(RHSA-2013:0629) Moderate: jbossweb security update

2013-03-1100:00:00

access.redhat.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

67.1%

JSON

JBoss Web is the web container, based on Apache Tomcat, in JBoss Enterprise
Application Platform. It provides a single deployment platform for the
JavaServer Pages (JSP) and Java Servlet technologies.

Multiple weaknesses were found in the JBoss Web DIGEST authentication
implementation, effectively reducing the security normally provided by
DIGEST authentication. A remote attacker could use these flaws to perform
replay attacks in some circumstances. (CVE-2012-5885, CVE-2012-5886,
CVE-2012-5887)

Warning: Before applying this update, back up your existing JBoss
Enterprise Application Platform installation (including all applications
and configuration files).

All users of JBoss Enterprise Application Platform 5.2.0 on Red Hat
Enterprise Linux 4, 5, and 6 are advised to upgrade to these updated
packages. The JBoss server process must be restarted for the update to take
effect.

OSVersionArchitecturePackageVersionFilename
RedHat5srcjbossweb< 2.1.13-3_patch_02.ep5.el5jbossweb-2.1.13-3_patch_02.ep5.el5.src.rpm
RedHat5noarchjbossweb-jsp-2.1-api< 2.1.13-3_patch_02.ep5.el5jbossweb-jsp-2.1-api-2.1.13-3_patch_02.ep5.el5.noarch.rpm
RedHat6srcjbossweb< 2.1.13-4_patch_02.ep5.el6jbossweb-2.1.13-4_patch_02.ep5.el6.src.rpm
RedHat5noarchjbossweb-servlet-2.5-api< 2.1.13-3_patch_02.ep5.el5jbossweb-servlet-2.5-api-2.1.13-3_patch_02.ep5.el5.noarch.rpm
RedHat6noarchjbossweb-lib< 2.1.13-4_patch_02.ep5.el6jbossweb-lib-2.1.13-4_patch_02.ep5.el6.noarch.rpm
RedHat5noarchjbossweb-el-1.0-api< 2.1.13-3_patch_02.ep5.el5jbossweb-el-1.0-api-2.1.13-3_patch_02.ep5.el5.noarch.rpm
RedHat6noarchjbossweb-servlet-2.5-api< 2.1.13-4_patch_02.ep5.el6jbossweb-servlet-2.5-api-2.1.13-4_patch_02.ep5.el6.noarch.rpm
RedHat6noarchjbossweb-el-1.0-api< 2.1.13-4_patch_02.ep5.el6jbossweb-el-1.0-api-2.1.13-4_patch_02.ep5.el6.noarch.rpm
RedHat6noarchjbossweb< 2.1.13-4_patch_02.ep5.el6jbossweb-2.1.13-4_patch_02.ep5.el6.noarch.rpm
RedHat5noarchjbossweb< 2.1.13-3_patch_02.ep5.el5jbossweb-2.1.13-3_patch_02.ep5.el5.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	5	src	jbossweb	< 2.1.13-3_patch_02.ep5.el5	jbossweb-2.1.13-3_patch_02.ep5.el5.src.rpm
RedHat	5	noarch	jbossweb-jsp-2.1-api	< 2.1.13-3_patch_02.ep5.el5	jbossweb-jsp-2.1-api-2.1.13-3_patch_02.ep5.el5.noarch.rpm
RedHat	6	src	jbossweb	< 2.1.13-4_patch_02.ep5.el6	jbossweb-2.1.13-4_patch_02.ep5.el6.src.rpm
RedHat	5	noarch	jbossweb-servlet-2.5-api	< 2.1.13-3_patch_02.ep5.el5	jbossweb-servlet-2.5-api-2.1.13-3_patch_02.ep5.el5.noarch.rpm
RedHat	6	noarch	jbossweb-lib	< 2.1.13-4_patch_02.ep5.el6	jbossweb-lib-2.1.13-4_patch_02.ep5.el6.noarch.rpm
RedHat	5	noarch	jbossweb-el-1.0-api	< 2.1.13-3_patch_02.ep5.el5	jbossweb-el-1.0-api-2.1.13-3_patch_02.ep5.el5.noarch.rpm
RedHat	6	noarch	jbossweb-servlet-2.5-api	< 2.1.13-4_patch_02.ep5.el6	jbossweb-servlet-2.5-api-2.1.13-4_patch_02.ep5.el6.noarch.rpm
RedHat	6	noarch	jbossweb-el-1.0-api	< 2.1.13-4_patch_02.ep5.el6	jbossweb-el-1.0-api-2.1.13-4_patch_02.ep5.el6.noarch.rpm
RedHat	6	noarch	jbossweb	< 2.1.13-4_patch_02.ep5.el6	jbossweb-2.1.13-4_patch_02.ep5.el6.noarch.rpm
RedHat	5	noarch	jbossweb	< 2.1.13-3_patch_02.ep5.el5	jbossweb-2.1.13-3_patch_02.ep5.el5.noarch.rpm