-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat JBoss Enterprise Application Platform 6.3.2 update Advisory ID: RHSA-2014:1822-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-1822.html Issue date: 2014-11-06 CVE Names: CVE-2013-4002 ===================================================================== 1. Summary: Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.3.2 and fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat JBoss EAP 6.3 for RHEL 7 - noarch 3. Description: Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an excessive amount of CPU. (CVE-2013-4002) This release of JBoss Enterprise Application Platform also includes bug fixes and enhancements. A list of these changes is available from the JBoss Enterprise Application Platform 6.3.2 Downloads page on the Customer Portal. All users of Red Hat JBoss Enterprise Application Platform 6.3 on Red Hat Enterprise Linux 7 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up any customized Red Hat JBoss Enterprise Application Platform 6 configuration files. On update, the configuration files that have been locally modified will not be updated. The updated version of such files will be stored as the rpmnew files. Make sure to locate any such files after the update and merge any changes manually. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1019176 - CVE-2013-4002 Xerces-J2 OpenJDK: XML parsing Denial of Service (JAXP, 8017298) 1147624 - RHEL7 RPMs: Upgrade apache-cxf-xjc-utils to 2.6.2.redhat-1 1147630 - RHEL7 RPMs: Upgrade xml-security to 1.5.7.redhat-1 1149799 - RHEL7 RPMs: Upgrade wss4j to 1.6.16.redhat-2 1149802 - RHEL7 RPMs: Upgrade jbossws-cxf to 4.3.1.Final-redhat-1 1149805 - RHEL7 RPMs: Upgrade jbossws-common to 2.3.1.Final-redhat-1 1149816 - RHEL7 RPMs: Upgrade netty to 3.6.10.Final-redhat-1 1149819 - RHEL7 RPMs: Upgrade apache-cxf to 2.7.12.SP1-redhat-1 1149822 - RHEL7 RPMs: Upgrade jboss-hal to 2.2.11.Final-redhat-1 1149825 - RHEL7 RPMs: Upgrade jboss-remoting3-jmx to 1.1.3.Final-redhat-2 1149828 - RHEL7 RPMs: Upgrade jboss-xnio-base to 3.0.11.GA-redhat-2 1150706 - RHEL7 RPMs: Upgrade hibernate4-eap6 to 4.2.14.SP4-redhat-1 1150896 - RHEL7 RPMs: Upgrade ironjacamar-eap6 to 1.0.28.Final-redhat-1 1151608 - RHEL7 RPMs: Upgrade weld-core to 1.1.25.Final-redhat-2 1151611 - RHEL7 RPMs: Upgrade jboss-metadata to 7.1.2.Final-redhat-1 1151614 - RHEL7 RPMs: Upgrade jboss-as-console to 2.2.11.Final-redhat-1 6. Package List: Red Hat JBoss EAP 6.3 for RHEL 7: Source: apache-cxf-2.7.12-1.SP1_redhat_1.1.ep6.el7.src.rpm apache-cxf-xjc-utils-2.6.2-3.redhat_1.1.ep6.el7.src.rpm hibernate4-eap6-4.2.14-9.SP4_redhat_1.1.ep6.el7.src.rpm ironjacamar-eap6-1.0.28-1.Final_redhat_1.1.ep6.el7.src.rpm javassist-eap6-3.18.1-5.GA_redhat_1.1.ep6.el7.src.rpm jboss-as-appclient-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-cli-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-client-all-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-clustering-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-cmp-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-configadmin-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-connector-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-console-2.2.11-1.Final_redhat_1.1.ep6.el7.src.rpm jboss-as-controller-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-controller-client-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-core-security-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-deployment-repository-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-deployment-scanner-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-domain-http-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-domain-management-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-ee-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-ee-deployment-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-ejb3-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-embedded-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-host-controller-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-jacorb-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-jaxr-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-jaxrs-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-jdr-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-jmx-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-jpa-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-jsf-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-jsr77-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-logging-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-mail-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-management-client-content-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-messaging-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-modcluster-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-naming