-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Low: Red Hat JBoss Enterprise Application Platform 6.3.1 update Advisory ID: RHSA-2014:1287-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-1287.html Issue date: 2014-09-23 CVE Names: CVE-2014-3558 ===================================================================== 1. Summary: Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.3.1 and fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat JBoss EAP 6.3 for RHEL 7 - noarch 3. Description: Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was discovered that the implementation of org.hibernate.validator.util.ReflectionHelper together with the permissions required to run Hibernate Validator under the Java Security Manager could allow a malicious application deployed in the same application container to execute several actions with escalated privileges, which might otherwise not be possible. This flaw could be used to perform various attacks, including but not restricted to, arbitrary code execution in systems that are otherwise secured by the Java Security Manager. (CVE-2014-3558) This release of JBoss Enterprise Application Platform also includes bug fixes and enhancements. A list of these changes is available from the JBoss Enterprise Application Platform 6.3.1 Downloads page on the Customer Portal. All users of Red Hat JBoss Enterprise Application Platform 6.3 on Red Hat Enterprise Linux 7 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up any customized Red Hat JBoss Enterprise Application Platform 6 configuration files. On update, the configuration files that have been locally modified will not be updated. The updated version of such files will be stored as the rpmnew files. Make sure to locate any such files after the update and merge any changes manually. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1120495 - CVE-2014-3558 Hibernate Validator: JSM bypass via ReflectionHelper 1128668 - RHEL7 RPMs: Upgrade apache-cxf to 2.7.11.redhat-9 1128714 - RHEL7 RPMs: Upgrade hibernate4-validator to 4.3.2.Final-redhat-1 1129665 - RHEL7 RPMs: Upgrade jboss-hal to 2.2.10.Final-redhat-1 1129682 - RHEL7 RPMs: Upgrade jbossts to 4.17.22.Final-redhat-2 1131102 - RHEL7 RPMs: Upgrade hibernate4-eap6 to 4.2.14.SP3-redhat-1 1131837 - RHEL7 RPMs: Upgrade jboss-as-console to 2.2.10.Final-redhat-1 1131983 - RHEL7 RPMs: Upgrade jboss-marshalling to 1.4.8.Final-redhat-1 1131988 - RHEL7 RPMs: Upgrade jboss-ejb-client to 1.0.26.Final-redhat-1 1132011 - RHEL7 RPMs: Upgrade jboss-modules to 1.3.4.Final-redhat-1 1132035 - RHEL7 RPMs: Upgrade jboss-remoting3 to 3.3.3.Final-redhat-1 1132041 - RHEL7 RPMs: Upgrade jboss-security-negotiation to 2.3.4.Final-redhat-1 1132813 - RHEL7 RPMs: Upgrade jboss-remote-naming to 1.0.9.Final-redhat-1 1134669 - RHEL7 RPMs: Upgrade wss4j to 1.6.15.redhat-1 1136934 - RHEL7 RPMs: Upgrade hornetq to 2.3.21.Final-redhat-1 1136937 - RHEL7 RPMs: Upgrade jbossweb to 7.4.9.Final-redhat-1 6. Package List: Red Hat JBoss EAP 6.3 for RHEL 7: Source: glassfish-jaxb-eap6-2.2.5-22.redhat_9.1.ep6.el7.src.rpm glassfish-jsf-eap6-2.1.28-5.redhat_6.1.ep6.el7.src.rpm hibernate4-eap6-4.2.14-8.SP3_redhat_1.1.ep6.el7.src.rpm hibernate4-validator-4.3.2-1.Final_redhat_1.2.ep6.el7.src.rpm hornetq-2.3.21-1.Final_redhat_1.1.ep6.el7.src.rpm httpcomponents-eap6-7-4.redhat_3.1.ep6.el7.src.rpm ironjacamar-eap6-1.0.27-1.Final_redhat_1.1.ep6.el7.src.rpm jboss-as-appclient-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-cli-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-client-all-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-clustering-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-cmp-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-configadmin-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-connector-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-console-2.2.10-1.Final_redhat_1.1.ep6.el7.src.rpm jboss-as-controller-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-controller-client-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-core-security-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-deployment-repository-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-deployment-scanner-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-domain-http-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-domain-management-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-ee-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-ee-deployment-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-ejb3-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-embedded-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-host-controller-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-jacorb-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-jaxr-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-jaxrs-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-jdr-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-jmx-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-jpa-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-jsf-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-jsr77-