Red Hat JBoss Enterprise Web Platform is a platform for Java applications,
which integrates the JBoss Web Server with JBoss Hibernate and JBoss Seam.
It was found that the implementation of the
org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method
provided a DocumentBuilderFactory that would expand entity references.
A remote, unauthenticated attacker could use this flaw to read files
accessible to the user running the application server, and potentially
perform other more advanced XXE attacks. (CVE-2014-3530)
Red Hat would like to thank Alexander Papadakis for reporting this issue.
All users of Red Hat JBoss Enterprise Web Platform 5.2.0 on Red Hat
Enterprise Linux 4, 5, and 6 are advised to upgrade to these updated
packages. The JBoss server process must be restarted for the update to take
effect.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
RedHat | 5 | src | picketlink-federation | < 2.1.5-3_patch_01.ep5.el5 | picketlink-federation-2.1.5-3_patch_01.ep5.el5.src.rpm |
RedHat | 6 | noarch | picketlink-federation | < 2.1.5-3_patch_01.el6_5 | picketlink-federation-2.1.5-3_patch_01.el6_5.noarch.rpm |
RedHat | 6 | src | picketlink-federation | < 2.1.5-3_patch_01.el6_5 | picketlink-federation-2.1.5-3_patch_01.el6_5.src.rpm |
RedHat | 5 | noarch | picketlink-federation | < 2.1.5-3_patch_01.ep5.el5 | picketlink-federation-2.1.5-3_patch_01.ep5.el5.noarch.rpm |