RHSA-2013:1011: Moderate: Red Hat JBoss Web Server 2.0.1 update

Red Hat JBoss Web Server is a fully integrated and certified set ofcomponents for hosting Java web applications. It is comprised of the ApacheHTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector(modjk), JBoss HTTP Connector (modcluster), Hibernate, and the TomcatNative library.This release serves as a replacement for Red Hat JBoss Web Server 2.0.0,and includes several bug fixes. Refer to the Red Hat JBoss Web Server 2.0.1Release Notes for information on the most significant of these changes,available shortly from https://access.redhat.com/site/documentation/ The following security issues are also fixed with this release:Cross-site scripting (XSS) flaws were found in the Apache HTTP Servermodproxybalancer module's manager web interface. If a remote attackercould trick a user, who was logged into the manager web interface, intovisiting a specially-crafted URL, it would lead to arbitrary web scriptexecution in the context of the user's manager interface session.(CVE-2012-4558)Cross-site scripting (XSS) flaws were found in the Apache HTTP Servermodinfo, modstatus, modimagemap, modldap, and modproxyftp modules. Anattacker could possibly use these flaws to perform XSS attacks if they wereable to make the victim's browser generate an HTTP request with aspecially-crafted Host header. (CVE-2012-3499)A session fixation flaw was found in the Tomcat FormAuthenticator module.During a narrow window of time, if a remote attacker sent requests while auser was logging in, it could possibly result in the attacker's requestsbeing processed as if they were sent by the user. (CVE-2013-2067)A denial of service flaw was found in the way the Tomcat chunked transferencoding input filter processed CRLF sequences. A remote attacker coulduse this flaw to send an excessively long request, consuming networkbandwidth, CPU, and memory on the Tomcat server. Chunked transfer encodingis enabled by default. (CVE-2012-3544)A flaw was found in the way the Tomcat 7 asynchronous contextimplementation performed request management in certain circumstances. If anapplication used AsyncListeners and threw RuntimeExceptions, Tomcat couldsend a reply that contains information from a different user's request,possibly leading to the disclosure of sensitive information. This issueonly affected Tomcat 7. (CVE-2013-2071)Note: Do not install Red Hat JBoss Web Server 2 on a host which has Red HatJBoss Web Server 1 installed.Warning: Before applying the update, back up your existing Red Hat JBossWeb Server installation (including all applications and configurationfiles).All users of Red Hat JBoss Web Server 2.0.0 on Red Hat Enterprise Linux 5are advised to upgrade to Red Hat JBoss Web Server 2.0.1. The JBoss serverprocess must be restarted for this update to take effect.