(RHSA-2008:0966) Moderate: Red Hat Application Stack v2.2 security and enhancement update

The Red Hat Application Stack v2.2 is an integrated open source application
stack, that includes Red Hat Enterprise Linux 5 and JBoss Enterprise
Application Platform (EAP) 4.2.

This erratum updates the Apache HTTP Server package to version 2.2.10 which
addresses the following security issues:

A flaw was found in the mod_proxy module. An attacker who has control of
a web server to which requests are being proxied could cause a limited
denial of service due to CPU consumption and stack exhaustion. (CVE-2008-2364)

A flaw was found in the mod_proxy_ftp module. Where Apache is configured
to support ftp-over-httpd proxying, a remote attacker could perform a
cross-site scripting attack. (CVE-2008-2939)

A cross-site request forgery issue was found in the mod_proxy_balancer
module. A remote attacker could cause a denial of service if
mod_proxy_balancer is enabled and an authenticated user is targeted.
(CVE-2007-6420)

The JBoss Enterprise Application Platform (EAP) 4.2 has been updated to
version 4.2.0.CP05.

The following packages were also updated:

• mysql to 5.0.60sp1
• mysql-connector-odbc to 3.51.26r1127
• perl-DBI to 1.607
• perl-DBD-MySQL to 4.008
• perl-DBD-Pg to 1.49
• php-pear to 1.7.2
• postgresql to 8.2.11
• postgresqlclient81 to 8.1.11