Red Hat Product Errata RHSA-2015:1525 - Security Advisory
Issued:
2015-07-30
Updated:
2015-07-30

RHSA-2015:1525 - Security Advisory

Synopsis

Moderate: Red Hat JBoss Operations Network 3.3.3 update

Type/Severity

Security Advisory: Moderate

Topic

Red Hat JBoss Operations Network 3.3 update 3, which fixes one security
issue and several bugs, is now available from the Red Hat Customer Portal.

Red Hat Product Security has rated this update as having Moderate security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.

Description

Red Hat JBoss Operations Network is a Middleware management solution that
provides a single point of control to deploy, manage, and monitor JBoss
Enterprise Middleware, applications, and services.

This JBoss Operations Network 3.3.3 release serves as a replacement for
JBoss Operations Network 3.3.2, and includes several bug fixes. Refer to
the Customer Portal page linked in the References section for information
on the most significant of these changes.

The following security issue is also fixed with this release:

It was discovered that a cross-site scripting (XSS) vulnerability on a
JBoss Operations Network 404 error page allowed for session fixation
attacks. An attacker could use this flaw to impersonate a legitimate user,
resulting in compromised integrity of secure data. (CVE-2015-3267)

All users of JBoss Operations Network 3.3.2 as provided from the Red Hat
Customer Portal are advised to upgrade to JBoss Operations Network 3.3.3.

Solution

The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing JBoss Operations Network installation (including its databases,
applications, configuration files, the JBoss Operations Network server's
file system directory, and so on).

Refer to the JBoss Operations Network 3.3.3 Release Notes for
installation information.

Affected Products

  • Red Hat JBoss Middleware Text-Only Advisories for MIDDLEWARE 1 x86_64

Fixes

  • BZ - 652800 - Unable to use parentheses in search filters for LDAP configuration
  • BZ - 1113044 - Jboss-on-agent packages conflicts in jbappplatform-6-i386-server-6-rpm RHN channel
  • BZ - 1173096 - Support for Filtering child resources
  • BZ - 1173164 - Globally uncaught Exception shown in the JBoss ON UI when trying to display orphaned operation schedule
  • BZ - 1180343 - JBoss ON server installer incorrectly requires storage node to be installed locally
  • BZ - 1187527 - It's not possible to add a standalone storage node
  • BZ - 1194638 - no patched log created when user does not have permission to apply patch
  • BZ - 1202760 - Next execution link in "Scheduled Operations" portlet is not correct
  • BZ - 1207263 - Dashboard portlet of memory heap does not have breadcrumb
  • BZ - 1207276 - Uninventory of platform always display a message "You are going to uninventory at least one resource that may be used by the storage cluster" when its not.
  • BZ - 1208854 - Unable to stop storage node when running on IBM SDK 8
  • BZ - 1209558 - RtFilter never load vHostMappingFile from absolute or relative path in EAP 6
  • BZ - 1211407 - Agent plug-in deletion fails if resource group or auto-group operation was used
  • BZ - 1212022 - unable to deploy package from repository if type is not File:Deployment/DomainDeployment
  • BZ - 1212627 - Server fails to reconnect to storage node
  • BZ - 1212853 - Failure saving measurement trait data - value too long for type character varying(4000)
  • BZ - 1212878 - Cannot obtain client connection to the RHQ app server while upgrading JON server
  • BZ - 1212933 - Resource start operation leads to broken managed server
  • BZ - 1212950 - EAP 6 start operation causes agent to run out of memory due to storing console output in an unused buffer
  • BZ - 1213366 - Could not complete storage cluster schema installation due to NoClassDefFoundError
  • BZ - 1213782 - Could not complete storage cluster schema installation: java.lang.NullPointerException
  • BZ - 1215648 - Reverse proxy in front of JBoss ON does not render the login page but shows the html source of the page
  • BZ - 1220816 - Attempt to associate the HTTP content source with repository displays JBWEB000065: HTTP Status 404 error
  • BZ - 1221288 - Impossible to send Notifications to a Group
  • BZ - 1221745 - Recent Alerts and Operations portlets are not sortable
  • BZ - 1225448 - Unable to add package type to content source
  • BZ - 1225492 - XHTML files contain errorprone javascript calls
  • BZ - 1232006 - Agent does not start if RHQ_AGENT_JAVA_OPTS is set in rhq-agent-env.sh
  • BZ - 1233991 - Creation and group association of bundle fails with IllegalArgumentException: Token did not result in valid file
  • BZ - 1237155 - CVE-2015-3267 JON: Cross Site scripting possible on the JBoss ON 404 error page

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.