-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat JBoss Enterprise Application Platform 6.1.1 update
Advisory ID:       RHSA-2013:1207-01
Product:           Red Hat JBoss Enterprise Application Platform
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2013-1207.html
Issue date:        2013-09-04
CVE Names:         CVE-2012-3499 CVE-2012-4558 CVE-2013-1862 
                   CVE-2013-1896 CVE-2013-1921 CVE-2013-2172 
                   CVE-2013-4112 
=====================================================================

1. Summary:

Red Hat JBoss Enterprise Application Platform 6.1.1, which fixes multiple
security issues, various bugs, and adds enhancements, is now available for
Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Relevant releases/architectures:

Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server - i386, noarch, x86_64

3. Description:

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java
applications based on JBoss Application Server 7.

This release serves as a replacement for Red Hat JBoss Enterprise
Application Platform 6.1.0, and includes bug fixes and enhancements. Refer
to the 6.1.1 Release Notes for information on the most significant of these
changes, available shortly from
https://access.redhat.com/site/documentation/

Security fixes:

Cross-site scripting (XSS) flaws were found in the mod_info, mod_status,
mod_imagemap, mod_ldap, and mod_proxy_ftp modules. An attacker could
possibly use these flaws to perform XSS attacks if they were able to make
the victim's browser generate an HTTP request with a specially-crafted Host
header. (CVE-2012-3499)

Cross-site scripting (XSS) flaws were found in the mod_proxy_balancer
module's manager web interface. If a remote attacker could trick a user,
who was logged into the manager web interface, into visiting a
specially-crafted URL, it would lead to arbitrary web script execution in
the context of the user's manager interface session. (CVE-2012-4558)

A flaw was found in the way the mod_dav module handled merge requests. An
attacker could use this flaw to send a crafted merge request that contains
URIs that are not configured for DAV, causing the httpd child process to
crash. (CVE-2013-1896)

A flaw was found in the way Apache Santuario XML Security for Java
validated XML signatures. Santuario allowed a signature to specify an
arbitrary canonicalization algorithm, which would be applied to the
SignedInfo XML fragment. A remote attacker could exploit this to spoof an
XML signature via a specially-crafted XML signature block. (CVE-2013-2172)

It was found that mod_rewrite did not filter terminal escape sequences from
its log file. If mod_rewrite was configured with the RewriteLog directive,
a remote attacker could use specially-crafted HTTP requests to inject
terminal escape sequences into the mod_rewrite log file. If a victim viewed
the log file with a terminal emulator, it could result in arbitrary command
execution with the privileges of that user. (CVE-2013-1862)

The data file used by PicketBox Vault to store encrypted passwords contains
a copy of its own admin key. The file is encrypted using only this admin
key, not the corresponding JKS key. A local attacker with permission to
read the vault data file could read the admin key from the file, and use it
to decrypt the file and read the stored passwords in clear text.
(CVE-2013-1921)

A flaw was found in JGroup's DiagnosticsHandler that allowed an attacker on
an adjacent network to reuse the credentials from a previous successful
authentication. This could be exploited to read diagnostic information
(information disclosure) and attain limited remote code execution.
(CVE-2013-4112)

Warning: Before applying this update, back up your existing Red Hat JBoss
Enterprise Application Platform installation and deployed applications.
Refer to the Solution section for further details.

All users of Red Hat JBoss Enterprise Application Platform 6.1.0 on Red Hat
Enterprise Linux 5 are advised to upgrade to these updated packages. The
JBoss server process must be restarted for the update to take effect.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied. Also, back up any customized
Red Hat JBoss Enterprise Application Platform 6 configuration files. On
update, the configuration files that have been locally modified will not be
updated. The updated version of such files will be stored as the rpmnew
files. Make sure to locate any such files after the update and merge any
changes manually.

