RHSA-2008:0828: Moderate: JBoss Enterprise Application Platform 4.3.0CP01 security update

Published Aug 5, 2008
·
Updated

JBoss EAP is a middleware platform for Java 2 Platform, Enterprise Edition(J2EE) applications.This release of JBoss EAP for Red Hat Enterprise Linux 5 contains the JBossApplication Server and JBoss Seam. This release serves as a replacement toJBoss EAP 4.3.0.GA, and fixes the following security issues:The JavaServer Faces (JSF) component was vulnerable to multiple cross-sitescripting (XSS) vulnerabilities. An attacker could use these flaws toinject arbitrary web script or HTML. (CVE-2008-1285)Unauthenticated users were able to access the status servlet, which couldallow remote attackers to acquire details about deployed web contexts.(CVE-2008-3273)These updated packages include bug fixes and enhancements which are notlisted here. For a full list, refer to the JBoss EAP 4.3.0.CP01 releasenotes, linked to in the "References" section of this advisory.Warning: before applying this update, please back up the JBoss EAP"server/[configuration]/deploy/" directory, and any customizedconfiguration files.All users of JBoss EAP on Red Hat Enterprise Linux 5 are advised to upgradeto these updated packages, which resolve these issues.

Affected Software

48 affected componentsFixes available
redhat/asm<1.5.3-1jpp.ep1.2.el5
1.5.3-1jpp.ep1.2.el5
redhat/cglib<2.1.3-2jpp.ep1.6.el5
2.1.3-2jpp.ep1.6.el5
redhat/concurrent<1.3.4-8jpp.ep1.6.el5.1
1.3.4-8jpp.ep1.6.el5.1
redhat/glassfish-jaf<1.1.0-0jpp.ep1.11.el5.1
1.1.0-0jpp.ep1.11.el5.1
redhat/glassfish-javamail<1.4.0-0jpp.ep1.9.el5
1.4.0-0jpp.ep1.9.el5
redhat/glassfish-jsf<1.2_08-0jpp.ep1.2.el5
1.2_08-0jpp.ep1.2.el5
redhat/hibernate3<3.2.4-1.SP1_CP03.0jpp.ep1.1.el5
3.2.4-1.SP1_CP03.0jpp.ep1.1.el5
redhat/hibernate3-annotations<3.2.1-1.patch02.1jpp.ep1.3.el5.1
3.2.1-1.patch02.1jpp.ep1.3.el5.1
redhat/hibernate3-entitymanager<3.2.1-1jpp.ep1.7.el5
3.2.1-1jpp.ep1.7.el5
redhat/jboss-aop<1.5.5-1.CP01.0jpp.ep1.1.el5
1.5.5-1.CP01.0jpp.ep1.1.el5
redhat/jboss-cache<1.4.1-4.SP9.1jpp.ep1.1.el5
1.4.1-4.SP9.1jpp.ep1.1.el5
redhat/jboss-messaging<1.4.0-1.SP3_CP02.0jpp.ep1.6.el5
1.4.0-1.SP3_CP02.0jpp.ep1.6.el5
redhat/jboss-remoting<2.2.2-3.SP7.0jpp.ep1.3.el5
2.2.2-3.SP7.0jpp.ep1.3.el5
redhat/jboss-seam<1.2.1-3.JBPAPP_4_3_0_GA.ep1.5.el5.1
1.2.1-3.JBPAPP_4_3_0_GA.ep1.5.el5.1
redhat/jbossas<4.3.0-2.GA_CP01.ep1.6.el5.1
4.3.0-2.GA_CP01.ep1.6.el5.1
redhat/jbossts<4.2.3-1.SP5_CP01.1jpp.ep1.1.el5
4.2.3-1.SP5_CP01.1jpp.ep1.1.el5
redhat/jbossws<2.0.1-2.SP2_CP01.0jpp.ep1.2.el5
2.0.1-2.SP2_CP01.0jpp.ep1.2.el5
redhat/jbossxb<1.0.0-2.SP1.0jpp.ep1.2.el5.1
1.0.0-2.SP1.0jpp.ep1.2.el5.1
redhat/jcommon<1.0.12-1jpp.ep1.3.el5
1.0.12-1jpp.ep1.3.el5
redhat/jfreechart<1.0.9-1jpp.ep1.3.el5.1
1.0.9-1jpp.ep1.3.el5.1
redhat/jgroups<2.4.2-1.GA_CP01.0jpp.ep1.1.el5
2.4.2-1.GA_CP01.0jpp.ep1.1.el5
redhat/rh-eap-docs<4.3.0-2.GA_CP01.ep1.4.el5
