Red Hat Security Advisory

RHSA-2014:0798

Red Hat JBoss Enterprise Application Platform 6.2.4 update

Released 2014-06-26 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server apache-cxf-2.7.11-3.redhat_3.1.ep6.el5, hibernate4-core-eap6-4.2.7-9.SP5_redhat_1.1.ep6.el5, hibernate4-eap6-4.2.7-9.SP5_redhat_1.1.ep6.el5 +47

Fixes 5 records

TI-2014-00033 CVE-2014-0035 · GHSA-v45r-rj5x-hpg2

The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when…

LOW 30

The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext,…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.07053 Published 2014-07-07 Partial fix · 2.6.13, 2.7.10 CWE-310

TI-2014-00032 CVE-2014-0034 · GHSA-38x2-fp9m-87mx

The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does…

LOW 30

The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.07405 Published 2014-07-07 Partial fix · 2.6.12, 2.7.9 CWE-20

TI-2014-02808 CVE-2014-3481 · GHSA-xm6x-8fqh-w3x3

org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise…

LOW 28

org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform (JEAP) before 6.2.4 enables entity expansion, which allows remote attackers to read arbitrary files via unspecified…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03031 Published 2014-07-07 Partial fix CWE-200

TI-2014-00104 CVE-2014-0110 · GHSA-5xf9-3v63-ww6f

Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a…

LOW 26

Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large invalid SOAP message.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03644 Published 2014-05-08 Partial fix · 2.6.14, 2.7.11 CWE-399

TI-2014-00103 CVE-2014-0109 · GHSA-5wqf-h3r3-gxvh

Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a…

LOW 26

Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/html to a SOAP endpoint, which triggers an…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03644 Published 2014-05-08 Partial fix · 2.6.14, 2.7.11 CWE-399