For more details, refer to the Release Notes for Red Hat JBoss Enterprise
Application Platform 6.1.1, available shortly from
https://access.redhat.com/site/documentation/

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

5. Bugs fixed (http://bugzilla.redhat.com/):

915883 - CVE-2012-3499 httpd: multiple XSS flaws due to unescaped hostnames
915884 - CVE-2012-4558 httpd: XSS flaw in mod_proxy_balancer manager interface
948106 - CVE-2013-1921 JBoss PicketBox: Insecure storage of masked passwords
953729 - CVE-2013-1862 httpd: mod_rewrite allows terminal escape sequences to be written to the log file
983489 - CVE-2013-4112 JGroups: Authentication via cached credentials
983549 - CVE-2013-1896 httpd: mod_dav DoS (httpd child process crash) via a URI MERGE request with source URI not handled by mod_dav
988076 - Upgrade jcip-annotations-eap6 to 1.0-redhat-4
996642 - Upgrade jbossweb to 7.2.2.Final-redhat-1 (RHEL-5)
996644 - Upgrade jboss-as-console to 1.5.5.Final-redhat-1 (RHEL-5)
996645 - Upgrade jboss-hal to 1.5.6.Final-redhat-1 (RHEL-5)
996646 - Upgrade hornetq-native to 2.3.3.Final-redhat-1 (RHEL-5)
996647 - Upgrade picketbox to 4.0.17.SP2-redhat-1 (RHEL-5)
996648 - Upgrade picketlink-federation to 2.1.6.2.Final-redhat-2 (RHEL-5)
996649 - Upgrade jaxbintros to 1.0.2.GA-redhat-5 (RHEL-5)
996650 - Upgrade hornetq to 2.3.4.Final-redhat-1 (RHEL-5)
996651 - Upgrade jboss-aesh to 0.33.6-redhat-1 (RHEL-5)
996652 - Upgrade jboss-stdio to 1.0.2.GA-redhat-1 (RHEL-5)
996653 - Upgrade jbossws-common to 2.1.3.Final-redhat-1 (RHEL-5)
996654 - Upgrade jbossts to 4.17.7.Final-redhat-1 (RHEL-5)
996655 - Upgrade jboss-logmanager to 1.4.3.Final-redhat-1 (RHEL-5)
996697 - Upgrade jgroups to 3.2.10.Final-redhat-1 (RHEL-5)
999263 - CVE-2013-2172 Apache Santuario XML Security for Java: XML signature spoofing

6. Package List:

Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server:

