(RHSA-2012:1010) Moderate: mod_cluster security update

mod_cluster is an Apache HTTP Server (httpd) based load balancer that
forwards requests from httpd to application server nodes. It can use the
AJP, HTTP, or HTTPS protocols for communication with application server
nodes.

The JBoss Enterprise Application Platform 5.1.2 release (RHSA-2011:1805)
introduced a regression, causing mod_cluster to register and expose the
root context of a server by default, even when “ROOT” was in the
“excludedContexts” list in the mod_cluster configuration. If an application
was deployed on the root context, a remote attacker could use this flaw to
bypass intended access restrictions and gain access to that application.
(CVE-2012-1154)

Warning: Before applying this update, back up your JBoss Enterprise
Application Platform’s “jboss-as/server/[PROFILE]/deploy/” directory, along
with all other customized configuration files.

All users of JBoss Enterprise Application Platform 5.1.2 as provided from
the Red Hat Customer Portal are advised to install this update.