-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Reference: CERT-EU Security Advisory 2012-0147 Title: JBoss Enterprise BRMS Platform 5.3.1 update [1] Version history: 17.12.2012 Initial publication Summary ======= JBoss Enterprise BRMS Platform 5.3.1, which fixes one security issue, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. CVE number: CVE-2012-2379 CVSS v2: 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N [2] Affected Versions ================= JBoss Enterprise BRMS Platform 5.3.1 Original Details ================ This release of JBoss Enterprise BRMS Platform 5.3.1 serves as a replacement for JBoss Enterprise BRMS Platform 5.3.0. This release is currently only available as a deployable package to run on an existing JBoss application server. (Users of the standalone package who require the CVE-2012-2379 fix immediately can obtain it from RHSA-2012:1559.) This release includes various bug fixes and enhancements which are detailed in the JBoss Enterprise BRMS Platform 5.3.1 Release Notes. A flaw was found in the way Apache CXF verified that XML elements were signed or encrypted by a particular Supporting Token. Apache CXF checked to ensure these elements were signed or encrypted by a Supporting Token, but not whether the correct token was used. A remote attacker could use this flaw to transmit confidential information without the appropriate security, and potentially circumvent access controls on web services exposed via Apache CXF. All users of JBoss Enterprise BRMS Platform 5.3.0 as provided from the Red Hat Customer Portal are advised to upgrade to JBoss Enterprise BRMS Platform 5.3.1. What can you do? ================ Patches are available [3] What to tell your users ======================= N/A More information ================ [1] https://rhn.redhat.com/errata/RHSA-2012-1573.html [2] https://access.redhat.com/security/cve/CVE-2012-2379 [3] https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms&downloadType=distributions Best regards, CERT-EU Team (http://cert.europa.eu) Phone: +32.2.2990005 / e-mail: cert-eu@ec.europa.eu PGP KeyID 0x46AC4383 FP: 9011 6BE9 D642 DD93 8348 DAFA 27A4 06CA 46AC 4383 Privacy Statement: http://cert.europa.eu/cert/plainedition/en/cert_privacy.html -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQIcBAEBAgAGBQJQ0dmRAAoJEPpzpNLI8SVo/CoP/2grr76WGLxK0m1XNAWZ1o5B TRw4dvqPI9wWoznKNALnJH23O0JOmjdXk7ComzuvvTLJChHxEAVaplPPFxjMWXOX 3/8MgX3PiSe2Bx3XDNMbbO3mZU9nesRE9GakRpg8RMn5OwP9TNoCaH2DXqQvziaY ZHKA9l0+QnJgLeCdAwu1xQfjk5FZ3myBHCwxVx5S6nXM2W+83aVe1B+sPNwKM9xr uc5JyabdyJYwGRF51CJpeZ8oVlAW6WE75QnT9dWObE6BpOQ0EQrxsgnitWarQEIa Vh9Ph/i4nE+WSd2nYfVvl3btWek7IxHXDgd0ZxJKMEwRsQOKGFlbruOedOHEOKNz /0Dm24vBNV0Qu7ddD58ZpC2iPJcPygsALjq90liya981SzHnAfE2OYRyMLUqQeUN 9PJ0AERFywskCOok1tjHrksqxTElGVtdeR2i3GC9xXTK6FONlbCctk+lkjDknWot akz45y9oNYWhYqxY3iiLlolWodRK5dTlV9WOYM/MEKewyJzFrEK3dHCAgP3y1u6S bcQrViKIXzM2tndKTTK55UYdI/G4lczddBK/ZPXLmvZJxRjLPyQN6S8A2YvwSyka GOqUilSpo7U02fp2tOwKtS7fqikmHa9yz4sUEKED/Wpn2NgLLkMz8fJ9BEodiYL/ O13W+beGUC69TnhTc07c =JRcZ -----END PGP SIGNATURE-----