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/apache-commons-beanutils-1.8.3-12.redhat_3.2.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/apache-commons-daemon-jsvc-eap6-1.0.15-2.redhat_2.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/apache-cxf-2.6.8-8.redhat_7.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/apache-cxf-xjc-utils-2.6.0-2.redhat_4.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/hibernate4-4.2.0-11.SP1_redhat_1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/hornetq-2.3.5-2.Final_redhat_2.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/hornetq-native-2.3.5-1.Final_redhat_1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/httpd-2.2.22-25.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/infinispan-5.2.7-1.Final_redhat_1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/ironjacamar-1.0.19-1.Final_redhat_2.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jaxbintros-1.0.2-16.GA_redhat_6.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-aesh-0.33.7-2.redhat_2.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-appclient-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-cli-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-client-all-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-clustering-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-cmp-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-configadmin-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-connector-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-console-1.5.6-2.Final_redhat_2.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-controller-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-controller-client-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-deployment-repository-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-deployment-scanner-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-domain-http-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-domain-management-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-ee-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-ee-deployment-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-ejb3-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-embedded-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-host-controller-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-jacorb-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-jaxr-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-jaxrs-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-jdr-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-jmx-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-jpa-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-jsf-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-jsr77-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-logging-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-mail-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-management-client-content-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-messaging-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-modcluster-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-naming-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-network-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-osgi-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-osgi-configadmin-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-osgi-service-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-platform-mbean-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-pojo-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-process-controller-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-protocol-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-remoting-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-sar-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-security-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-server-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-system-jmx-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-threads-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-transactions-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-version-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-web-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-webservices-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-weld-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-xts-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-ejb-client-1.0.23-1.Final_redhat_1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-hal-1.5.7-1.Final_redhat_1.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-invocation-1.1.2-1.Final_redhat_1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-jsp-api_2.2_spec-1.0.1-6.Final_redhat_2.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-logmanager-1.4.3-1.Final_redhat_1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-marshalling-1.3.18-2.GA_redhat_1.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-modules-1.2.2-1.Final_redhat_1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-remote-naming-1.0.7-1.Final_redhat_1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-security-negotiation-2.2.5-2.Final_redhat_2.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-stdio-1.0.2-1.GA_redhat_1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossas-appclient-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossas-bundles-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossas-core-7.2.1-6.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossas-domain-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossas-javadocs-7.2.1-2.Final_redhat_10.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossas-modules-eap-7.2.1-9.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossas-product-eap-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossas-standalone-7.2.1-6.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossas-welcome-content-eap-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossts-4.17.7-4.Final_redhat_4.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossweb-7.2.2-1.Final_redhat_1.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossws-common-2.1.3-1.Final_redhat_1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossws-cxf-4.1.4-7.Final_redhat_7.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossws-spi-2.1.3-1.Final_redhat_1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jcip-annotations-eap6-1.0-4.redhat_4.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jgroups-3.2.10-1.Final_redhat_2.2.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/log4j-jboss-logmanager-1.0.2-1.Final_redhat_1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/netty-3.6.6-3.Final_redhat_1.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/opensaml-2.5.1-2.redhat_2.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/openws-1.4.2-10.redhat_4.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/picketbox-4.0.17-3.SP2_redhat_2.1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/picketlink-federation-2.1.6.3-2.Final_redhat_2.2.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/wss4j-1.6.10-1.redhat_1.ep6.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/xml-security-1.5.5-1.redhat_1.ep6.el5.src.rpm

i386:
apache-commons-daemon-jsvc-eap6-1.0.15-2.redhat_2.ep6.el5.i386.rpm
apache-commons-daemon-jsvc-eap6-debuginfo-1.0.15-2.redhat_2.ep6.el5.i386.rpm
hornetq-native-2.3.5-1.Final_redhat_1.ep6.el5.i386.rpm
hornetq-native-debuginfo-2.3.5-1.Final_redhat_1.ep6.el5.i386.rpm
httpd-2.2.22-25.ep6.el5.i386.rpm
httpd-debuginfo-2.2.22-25.ep6.el5.i386.rpm
httpd-devel-2.2.22-25.ep6.el5.i386.rpm
httpd-tools-2.2.22-25.ep6.el5.i386.rpm
jbossas-hornetq-native-2.3.5-1.Final_redhat_1.ep6.el5.i386.rpm
mod_ssl-2.2.22-25.ep6.el5.i386.rpm

