RHSA-2010:0564: Important: jboss-seam2 security update
The JBoss Seam Framework is an application framework for building webapplications in Java.An input sanitization flaw was found in the way JBoss Seam processedcertain parametrized JBoss Expression Language (EL) expressions. A remoteattacker could use this flaw to execute arbitrary code via a URL,containing appended, specially-crafted expression language parameters,provided to certain applications based on the JBoss Seam framework. Note: Aproperly configured and enabled Java Security Manager would preventexploitation of this flaw. (CVE-2010-1871)Red Hat would like to thank Meder Kydyraliev of the Google Security Teamfor responsibly reporting this issue.Users of jboss-seam2 should upgrade to these updated packages, whichcontain a backported patch to correct this issue. The JBoss server processmust be restarted for this update to take effect.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2010:0564?
The severity of RHSA-2010:0564 is classified as important.
How do I fix RHSA-2010:0564?
To fix RHSA-2010:0564, you should update to the version 2.0.2.FP-1.ep1.24.el5 of JBoss Seam.
What is the nature of the vulnerability in RHSA-2010:0564?
The vulnerability in RHSA-2010:0564 is an input sanitization flaw in JBoss Seam's processing of certain EL expressions.
Who is affected by RHSA-2010:0564?
Users of JBoss Seam versions prior to 2.0.2.FP-1.ep1.24.el5 are affected by RHSA-2010:0564.
Can RHSA-2010:0564 lead to remote code execution?
Yes, the input sanitization flaw in RHSA-2010:0564 could allow a remote attacker to execute arbitrary code.