-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-network-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-osgi-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-osgi-configadmin-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-osgi-service-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-picketlink-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-platform-mbean-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-pojo-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-process-controller-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-protocol-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-remoting-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-sar-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-security-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-server-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-system-jmx-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-threads-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-transactions-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-version-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-web-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-webservices-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-weld-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-as-xts-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jboss-hal-2.2.11-1.Final_redhat_1.1.ep6.el7.src.rpm jboss-logmanager-1.5.2-2.Final_redhat_2.1.ep6.el7.src.rpm jboss-metadata-7.1.2-1.Final_redhat_1.1.ep6.el7.src.rpm jboss-remoting3-jmx-1.1.3-1.Final_redhat_2.1.ep6.el7.src.rpm jboss-xnio-base-3.0.11-1.GA_redhat_2.1.ep6.el7.src.rpm jbossas-appclient-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jbossas-bundles-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jbossas-core-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jbossas-domain-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jbossas-javadocs-7.4.2-2.Final_redhat_2.1.ep6.el7.src.rpm jbossas-modules-eap-7.4.2-2.Final_redhat_2.1.ep6.el7.src.rpm jbossas-product-eap-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jbossas-standalone-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jbossas-welcome-content-eap-7.4.2-3.Final_redhat_2.1.ep6.el7.src.rpm jbossws-common-2.3.1-1.Final_redhat_1.1.ep6.el7.src.rpm jbossws-cxf-4.3.1-1.Final_redhat_1.1.ep6.el7.src.rpm netty-3.6.10-1.Final_redhat_1.1.ep6.el7.src.rpm picketlink-bindings-2.5.3-11.SP12_redhat_1.1.ep6.el7.src.rpm picketlink-federation-2.5.3-12.SP12_redhat_1.1.ep6.el7.src.rpm resteasy-2.3.8-10.SP3_redhat_2.1.ep6.el7.src.rpm weld-core-1.1.25-1.Final_redhat_2.1.ep6.el7.src.rpm wss4j-1.6.16-1.redhat_2.1.ep6.el7.src.rpm xerces-j2-eap6-2.9.1-17.redhat_6.1.ep6.el7.src.rpm xml-security-1.5.7-2.redhat_1.1.ep6.el7.src.rpm noarch: apache-cxf-2.7.12-1.SP1_redhat_1.1.ep6.el7.noarch.rpm apache-cxf-xjc-utils-2.6.2-3.redhat_1.1.ep6.el7.noarch.rpm cxf-xjc-boolean-2.6.2-3.redhat_1.1.ep6.el7.noarch.rpm cxf-xjc-dv-2.6.2-3.redhat_1.1.ep6.el7.noarch.rpm cxf-xjc-ts-2.6.2-3.redhat_1.1.ep6.el7.noarch.rpm hibernate4-core-eap6-4.2.14-9.SP4_redhat_1.1.ep6.el7.noarch.rpm hibernate4-eap6-4.2.14-9.SP4_redhat_1.1.ep6.el7.noarch.rpm hibernate4-entitymanager-eap6-4.2.14-9.SP4_redhat_1.1.ep6.el7.noarch.rpm hibernate4-envers-eap6-4.2.14-9.SP4_redhat_1.1.ep6.el7.noarch.rpm hibernate4-infinispan-eap6-4.2.14-9.SP4_redhat_1.1.ep6.el7.noarch.rpm ironjacamar-common-api-eap6-1.0.28-1.Final_redhat_1.1.ep6.el7.noarch.rpm ironjacamar-common-impl-eap6-1.0.28-1.Final_redhat_1.1.ep6.el7.noarch.rpm ironjacamar-common-spi-eap6-1.0.28-1.Final_redhat_1.1.ep6.el7.noarch.rpm ironjacamar-core-api-eap6-1.0.28-1.Final_redhat_1.1.ep6.el7.noarch.rpm ironjacamar-core-impl-eap6-1.0.28-1.Final_redhat_1.1.ep6.el7.noarch.rpm ironjacamar-deployers-common-eap6-1.0.28-1.Final_redhat_1.1.ep6.el7.noarch.rpm ironjacamar-eap6-1.0.28-1.Final_redhat_1.1.ep6.el7.noarch.rpm ironjacamar-jdbc-eap6-1.0.28-1.Final_redhat_1.1.ep6.el7.noarch.rpm ironjacamar-spec-api-eap6-1.0.28-1.Final_redhat_1.1.ep6.el7.noarch.rpm ironjacamar-validator-eap6-1.0.28-1.Final_redhat_1.1.ep6.el7.noarch.rpm javassist-eap6-3.18.1-5.GA_redhat_1.1.ep6.el7.noarch.rpm jboss-as-appclient-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-cli-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-client-all-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-clustering-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-cmp-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-configadmin-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-connector-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-console-2.2.11-1.Final_redhat_1.1.ep6.el7.noarch.rpm