RHSA-2010:0564: Important: jboss-seam2 security update

First published: Tue Jul 27 2010(Updated: )

The JBoss Seam Framework is an application framework for building web<br>applications in Java.<br>An input sanitization flaw was found in the way JBoss Seam processed<br>certain parametrized JBoss Expression Language (EL) expressions. A remote<br>attacker could use this flaw to execute arbitrary code via a URL,<br>containing appended, specially-crafted expression language parameters,<br>provided to certain applications based on the JBoss Seam framework. Note: A<br>properly configured and enabled Java Security Manager would prevent<br>exploitation of this flaw. (CVE-2010-1871)<br>Red Hat would like to thank Meder Kydyraliev of the Google Security Team<br>for responsibly reporting this issue.<br>Users of jboss-seam2 should upgrade to these updated packages, which<br>contain a backported patch to correct this issue. The JBoss server process<br>must be restarted for this update to take effect.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• collector/redhat-errata
• source/Red Hat
• anchor-id/RHSA-2010:0564
• agent/software-canonical-lookup
• package-manager/redhat