noarch:
apache-commons-beanutils-1.8.3-12.redhat_3.2.ep6.el5.noarch.rpm
apache-cxf-2.6.8-8.redhat_7.1.ep6.el5.noarch.rpm
apache-cxf-xjc-utils-2.6.0-2.redhat_4.1.ep6.el5.noarch.rpm
cxf-xjc-boolean-2.6.0-2.redhat_4.1.ep6.el5.noarch.rpm
cxf-xjc-dv-2.6.0-2.redhat_4.1.ep6.el5.noarch.rpm
cxf-xjc-ts-2.6.0-2.redhat_4.1.ep6.el5.noarch.rpm
hibernate4-4.2.0-11.SP1_redhat_1.ep6.el5.noarch.rpm
hibernate4-core-4.2.0-11.SP1_redhat_1.ep6.el5.noarch.rpm
hibernate4-entitymanager-4.2.0-11.SP1_redhat_1.ep6.el5.noarch.rpm
hibernate4-envers-4.2.0-11.SP1_redhat_1.ep6.el5.noarch.rpm
hibernate4-infinispan-4.2.0-11.SP1_redhat_1.ep6.el5.noarch.rpm
hornetq-2.3.5-2.Final_redhat_2.1.ep6.el5.noarch.rpm
infinispan-5.2.7-1.Final_redhat_1.ep6.el5.noarch.rpm
infinispan-cachestore-jdbc-5.2.7-1.Final_redhat_1.ep6.el5.noarch.rpm
infinispan-cachestore-remote-5.2.7-1.Final_redhat_1.ep6.el5.noarch.rpm
infinispan-client-hotrod-5.2.7-1.Final_redhat_1.ep6.el5.noarch.rpm
infinispan-core-5.2.7-1.Final_redhat_1.ep6.el5.noarch.rpm
ironjacamar-1.0.19-1.Final_redhat_2.ep6.el5.noarch.rpm
ironjacamar-common-api-1.0.19-1.Final_redhat_2.ep6.el5.noarch.rpm
ironjacamar-common-impl-1.0.19-1.Final_redhat_2.ep6.el5.noarch.rpm
ironjacamar-common-spi-1.0.19-1.Final_redhat_2.ep6.el5.noarch.rpm
ironjacamar-core-api-1.0.19-1.Final_redhat_2.ep6.el5.noarch.rpm
ironjacamar-core-impl-1.0.19-1.Final_redhat_2.ep6.el5.noarch.rpm
ironjacamar-deployers-common-1.0.19-1.Final_redhat_2.ep6.el5.noarch.rpm
ironjacamar-jdbc-1.0.19-1.Final_redhat_2.ep6.el5.noarch.rpm
ironjacamar-spec-api-1.0.19-1.Final_redhat_2.ep6.el5.noarch.rpm
ironjacamar-validator-1.0.19-1.Final_redhat_2.ep6.el5.noarch.rpm
jaxbintros-1.0.2-16.GA_redhat_6.ep6.el5.noarch.rpm
jboss-aesh-0.33.7-2.redhat_2.1.ep6.el5.noarch.rpm
jboss-as-appclient-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-cli-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-client-all-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-clustering-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-cmp-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-configadmin-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-connector-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-console-1.5.6-2.Final_redhat_2.1.ep6.el5.noarch.rpm
jboss-as-controller-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-controller-client-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-deployment-repository-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-deployment-scanner-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-domain-http-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-domain-management-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-ee-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-ee-deployment-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-ejb3-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-embedded-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-host-controller-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-jacorb-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-jaxr-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-jaxrs-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-jdr-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-jmx-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-jpa-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-jsf-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-jsr77-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-logging-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-mail-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-management-client-content-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-messaging-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-modcluster-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-naming-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-network-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-osgi-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-osgi-configadmin-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-osgi-service-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-platform-mbean-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-pojo-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-process-controller-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-protocol-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-remoting-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-sar-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-security-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-server-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-system-jmx-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-threads-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-transactions-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-version-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-web-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-webservices-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-weld-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-as-xts-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jboss-ejb-client-1.0.23-1.Final_redhat_1.ep6.el5.noarch.rpm
jboss-hal-1.5.7-1.Final_redhat_1.1.ep6.el5.noarch.rpm
jboss-invocation-1.1.2-1.Final_redhat_1.ep6.el5.noarch.rpm
jboss-jsp-api_2.2_spec-1.0.1-6.Final_redhat_2.ep6.el5.noarch.rpm
jboss-logmanager-1.4.3-1.Final_redhat_1.ep6.el5.noarch.rpm
jboss-marshalling-1.3.18-2.GA_redhat_1.1.ep6.el5.noarch.rpm
jboss-modules-1.2.2-1.Final_redhat_1.ep6.el5.noarch.rpm
jboss-remote-naming-1.0.7-1.Final_redhat_1.ep6.el5.noarch.rpm
jboss-security-negotiation-2.2.5-2.Final_redhat_2.ep6.el5.noarch.rpm
jboss-stdio-1.0.2-1.GA_redhat_1.ep6.el5.noarch.rpm
jbossas-appclient-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jbossas-bundles-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jbossas-core-7.2.1-6.Final_redhat_10.1.ep6.el5.noarch.rpm
jbossas-domain-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jbossas-javadocs-7.2.1-2.Final_redhat_10.ep6.el5.noarch.rpm
jbossas-modules-eap-7.2.1-9.Final_redhat_10.1.ep6.el5.noarch.rpm
jbossas-product-eap-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jbossas-standalone-7.2.1-6.Final_redhat_10.1.ep6.el5.noarch.rpm
jbossas-welcome-content-eap-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm
jbossts-4.17.7-4.Final_redhat_4.ep6.el5.noarch.rpm
jbossweb-7.2.2-1.Final_redhat_1.1.ep6.el5.noarch.rpm
jbossws-common-2.1.3-1.Final_redhat_1.ep6.el5.noarch.rpm
jbossws-cxf-4.1.4-7.Final_redhat_7.ep6.el5.noarch.rpm
jbossws-spi-2.1.3-1.Final_redhat_1.ep6.el5.noarch.rpm
jcip-annotations-eap6-1.0-4.redhat_4.ep6.el5.noarch.rpm
jgroups-3.2.10-1.Final_redhat_2.2.ep6.el5.noarch.rpm
log4j-jboss-logmanager-1.0.2-1.Final_redhat_1.ep6.el5.noarch.rpm
netty-3.6.6-3.Final_redhat_1.1.ep6.el5.noarch.rpm
opensaml-2.5.1-2.redhat_2.1.ep6.el5.noarch.rpm
openws-1.4.2-10.redhat_4.1.ep6.el5.noarch.rpm
picketbox-4.0.17-3.SP2_redhat_2.1.ep6.el5.noarch.rpm
picketlink-federation-2.1.6.3-2.Final_redhat_2.2.ep6.el5.noarch.rpm
wss4j-1.6.10-1.redhat_1.ep6.el5.noarch.rpm
xml-security-1.5.5-1.redhat_1.ep6.el5.noarch.rpm

