Red Hat Security Advisory: JBoss Operations Network 3.1.2 update Security Advisory secalert@redhat.com Red Hat Security Response Team RHSA-2013:0187 Final 1 1 2013-01-23T21:39:00Z Current version 2013-01-23T21:39:00Z 2013-01-23T21:39:00Z Red Hat rhsa-to-cvrf 1.0.1484 2013-01-23T21:54:06Z JBoss Operations Network 3.1.2, which fixes one security issue and several bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. JBoss Operations Network (JBoss ON) is a middleware management solution that provides a single point of control to deploy, manage, and monitor JBoss Enterprise Middleware, applications, and services. This JBoss ON 3.1.2 release serves as a replacement for JBoss ON 3.1.1, and includes several bug fixes. Refer to the JBoss ON 3.1.2 Release Notes for information on the most significant of these changes. The Release Notes will be available shortly from https://access.redhat.com/knowledge/docs/ The following security issue is also fixed with this release: A cross-site scripting (XSS) flaw was found in Google Web Toolkit (GWT), a core part of the JBoss ON web interface. If a remote attacker could trick a user, who was logged into the JBoss ON web interface, into visiting a specially-crafted URL, it could possibly lead to arbitrary web script execution in the context of the user's JBoss ON session. (CVE-2012-5920) Warning: Before applying the update, back up your existing JBoss ON installation (including its databases, applications, configuration files, the JBoss ON server's file system directory, and so on). All users of JBoss Operations Network 3.1.1 as provided from the Red Hat Customer Portal are advised to upgrade to JBoss Operations Network 3.1.2. Please see https://www.redhat.com/footer/terms-of-use.html Copyright © 2013 Red Hat, Inc. All rights reserved. Moderate https://rhn.redhat.com/errata/RHSA-2013-0187.html https://rhn.redhat.com/errata/RHSA-2013-0187.html https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=em&version=3.1.2 https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=em&version=3.1.2 https://developers.google.com/web-toolkit/release-notes#Release_Notes_Current https://developers.google.com/web-toolkit/release-notes#Release_Notes_Current https://access.redhat.com/knowledge/docs/ https://access.redhat.com/knowledge/docs/ A cross-site scripting (XSS) flaw was found in Google Web Toolkit (GWT), a core part of the JBoss ON web interface. If a remote attacker could trick a user, who was logged into the JBoss ON web interface, into visiting a specially-crafted URL, it could possibly lead to arbitrary web script execution in the context of the user's JBoss ON session. 2012-10-29T00:00:00Z 2012-10-26T00:00:00Z CVE-2012-5920 Moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing JBoss ON installation (including its databases, applications, configuration files, the JBoss ON server's file system directory, and so on). Refer to the JBoss Operations Network 3.1.2 Release Notes for installation information. https://rhn.redhat.com/errata/RHSA-2013-0187.html https://developers.google.com/web-toolkit/release-notes#Release_Notes_Current https://developers.google.com/web-toolkit/release-notes#Release_Notes_Current https://www.redhat.com/security/data/cve/CVE-2012-5920.html CVE-2012-5920 https://bugzilla.redhat.com/show_bug.cgi?id=871690 bz#871690: CVE-2012-5920 GWT: unknown XSS flaw