-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: JBoss Enterprise Application Platform 5.2.0 security update Advisory ID: RHSA-2013:0873-01 Product: JBoss Enterprise Application Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-0873.html Issue date: 2013-05-28 CVE Names: CVE-2012-5575 ===================================================================== 1. Summary: Updated packages for JBoss Enterprise Application Platform 5.2.0 which fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: JBoss Enterprise Application Platform 5 for RHEL 4 AS - noarch JBoss Enterprise Application Platform 5 for RHEL 4 ES - noarch JBoss Enterprise Application Platform 5 for RHEL 5 Server - noarch JBoss Enterprise Application Platform 5 for RHEL 6 Server - noarch 3. Description: JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam. XML encryption backwards compatibility attacks were found against various frameworks, including Apache CXF. An attacker could force a server to use insecure, legacy cryptosystems, even when secure cryptosystems were enabled on endpoints. By forcing the use of legacy cryptosystems, flaws such as CVE-2011-1096 and CVE-2011-2487 would be exposed, allowing plain text to be recovered from cryptograms and symmetric keys. This issue affected both the JBoss Web Services CXF (jbossws-cxf) and JBoss Web Services Native (jbossws-native) stacks. (CVE-2012-5575) Red Hat would like to thank Tibor Jager, Kenneth G. Paterson and Juraj Somorovsky of Ruhr-University Bochum for reporting this issue. If you are using jbossws-cxf, then automatic checks to prevent this flaw are only run when WS-SecurityPolicy is used to enforce security requirements. It is best practice to use WS-SecurityPolicy to enforce security requirements. If you are using jbossws-native, the fix for this flaw is implemented by two new configuration parameters in the 'encryption' element. This element can be a child of 'requires' in both client and server wsse configuration descriptors (set on a per-application basis via the application's jboss-wsse-server.xml and jboss-wsse-client.xml files). The new attributes are 'algorithms' and 'keyWrapAlgorithms'. These attributes should contain a blank space or comma separated list of algorithm IDs that are allowed for the encrypted incoming message, both for encryption and private key wrapping. For backwards compatibility, no algorithm checks are performed by default for empty lists or missing attributes. For example (do not include the line break in your configuration): encryption algorithms="aes-192-gcm aes-256-gcm" keyWrapAlgorithms="rsa_oaep" Specifies that incoming messages are required to be encrypted, and that the only permitted encryption algorithms are AES-192 and 256 in GCM mode, and RSA-OAEP only for key wrapping. Before performing any decryption, the jbossws-native stack will verify that each algorithm specified in the incoming messages is included in the allowed algorithms lists from these new encryption element attributes. The algorithm values to be used for 'algorithms' and 'keyWrapAlgorithms' are the same as for 'algorithm' and 'keyWrapAlgorithm' in the 'encrypt' element. Warning: Before applying this update, back up your existing JBoss Enterprise Application Platform installation (including all applications and configuration files). All users of JBoss Enterprise Application Platform 5.2.0 on Red Hat Enterprise Linux 4, 5, and 6 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 880443 - CVE-2012-5575 jbossws-native, jbossws-cxf, apache-cxf: XML encryption backwards compatibility attacks 6. Package List: JBoss Enterprise Application Platform 5 for RHEL 4 AS: Source: ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/apache-cxf-2.2.12-12.patch_07.ep5.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jbossws-3.1.2-14.SP15_patch_02.ep5.el4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/wss4j-1.5.12-6_patch_03.ep5.el4.src.rpm noarch: apache-cxf-2.2.12-12.patch_07.ep5.el4.noarch.rpm jbossws-3.1.2-14.SP15_patch_02.ep5.el4.noarch.rpm wss4j-1.5.12-6_patch_03.ep5.el4.noarch.rpm JBoss Enterprise Application Platform 5 for RHEL 4 ES: Source: ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/apache-cxf-2.2.12-12.patch_07.ep5.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jbossws-3.1.2-14.SP15_patch_02.ep5.el4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/wss4j-1.5.12-6_patch_03.ep5.el4.src.rpm noarch: apache-cxf-2.2.12-12.patch_07.ep5.el4.noarch.rpm jbossws-3.1.2-14.SP15_patch_02.ep5.el4.noarch.rpm wss4j-1.5.12-6_patch_03.ep5.el4.noarch.rpm JBoss Enterprise Application Platform 5 for RHEL 5 Server: Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/apache-cxf-2.2.12-12.patch_07.ep5.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossws-3.1.2-14.SP15_patch_02.ep5.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/wss4j-1.5.12-6_patch_03.ep5.el5.src.rpm noarch: apache-cxf-2.2.12-12.patch_07.ep5.el5.noarch.rpm jbossws-3.1.2-14.SP15_patch_02.ep5.el5.noarch.rpm wss4j-1.5.12-6_patch_03.ep5.el5.noarch.rpm JBoss Enterprise Application Platform 5 for RHEL 6 Server: Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/apache-cxf-2.2.12-12.patch_07.ep5.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jbossws-3.1.2-14.SP15_patch_02.ep5.el6.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/wss4j-1.5.12-6_patch_03.ep5.el6.src.rpm noarch: apache-cxf-2.2.12-12.patch_07.ep5.el6.noarch.rpm jbossws-3.1.2-14.SP15_patch_02.ep5.el6.noarch.rpm wss4j-1.5.12-6_patch_03.ep5.el6.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2012-5575.html https://access.redhat.com/security/updates/classification/#important http://ws.apache.org/wss4j/best_practice.html http://cxf.apache.org/cve-2012-5575.html 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2013 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFRpO72XlSAg2UNWIIRAg6SAJ98q8sHWcmQDO/N0Gk3my43HBgUqgCeMKD/ vZuqul6GjKIzxuw+06zCTPo= =1ZuP -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce