Red Hat Security Advisory

RHSA-2015:0846

Red Hat JBoss Enterprise Application Platform 6.4.0 update

Released 2015-04-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server apache-commons-cli-eap6-1.2.0-1.redhat_8.1.ep6.el5, apache-commons-codec-eap6-1.4.0-4.redhat_4.1.ep6.el5, apache-commons-configuration-eap6-1.6.0-1.redhat_4.2.ep6.el5 +47

Fixes 7 records

TI-2015-00198 CVE-2015-0226 · GHSA-vjwc-5hfh-2vv5

Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about…

MEDIUM 41

Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plainte…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.05501 Published 2017-10-30 Partial fix · 1.6.17, 2.0.2 CWE-327

TI-2015-00199 CVE-2015-0227 · GHSA-6r5v-hp32-fjqw

Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the…

LOW 33

Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.07543 Published 2015-02-12 Partial fix · 1.6.17, 2.02 CWE-264

TI-2014-06727 CVE-2014-8111 · GHSA-f49p-9mwv-783f

Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of…

LOW 33

Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attackers to access otherwise restricted artifacts via unspecified vectors.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.07059 Published 2015-04-21 Partial fix CWE-200

TI-2015-00244 CVE-2015-0277 · GHSA-vhqm-6xhg-59wv

The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member…

LOW 31

The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts v…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.0196 Published 2015-08-17 Fixed CWE-284

TI-2015-05246 CVE-2015-6254 · GHSA-cc8r-2q55-6c87

The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0…

LOW 30

The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the messag…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.01781 Published 2015-08-17 Fixed CWE-17

TI-2015-00263 CVE-2015-0298 · GHSA-hf4r-6f6g-9rgp

Cross-site scripting (XSS) vulnerability in the manager web interface in mod_cluster…

LOW 24

Cross-site scripting (XSS) vulnerability in the manager web interface in mod_cluster before 1.3.2.Alpha1 allows remote attackers to inject arbitrary web script or HTML via a crafted MCMP message.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01846 Published 2015-08-24 Partial fix CWE-79

TI-2014-02910 CVE-2014-3586 · GHSA-q4g2-rhrf-wvj6

The default configuration for the Command Line Interface in Red Hat Enterprise…

LOW 11

The default configuration for the Command Line Interface in Red Hat Enterprise Application Platform before 6.4.0 and WildFly (formerly JBoss Application Server) uses weak permissions for .jboss-cli-history, which allows…

CVSS 2.0LOW 2.1 Local No auth Interaction — EPSS 0.00372 Published 2015-04-21 Partial fix CWE-264