Red Hat Security Advisory: JBoss Enterprise BRMS Platform 5.3.1 update Security Advisory secalert@redhat.com Red Hat Security Response Team RHSA-2012:1573 Final 1 1 2012-12-13T00:23:00Z Current version 2012-12-13T00:23:00Z 2012-12-13T00:23:00Z Red Hat rhsa-to-cvrf 1.0.1484 2012-12-13T00:30:02Z JBoss Enterprise BRMS Platform 5.3.1, which fixes one security issue, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. JBoss Enterprise BRMS Platform is a business rules management system for the management, storage, creation, modification, and deployment of JBoss Rules. This release of JBoss Enterprise BRMS Platform 5.3.1 serves as a replacement for JBoss Enterprise BRMS Platform 5.3.0. This release is currently only available as a deployable package to run on an existing JBoss application server. (Users of the standalone package who require the CVE-2012-2379 fix immediately can obtain it from RHSA-2012:1559.) This release includes various bug fixes and enhancements which are detailed in the JBoss Enterprise BRMS Platform 5.3.1 Release Notes. The Release Notes will be available shortly from https://access.redhat.com/knowledge/docs/ The following security issue is also fixed with this release: A flaw was found in the way Apache CXF verified that XML elements were signed or encrypted by a particular Supporting Token. Apache CXF checked to ensure these elements were signed or encrypted by a Supporting Token, but not whether the correct token was used. A remote attacker could use this flaw to transmit confidential information without the appropriate security, and potentially circumvent access controls on web services exposed via Apache CXF. (CVE-2012-2379) Red Hat would like to thank the Apache CXF project for reporting this issue. All users of JBoss Enterprise BRMS Platform 5.3.0 as provided from the Red Hat Customer Portal are advised to upgrade to JBoss Enterprise BRMS Platform 5.3.1. Please see https://www.redhat.com/footer/terms-of-use.html Copyright © 2012 Red Hat, Inc. All rights reserved. Important https://rhn.redhat.com/errata/RHSA-2012-1573.html https://rhn.redhat.com/errata/RHSA-2012-1573.html https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms&downloadType=distributions https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms&downloadType=distributions https://access.redhat.com/knowledge/docs/ https://access.redhat.com/knowledge/docs/ https://rhn.redhat.com/errata/RHSA-2012-1559.html https://rhn.redhat.com/errata/RHSA-2012-1559.html http://cxf.apache.org/cve-2012-2379.html http://cxf.apache.org/cve-2012-2379.html This release of JBoss Enterprise BRMS Platform 5.3.1 serves as a replacement for JBoss Enterprise BRMS Platform 5.3.0. This release is currently only available as a deployable package to run on an existing JBoss application server. (Users of the standalone package who require the CVE-2012-2379 fix immediately can obtain it from RHSA-2012:1559.) This release includes various bug fixes and enhancements which are detailed in the JBoss Enterprise BRMS Platform 5.3.1 Release Notes. The Release Notes will be available shortly from https://access.redhat.com/knowledge/docs/ A flaw was found in the way Apache CXF verified that XML elements were signed or encrypted by a particular Supporting Token. Apache CXF checked to ensure these elements were signed or encrypted by a Supporting Token, but not whether the correct token was used. A remote attacker could use this flaw to transmit confidential information without the appropriate security, and potentially circumvent access controls on web services exposed via Apache CXF. 2012-05-28T00:00:00Z 2012-06-07T00:00:00Z CVE-2012-2379 Important 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing JBoss Enterprise BRMS Platform installation (including its databases, applications, configuration files, and so on). https://rhn.redhat.com/errata/RHSA-2012-1573.html http://cxf.apache.org/cve-2012-2379.html http://cxf.apache.org/cve-2012-2379.html https://www.redhat.com/security/data/cve/CVE-2012-2379.html CVE-2012-2379 https://bugzilla.redhat.com/show_bug.cgi?id=826534 bz#826534: CVE-2012-2379 jbossws-cxf, apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token Red Hat would like to thank the Apache CXF project for reporting this issue.