jboss-as-controller-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-controller-client-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-core-security-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-deployment-repository-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-deployment-scanner-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-domain-http-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-domain-management-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-ee-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-ee-deployment-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-ejb3-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-embedded-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-host-controller-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-jacorb-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-jaxr-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-jaxrs-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-jdr-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-jmx-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-jpa-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-jsf-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-jsr77-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-logging-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-mail-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-management-client-content-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-messaging-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-modcluster-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-naming-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-network-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-osgi-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-osgi-configadmin-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-osgi-service-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-picketlink-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-platform-mbean-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-pojo-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-process-controller-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-protocol-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-remoting-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-sar-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-security-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-server-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-system-jmx-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-threads-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-transactions-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-version-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-web-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-webservices-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-weld-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-as-xts-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-hal-2.2.11-1.Final_redhat_1.1.ep6.el7.noarch.rpm jboss-logmanager-1.5.2-2.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-metadata-7.1.2-1.Final_redhat_1.1.ep6.el7.noarch.rpm jboss-metadata-appclient-7.1.2-1.Final_redhat_1.1.ep6.el7.noarch.rpm jboss-metadata-common-7.1.2-1.Final_redhat_1.1.ep6.el7.noarch.rpm jboss-metadata-ear-7.1.2-1.Final_redhat_1.1.ep6.el7.noarch.rpm jboss-metadata-ejb-7.1.2-1.Final_redhat_1.1.ep6.el7.noarch.rpm jboss-metadata-web-7.1.2-1.Final_redhat_1.1.ep6.el7.noarch.rpm jboss-remoting3-jmx-1.1.3-1.Final_redhat_2.1.ep6.el7.noarch.rpm jboss-xnio-base-3.0.11-1.GA_redhat_2.1.ep6.el7.noarch.rpm jbossas-appclient-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jbossas-bundles-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jbossas-core-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jbossas-domain-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jbossas-javadocs-7.4.2-2.Final_redhat_2.1.ep6.el7.noarch.rpm jbossas-modules-eap-7.4.2-2.Final_redhat_2.1.ep6.el7.noarch.rpm jbossas-product-eap-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jbossas-standalone-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jbossas-welcome-content-eap-7.4.2-3.Final_redhat_2.1.ep6.el7.noarch.rpm jbossws-common-2.3.1-1.Final_redhat_1.1.ep6.el7.noarch.rpm jbossws-cxf-4.3.1-1.Final_redhat_1.1.ep6.el7.noarch.rpm netty-3.6.10-1.Final_redhat_1.1.ep6.el7.noarch.rpm picketlink-bindings-2.5.3-11.SP12_redhat_1.1.ep6.el7.noarch.rpm picketlink-federation-2.5.3-12.SP12_redhat_1.1.ep6.el7.noarch.rpm resteasy-2.3.8-10.SP3_redhat_2.1.ep6.el7.noarch.rpm weld-core-1.1.25-1.Final_redhat_2.1.ep6.el7.noarch.rpm wss4j-1.6.16-1.redhat_2.1.ep6.el7.noarch.rpm xerces-j2-eap6-2.9.1-17.redhat_6.1.ep6.el7.noarch.rpm xjc-utils-2.6.2-3.redhat_1.1.ep6.el7.noarch.rpm xml-security-1.5.7-2.redhat_1.1.ep6.el7.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2013-4002 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFUW660XlSAg2UNWIIRApw9AKCdJiMGSN4DzYlJReAifjDxadU9UgCfbDwU IUzmnmvV0ixremdwRy7Il5c= =4MgE -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce