[RHSA-2014:1039-01] Moderate: Red Hat JBoss Enterprise Application Platform 6.3.0 security update

[bugzilla at redhat.com]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat JBoss Enterprise Application Platform 6.3.0 security update
Advisory ID:       RHSA-2014:1039-01
Product:           Red Hat JBoss Enterprise Application Platform
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2014-1039.html
Issue date:        2014-08-11
CVE Names:         CVE-2014-3490 
=====================================================================

1. Summary:

An update for Red Hat JBoss Enterprise Application Platform 6.3.0 that
fixes one security issue is now available from the Red Hat Customer Portal.

Red Hat Product Security has rated this update as having Moderate security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.

2. Description:

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java
applications based on JBoss Application Server 7.

It was found that the fix for CVE-2012-0818 was incomplete: external
parameter entities were not disabled when the
resteasy.document.expand.entity.references parameter was set to false.
A remote attacker able to send XML requests to a RESTEasy endpoint could
use this flaw to read files accessible to the user running the application
server, and potentially perform other more advanced XXE attacks.
(CVE-2014-3490)

This issue was discovered by David Jorm of Red Hat Product Security.

All users of Red Hat JBoss Enterprise Application Platform 6.3.0 as
provided from the Red Hat Customer Portal are advised to apply this update.
The JBoss server process must be restarted for the update to take effect.

3. Solution:

The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing Red Hat JBoss Enterprise Application Platform installation and
deployed applications.

4. Bugs fixed (https://bugzilla.redhat.com/):

1107901 - CVE-2014-3490 RESTEasy: XXE via parameter entities

5. References:

https://www.redhat.com/security/data/cve/CVE-2014-3490.html
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=6.3

6. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2014 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFT6PyrXlSAg2UNWIIRAg+TAJ9OCz7ZE8OYV7021KB0w289mz0oMwCgv9WS
3PGhpwQwM48QXnOLbTrGXAQ=
=y3Dw
-----END PGP SIGNATURE-----