(RHSA-2013:0631) Moderate: jbossweb security update

2013-03-1100:00:00

access.redhat.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

67.1%

JSON

JBoss Web is a web container based on Apache Tomcat. It provides a single
deployment platform for the JavaServer Pages (JSP) and Java Servlet
technologies.

Multiple weaknesses were found in the JBoss Web DIGEST authentication
implementation, effectively reducing the security normally provided by
DIGEST authentication. A remote attacker could use these flaws to perform
replay attacks in some circumstances. (CVE-2012-5885, CVE-2012-5886,
CVE-2012-5887)

Warning: Before applying this update, back up your existing JBoss
Enterprise Web Platform installation (including all applications and
configuration files).

All users of JBoss Enterprise Web Platform 5.2.0 on Red Hat Enterprise
Linux 4, 5, and 6 are advised to upgrade to these updated packages. The
JBoss server process must be restarted for the update to take effect.

OSVersionArchitecturePackageVersionFilename
RedHat5noarchjbossweb-servlet-2.5-api< 2.1.13-3_patch_02.ep5.el5jbossweb-servlet-2.5-api-2.1.13-3_patch_02.ep5.el5.noarch.rpm
RedHat5noarchjbossweb-jsp-2.1-api< 2.1.13-3_patch_02.ep5.el5jbossweb-jsp-2.1-api-2.1.13-3_patch_02.ep5.el5.noarch.rpm
RedHat5srcjbossweb< 2.1.13-3_patch_02.ep5.el5jbossweb-2.1.13-3_patch_02.ep5.el5.src.rpm
RedHat6noarchjbossweb-lib< 2.1.13-4_patch_02.ep5.el6jbossweb-lib-2.1.13-4_patch_02.ep5.el6.noarch.rpm
RedHat6srcjbossweb< 2.1.13-4_patch_02.ep5.el6jbossweb-2.1.13-4_patch_02.ep5.el6.src.rpm
RedHat6noarchjbossweb-el-1.0-api< 2.1.13-4_patch_02.ep5.el6jbossweb-el-1.0-api-2.1.13-4_patch_02.ep5.el6.noarch.rpm
RedHat5noarchjbossweb< 2.1.13-3_patch_02.ep5.el5jbossweb-2.1.13-3_patch_02.ep5.el5.noarch.rpm
RedHat6noarchjbossweb< 2.1.13-4_patch_02.ep5.el6jbossweb-2.1.13-4_patch_02.ep5.el6.noarch.rpm
RedHat6noarchjbossweb-servlet-2.5-api< 2.1.13-4_patch_02.ep5.el6jbossweb-servlet-2.5-api-2.1.13-4_patch_02.ep5.el6.noarch.rpm
RedHat5noarchjbossweb-lib< 2.1.13-3_patch_02.ep5.el5jbossweb-lib-2.1.13-3_patch_02.ep5.el5.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	5	noarch	jbossweb-servlet-2.5-api	< 2.1.13-3_patch_02.ep5.el5	jbossweb-servlet-2.5-api-2.1.13-3_patch_02.ep5.el5.noarch.rpm
RedHat	5	noarch	jbossweb-jsp-2.1-api	< 2.1.13-3_patch_02.ep5.el5	jbossweb-jsp-2.1-api-2.1.13-3_patch_02.ep5.el5.noarch.rpm
RedHat	5	src	jbossweb	< 2.1.13-3_patch_02.ep5.el5	jbossweb-2.1.13-3_patch_02.ep5.el5.src.rpm
RedHat	6	noarch	jbossweb-lib	< 2.1.13-4_patch_02.ep5.el6	jbossweb-lib-2.1.13-4_patch_02.ep5.el6.noarch.rpm
RedHat	6	src	jbossweb	< 2.1.13-4_patch_02.ep5.el6	jbossweb-2.1.13-4_patch_02.ep5.el6.src.rpm
RedHat	6	noarch	jbossweb-el-1.0-api	< 2.1.13-4_patch_02.ep5.el6	jbossweb-el-1.0-api-2.1.13-4_patch_02.ep5.el6.noarch.rpm
RedHat	5	noarch	jbossweb	< 2.1.13-3_patch_02.ep5.el5	jbossweb-2.1.13-3_patch_02.ep5.el5.noarch.rpm
RedHat	6	noarch	jbossweb	< 2.1.13-4_patch_02.ep5.el6	jbossweb-2.1.13-4_patch_02.ep5.el6.noarch.rpm
RedHat	6	noarch	jbossweb-servlet-2.5-api	< 2.1.13-4_patch_02.ep5.el6	jbossweb-servlet-2.5-api-2.1.13-4_patch_02.ep5.el6.noarch.rpm
RedHat	5	noarch	jbossweb-lib	< 2.1.13-3_patch_02.ep5.el5	jbossweb-lib-2.1.13-3_patch_02.ep5.el5.noarch.rpm