSS Base Score is the numeric value of the computed CVSS Environmental Score which should be a float from 0 – 10.0. - - - - - The CVSS Vector string is the official notation that contains all of the values used to compute the Base, Temporal, and Environmental scores. - - - - - - - - - - - - The Remediation meta-container tag holds all related Workaround, Mitigation, Vendor Fix, and Entitlement entries that are associated with the specific vulnerability. - - - - - - Holds all of the specific details on how to handle (and presumably, fix) the vulnerability, tied to Product ID. - - - - - - Textual description of this remedy. - - - - - - - - - - The Entitlement string will contain any possible vendor-defined constraints for obtaining fixed software or hardware that fully resolves the vulnerability. - - - - - - - - - - URL from which the remedy can be obtained. - - - - - - - - Specific type of remedy. - - - - - The date Remedy was last updated, if omitted it is deemed to be unknown, unimportant, or irrelevant. - - - - - - - - - - This meta-container should include references to any conferences, papers, advisories, and other resources that are related to this vulnerability. - - - - - - This meta-container contains an orthogonally related document, background info, whitepaper, etc. to the specific vulnerability. - - - - - - The URL of the related document. - - - - - The description of the related document. - - - - - - - - - - - Enumerated type value of reference relative to this document. - - - - - - - - - - The Acknowledgments container holds one or more Acknowledgement containers for vulnerability-level acknowledgements. - - - - - - The Acknowledgment container holds recognition for external parties who were instrumental in the discovery of, reporting of, and response to the vulnerability. - - - - - - The name (i.e., individual name) of the party being acknowledged. - - - - - - - - - - The organization of the party being acknowledged or the organization itself being acknowledged. - - - - - - - - - - The details of the acknowledgment that address the recognition of external parties who were instrumental in the discovery, reporting and response of this document. - - - - - - - - - - The optional URL to the person, place, or thing being acknowledged. - - - - - - - - - - - - Locally significant numeric value to track vulnerabilities within a CVRF document. This enables vulnerabilities to be referenced from elsewhere inside the document (often at the document-level) - - - - - - This is to ensure that each product mentions a given ProductID only one. - - - - - - - This is to ensure that each CVSS score set mentions a given ProductID only one. - - - - - - - This is to ensure that each note has a unique ordinal value. - - - - - - From a8d13e6d5b73eb26842b66b901d80a9fef0edde4 Mon Sep 17 00:00:00 2001 From: Shivam Sandbhor Date: Fri, 17 Apr 2020 18:18:11 +0530 Subject: [PATCH 7/8] Trim cvrf_parser Signed-off-by: Shivam Sandbhor --- .../scraper/cvrf_parser/cvrf_parser.py | 40 +------------------ 1 file changed, 1 insertion(+), 39 deletions(-) diff --git a/vulnerabilities/scraper/cvrf_parser/cvrf_parser.py b/vulnerabilities/scraper/cvrf_parser/cvrf_parser.py index c63b4d6ef..b81baa002 100755 --- a/vulnerabilities/scraper/cvrf_parser/cvrf_parser.py +++ b/vulnerabilities/scraper/cvrf_parser/cvrf_parser.py @@ -4,38 +4,9 @@ class CVRF_Syntax(object): # CVRF Elements and Namespaces. - CVRF_ARGS = [ - "all", - "DocumentTitle", - "DocumentType", - "DocumentPublisher", - "DocumentTracking", - "DocumentNotes", - "DocumentDistribution", - "AggregateSeverity", - "DocumentReferences", - "Acknowledgments", - ] cvrf_versions = ["1.1", "1.2"] - output_formats = ["csv", "html", "txt"] - related_product_tags = [ - "all", - "ProductID", - "Status", - "CVE", - "Title", - "BaseScore", - "Vector", - "TemporalScore", - "Note", - "FullProductName", - "Branch", - "Revision", - "Remediation", - "Acknowledgment", - "Threat", - ] + VULN_ARGS = [ "all", @@ -57,15 +28,6 @@ class CVRF_Syntax(object): "Vulnerability", ] - PROD_ARGS = [ - "all", - "Branch", - "FullProductName", - "Relationship", - "ProductGroups", - "ProductID", - ] - def __init__(self, cvrf_version): # defaults to current cvrf version 1.2 specification unless otherwise # specified From f9654b05be3200cc7e88969b2f67d6c48eb5cc92 Mon Sep 17 00:00:00 2001 From: Shivam Sandbhor Date: Tue, 5 May 2020 10:42:13 +0530 Subject: [PATCH 8/8] Fix style Signed-off-by: Shivam Sandbhor --- vulnerabilities/scraper/cvrf_parser/cvrf_parser.py | 1 - 1 file changed, 1 deletion(-) diff --git a/vulnerabilities/scraper/cvrf_parser/cvrf_parser.py b/vulnerabilities/scraper/cvrf_parser/cvrf_parser.py index b81baa002..eae6b4b5a 100755 --- a/vulnerabilities/scraper/cvrf_parser/cvrf_parser.py +++ b/vulnerabilities/scraper/cvrf_parser/cvrf_parser.py @@ -6,7 +6,6 @@ class CVRF_Syntax(object): # CVRF Elements and Namespaces. cvrf_versions = ["1.1", "1.2"] - VULN_ARGS = [ "all",