4.3.0-2.GA_CP01.ep1.4.el5
redhat/asm<1.5.3-1jpp.ep1.2.el5
1.5.3-1jpp.ep1.2.el5
redhat/cglib<2.1.3-2jpp.ep1.6.el5
2.1.3-2jpp.ep1.6.el5
redhat/concurrent<1.3.4-8jpp.ep1.6.el5.1
1.3.4-8jpp.ep1.6.el5.1
redhat/glassfish-jaf<1.1.0-0jpp.ep1.11.el5.1
1.1.0-0jpp.ep1.11.el5.1
redhat/glassfish-javamail<1.4.0-0jpp.ep1.9.el5
1.4.0-0jpp.ep1.9.el5
redhat/glassfish-jsf<1.2_08-0jpp.ep1.2.el5
1.2_08-0jpp.ep1.2.el5
redhat/hibernate3-annotations<3.2.1-1.patch02.1jpp.ep1.3.el5.1
3.2.1-1.patch02.1jpp.ep1.3.el5.1
redhat/hibernate3-annotations-javadoc<3.2.1-1.patch02.1jpp.ep1.3.el5.1
3.2.1-1.patch02.1jpp.ep1.3.el5.1
redhat/hibernate3-entitymanager<3.2.1-1jpp.ep1.7.el5
3.2.1-1jpp.ep1.7.el5
redhat/hibernate3-entitymanager-javadoc<3.2.1-1jpp.ep1.7.el5
3.2.1-1jpp.ep1.7.el5
redhat/hibernate3-javadoc<3.2.4-1.SP1_CP03.0jpp.ep1.1.el5
3.2.4-1.SP1_CP03.0jpp.ep1.1.el5
redhat/jboss-aop<1.5.5-1.CP01.0jpp.ep1.1.el5
1.5.5-1.CP01.0jpp.ep1.1.el5
redhat/jboss-cache<1.4.1-4.SP9.1jpp.ep1.1.el5
1.4.1-4.SP9.1jpp.ep1.1.el5
redhat/jboss-messaging<1.4.0-1.SP3_CP02.0jpp.ep1.6.el5
1.4.0-1.SP3_CP02.0jpp.ep1.6.el5
redhat/jboss-remoting<2.2.2-3.SP7.0jpp.ep1.3.el5
2.2.2-3.SP7.0jpp.ep1.3.el5
redhat/jboss-seam<1.2.1-3.JBPAPP_4_3_0_GA.ep1.5.el5.1
1.2.1-3.JBPAPP_4_3_0_GA.ep1.5.el5.1
redhat/jboss-seam-docs<1.2.1-3.JBPAPP_4_3_0_GA.ep1.5.el5.1
1.2.1-3.JBPAPP_4_3_0_GA.ep1.5.el5.1
redhat/jbossas<4.3.0-2.GA_CP01.ep1.6.el5.1
4.3.0-2.GA_CP01.ep1.6.el5.1
redhat/jbossts<4.2.3-1.SP5_CP01.1jpp.ep1.1.el5
4.2.3-1.SP5_CP01.1jpp.ep1.1.el5
redhat/jbossws<2.0.1-2.SP2_CP01.0jpp.ep1.2.el5
2.0.1-2.SP2_CP01.0jpp.ep1.2.el5
redhat/jbossws-native42<2.0.1-2.SP2_CP01.0jpp.ep1.2.el5
2.0.1-2.SP2_CP01.0jpp.ep1.2.el5
redhat/jbossxb<1.0.0-2.SP1.0jpp.ep1.2.el5.1
1.0.0-2.SP1.0jpp.ep1.2.el5.1
redhat/jcommon<1.0.12-1jpp.ep1.3.el5
1.0.12-1jpp.ep1.3.el5
redhat/jfreechart<1.0.9-1jpp.ep1.3.el5.1
1.0.9-1jpp.ep1.3.el5.1
redhat/jgroups<2.4.2-1.GA_CP01.0jpp.ep1.1.el5
2.4.2-1.GA_CP01.0jpp.ep1.1.el5
redhat/rh-eap-docs<4.3.0-2.GA_CP01.ep1.4.el5
4.3.0-2.GA_CP01.ep1.4.el5

Remediation

Event History

Aug 5, 2008
Advisory Published
12:00 AM

Frequently Asked Questions

1

What is the severity of RHSA-2008:0828?

The severity of RHSA-2008:0828 is categorized as moderate.

2

How do I fix RHSA-2008:0828?

To fix RHSA-2008:0828, update to the patched versions of the affected packages as specified in the advisory.

3

Which packages are affected by RHSA-2008:0828?

Affected packages include JBoss EAP components such as jbossas, jboss-cache, and jboss-messaging among others.

4

What versions of JBoss EAP are impacted by RHSA-2008:0828?

Versions prior to JBoss EAP 4.3.0.GA and its patches are impacted by RHSA-2008:0828.

5

Is RHSA-2008:0828 applicable to Red Hat Enterprise Linux 6?

No, RHSA-2008:0828 specifically addresses vulnerabilities in Red Hat Enterprise Linux 5.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203