Synopsis

Important: Red Hat JBoss Enterprise Web Platform 5.2.0 security update

Type/Severity

Security Advisory: Important

Topic

Updated packages for Red Hat JBoss Enterprise Web Platform 5.2.0 that fix
one security issue are now available for Red Hat Enterprise Linux 4, 5,
and 6.

The Red Hat Security Response Team has rated this update as having
Important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

Description

Red Hat JBoss Enterprise Web Platform is a platform for Java applications,
which integrates the JBoss Web Server with JBoss Hibernate and JBoss Seam.

It was found that the implementation of the
org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method
provided a DocumentBuilderFactory that would expand entity references.
A remote, unauthenticated attacker could use this flaw to read files
accessible to the user running the application server, and potentially
perform other more advanced XXE attacks. (CVE-2014-3530)

Red Hat would like to thank Alexander Papadakis for reporting this issue.

All users of Red Hat JBoss Enterprise Web Platform 5.2.0 on Red Hat
Enterprise Linux 4, 5, and 6 are advised to upgrade to these updated
packages. The JBoss server process must be restarted for the update to take
effect.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied. Also, back up your existing Red
Hat JBoss Enterprise Web Platform 5 installation (including all
applications and configuration files).

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

Affected Products

• JBoss Enterprise Web Platform 5 for RHEL 6 x86_64
• JBoss Enterprise Web Platform 5 for RHEL 6 i386
• JBoss Enterprise Web Platform 5 for RHEL 5 x86_64
• JBoss Enterprise Web Platform 5 for RHEL 5 i386

Fixes

• BZ - 1112987 - CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage

CVEs

• CVE-2014-3530

References

• https://access.redhat.com/security/updates/classification/#important

JBoss Enterprise Web Platform 5 for RHEL 6

SRPM
picketlink-federation-2.1.5-3_patch_01.el6_5.src.rpm	SHA-256: 802448bee6fa7b93019f9350d1f48bd6fdc72cf3d7f855171c6385ac1416a438
x86_64
picketlink-federation-2.1.5-3_patch_01.el6_5.noarch.rpm	SHA-256: f58da1a135c070f514d1115d446c37fa1dadc2f91d4d13f6fb79363e0a951964
i386
picketlink-federation-2.1.5-3_patch_01.el6_5.noarch.rpm	SHA-256: f58da1a135c070f514d1115d446c37fa1dadc2f91d4d13f6fb79363e0a951964

JBoss Enterprise Web Platform 5 for RHEL 5

SRPM
picketlink-federation-2.1.5-3_patch_01.ep5.el5.src.rpm	SHA-256: 7d2d5a4df93e252c4620e1a9e3873b2d4c41a2a5bcf314268b705d8b6ab0cc43
x86_64
picketlink-federation-2.1.5-3_patch_01.ep5.el5.noarch.rpm	SHA-256: 064580d432f539978c55867006754f42565f4b3a211d718c6907ead77b87d6e5
i386
picketlink-federation-2.1.5-3_patch_01.ep5.el5.noarch.rpm	SHA-256: 064580d432f539978c55867006754f42565f4b3a211d718c6907ead77b87d6e5