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-logging-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-mail-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-management-client-content-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-messaging-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-modcluster-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-naming-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-network-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-osgi-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-osgi-configadmin-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-osgi-service-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-picketlink-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-platform-mbean-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-pojo-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-process-controller-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-protocol-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-remoting-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-sar-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-security-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-server-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-system-jmx-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-threads-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-transactions-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-version-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-web-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-webservices-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-weld-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-as-xts-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jboss-ejb-client-1.0.26-1.Final_redhat_1.1.ep6.el7.src.rpm jboss-hal-2.2.10-1.Final_redhat_1.1.ep6.el7.src.rpm jboss-jaxws-api_2.2_spec-2.0.2-6.Final_redhat_1.1.ep6.el7.src.rpm jboss-jms-api_1.1_spec-1.0.1-12.Final_redhat_2.2.ep6.el7.src.rpm jboss-marshalling-1.4.8-1.Final_redhat_1.1.ep6.el7.src.rpm jboss-modules-1.3.4-1.Final_redhat_1.1.ep6.el7.src.rpm jboss-remote-naming-1.0.9-1.Final_redhat_1.1.ep6.el7.src.rpm jboss-remoting3-3.3.3-1.Final_redhat_1.1.ep6.el7.src.rpm jboss-saaj-api_1.3_spec-1.0.3-6.Final_redhat_1.1.ep6.el7.src.rpm jboss-security-negotiation-2.3.4-1.Final_redhat_1.1.ep6.el7.src.rpm jbossas-appclient-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jbossas-bundles-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jbossas-core-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jbossas-domain-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jbossas-javadocs-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jbossas-modules-eap-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jbossas-product-eap-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jbossas-standalone-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jbossas-welcome-content-eap-7.4.1-2.Final_redhat_3.1.ep6.el7.src.rpm jbossts-4.17.22-2.Final_redhat_2.1.ep6.el7.src.rpm jbossweb-7.4.9-1.Final_redhat_1.1.ep6.el7.src.rpm jbossxb2-2.0.3-14.GA_redhat_2.2.ep6.el7.src.rpm resteasy-2.3.8-8.SP2_redhat_3.1.ep6.el7.src.rpm wss4j-1.6.15-2.redhat_1.1.ep6.el7.src.rpm xml-security-1.5.6-2.redhat_1.1.ep6.el7.src.rpm noarch: glassfish-jaxb-eap6-2.2.5-22.redhat_9.1.ep6.el7.noarch.rpm glassfish-jsf-eap6-2.1.28-5.redhat_6.1.ep6.el7.noarch.rpm hibernate4-core-eap6-4.2.14-8.SP3_redhat_1.1.ep6.el7.noarch.rpm hibernate4-eap6-4.2.14-8.SP3_redhat_1.1.ep6.el7.noarch.rpm hibernate4-entitymanager-eap6-4.2.14-8.SP3_redhat_1.1.ep6.el7.noarch.rpm hibernate4-envers-eap6-4.2.14-8.SP3_redhat_1.1.ep6.el7.noarch.rpm hibernate4-infinispan-eap6-4.2.14-8.SP3_redhat_1.1.ep6.el7.noarch.rpm hibernate4-validator-4.3.2-1.Final_redhat_1.2.ep6.el7.noarch.rpm hornetq-2.3.21-1.Final_redhat_1.1.ep6.el7.noarch.rpm httpclient-eap6-4.2.6-4.redhat_3.1.ep6.el7.noarch.rpm httpcomponents-client-eap6-4.2.6-4.redhat_3.1.ep6.el7.noarch.rpm httpcomponents-core-eap6-4.2.5-4.redhat_3.1.ep6.el7.noarch.rpm httpcomponents-project-eap6-7-4.redhat_3.1.ep6.el7.noarch.rpm httpcore-eap6-4.2.5-4.redhat_3.1.ep6.el7.noarch.rpm httpmime-eap6-4.2.6-4.redhat_3.1.ep6.el7.noarch.rpm ironjacamar-common-api-eap6-1.0.27-1.Final_redhat_1.1.ep6.el7.noarch.rpm ironjacamar-common-impl-eap6-1.0.27-1.Final_redhat_1.1.ep6.el7.noarch.rpm ironjacamar-common-spi-eap6-1.0.27-1.Final_redhat_1.1.ep6.el7.noarch.rpm ironjacamar-core-api-eap6-1.0.27-1.Final_redhat_1.1.ep6.el7.noarch.rpm ironjacamar-core-impl-eap6-1.0.27-1.Final_redhat_1.1.ep6.el7.noarch.rpm ironjacamar-deployers-common-eap6-1.0.27-1.Final_redhat_1.1.ep6.el7.noarch.rpm ironjacamar-eap6-1.0.27-1.Final_redhat_1.1.ep6.el7.noarch.rpm ironjacamar-jdbc-eap6-1.0.27-1.Final_redhat_1.1.ep6.el7.noarch.rpm ironjacamar-spec-api-eap6-1.0.27-1.Final_redhat_1.1.ep6.el7.noarch.rpm ironjacamar-validator-eap6-1.0.27-1.Final_redhat_1.1.ep6.el7.noarch.rpm