x86_64:
apache-commons-daemon-jsvc-eap6-1.0.15-2.redhat_2.ep6.el5.x86_64.rpm
apache-commons-daemon-jsvc-eap6-debuginfo-1.0.15-2.redhat_2.ep6.el5.x86_64.rpm
hornetq-native-2.3.5-1.Final_redhat_1.ep6.el5.x86_64.rpm
hornetq-native-debuginfo-2.3.5-1.Final_redhat_1.ep6.el5.x86_64.rpm
httpd-2.2.22-25.ep6.el5.x86_64.rpm
httpd-debuginfo-2.2.22-25.ep6.el5.x86_64.rpm
httpd-devel-2.2.22-25.ep6.el5.x86_64.rpm
httpd-tools-2.2.22-25.ep6.el5.x86_64.rpm
jbossas-hornetq-native-2.3.5-1.Final_redhat_1.ep6.el5.x86_64.rpm
mod_ssl-2.2.22-25.ep6.el5.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2012-3499.html
https://www.redhat.com/security/data/cve/CVE-2012-4558.html
https://www.redhat.com/security/data/cve/CVE-2013-1862.html
https://www.redhat.com/security/data/cve/CVE-2013-1896.html
https://www.redhat.com/security/data/cve/CVE-2013-1921.html
https://www.redhat.com/security/data/cve/CVE-2013-2172.html
https://www.redhat.com/security/data/cve/CVE-2013-4112.html
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/site/documentation/

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2013 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFSJ4QEXlSAg2UNWIIRAgOPAJ4/KG6aDFsPx4v4TyM+IAw3D6nUCwCgpDCv
Z/gZxr8tfBZOJfNWozZ6zSM=
=FclZ
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce