Updated packages for Red Hat JBoss Enterprise Web Platform 5.2.0 that fixone security issue are now available for Red Hat Enterprise Linux 4, 5,and 6.Red Hat Product Security has rated this update as having Moderate securityimpact. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available from the CVE link in theReferences section.

Red Hat JBoss Enterprise Web Platform is a platform for Java applications,which integrates the JBoss Web Server with JBoss Hibernate and JBoss Seam.It was discovered that the Apache Santuario XML Security for Java projectallowed Document Type Definitions (DTDs) to be processed when applyingTransforms even when secure validation was enabled. A remote attacker coulduse this flaw to exhaust all available memory on the system, causing adenial of service. (CVE-2013-4517)All users of Red Hat JBoss Enterprise Web Platform 5.2.0 on Red HatEnterprise Linux 4, 5, and 6 are advised to upgrade to these updatedpackages. The JBoss server process must be restarted for the update to takeeffect.
Before applying this update, make sure all previously released erratarelevant to your system have been applied. Also, back up your existing RedHat JBoss Enterprise Web Platform 5 installation (including allapplications and configuration files).This update is available via the Red Hat Network. Details on how to use theRed Hat Network to apply this update are available athttps://access.redhat.com/articles/11258JBoss Enterprise Web Platform 5 EL4

SRPMS:
xml-security-1.5.6-3.ep5.el4.src.rpm
    MD5: c2a76f45a368772c9f9a58660cfbb030SHA-256: 955ea02e4f3a0b6f7139a603a1bc2dd0633b33e7fe078440fd293707b1fd3903
 
IA-32:
xml-security-1.5.6-3.ep5.el4.noarch.rpm
    MD5: 4cfecf7600a28896f2b157f0f6164a6dSHA-256: 349ba933e8efe42f7fa2bbfe865ce8223f55fa0fa86a41fcbb4f25affef86793
 
x86_64:
xml-security-1.5.6-3.ep5.el4.noarch.rpm
    MD5: 4cfecf7600a28896f2b157f0f6164a6dSHA-256: 349ba933e8efe42f7fa2bbfe865ce8223f55fa0fa86a41fcbb4f25affef86793
 
JBoss Enterprise Web Platform 5 EL5

SRPMS:
xml-security-1.5.6-3.ep5.el5.src.rpm
    MD5: b86166d959b7d4319c997aee2f5dad4eSHA-256: f3eef1efa9599ca99dc2f01fd4150beefe25411f951710aa4abecc388c8c6dc0
 
IA-32:
xml-security-1.5.6-3.ep5.el5.noarch.rpm
    MD5: c13e29a10c6e93b67634b7f5b652d08fSHA-256: 8189d4b165ec111afcac65055a20c807fe32ae78afe27cd3a589676f9a3c6293
 
x86_64:
xml-security-1.5.6-3.ep5.el5.noarch.rpm
    MD5: c13e29a10c6e93b67634b7f5b652d08fSHA-256: 8189d4b165ec111afcac65055a20c807fe32ae78afe27cd3a589676f9a3c6293
 
JBoss Enterprise Web Platform 5 EL6

SRPMS:
xml-security-1.5.6-3.el6.src.rpm
    MD5: 76ad4a780d7d183552bf7c988ab94d3eSHA-256: eea580dceb45bc7fe89d0256404f2a57b69f1044d6611f66e6e3bab7009d1263
 
IA-32:
xml-security-1.5.6-3.el6.noarch.rpm
    MD5: 587d988c8ca1a72eafd8d004f1f8d55eSHA-256: 3e5baab2c0d71ff2734d7ba918e3863274a7d4b21deee6a549ed20ead01aeda5
 
x86_64:
xml-security-1.5.6-3.el6.noarch.rpm
    MD5: 587d988c8ca1a72eafd8d004f1f8d55eSHA-256: 3e5baab2c0d71ff2734d7ba918e3863274a7d4b21deee6a549ed20ead01aeda5
 
(The unlinked packages above are only available from the Red Hat Network)
1045257 – CVE-2013-4517 Apache Santuario XML Security for Java: Java XML Signature DoS Attack

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from:

Leave a Reply