jboss-as-appclient-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-cli-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-client-all-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-clustering-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-cmp-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-configadmin-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-connector-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-console-2.2.10-1.Final_redhat_1.1.ep6.el7.noarch.rpm jboss-as-controller-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-controller-client-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-core-security-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-deployment-repository-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-deployment-scanner-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-domain-http-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-domain-management-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-ee-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-ee-deployment-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-ejb3-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-embedded-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-host-controller-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-jacorb-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-jaxr-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-jaxrs-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-jdr-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-jmx-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-jpa-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-jsf-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-jsr77-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-logging-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-mail-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-management-client-content-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-messaging-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-modcluster-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-naming-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-network-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-osgi-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-osgi-configadmin-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-osgi-service-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-picketlink-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-platform-mbean-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-pojo-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-process-controller-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-protocol-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-remoting-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-sar-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-security-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-server-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-system-jmx-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-threads-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-transactions-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-version-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-web-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-webservices-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-weld-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-as-xts-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jboss-ejb-client-1.0.26-1.Final_redhat_1.1.ep6.el7.noarch.rpm jboss-hal-2.2.10-1.Final_redhat_1.1.ep6.el7.noarch.rpm jboss-jaxws-api_2.2_spec-2.0.2-6.Final_redhat_1.1.ep6.el7.noarch.rpm jboss-jms-api_1.1_spec-1.0.1-12.Final_redhat_2.2.ep6.el7.noarch.rpm jboss-marshalling-1.4.8-1.Final_redhat_1.1.ep6.el7.noarch.rpm jboss-modules-1.3.4-1.Final_redhat_1.1.ep6.el7.noarch.rpm jboss-remote-naming-1.0.9-1.Final_redhat_1.1.ep6.el7.noarch.rpm jboss-remoting3-3.3.3-1.Final_redhat_1.1.ep6.el7.noarch.rpm jboss-saaj-api_1.3_spec-1.0.3-6.Final_redhat_1.1.ep6.el7.noarch.rpm jboss-security-negotiation-2.3.4-1.Final_redhat_1.1.ep6.el7.noarch.rpm jbossas-appclient-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jbossas-bundles-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jbossas-core-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jbossas-domain-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jbossas-javadocs-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jbossas-modules-eap-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jbossas-product-eap-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jbossas-standalone-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jbossas-welcome-content-eap-7.4.1-2.Final_redhat_3.1.ep6.el7.noarch.rpm jbossts-4.17.22-2.Final_redhat_2.1.ep6.el7.noarch.rpm jbossweb-7.4.9-1.Final_redhat_1.1.ep6.el7.noarch.rpm jbossxb2-2.0.3-14.GA_redhat_2.2.ep6.el7.noarch.rpm resteasy-2.3.8-8.SP2_redhat_3.1.ep6.el7.noarch.rpm wss4j-1.6.15-2.redhat_1.1.ep6.el7.noarch.rpm xml-security-1.5.6-2.redhat_1.1.ep6.el7.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2014-3558.html https://access.redhat.com/security/updates/classification/#low 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFUIdf3XlSAg2UNWIIRAmlBAKC4lyA28/hR5ufGCAgu+0ZyP9qWUwCdHPay YZV6zClahI1R5p1avEivTwE= =jLnf -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce