RHSA-2014:0212: Moderate: Red Hat JBoss SOA Platform 5.3.1 update

Red Hat JBoss SOA Platform is the next-generation ESB and business processautomation infrastructure. Red Hat JBoss SOA Platform allows IT to leverageexisting (MoM and EAI), modern (SOA and BPM-Rules), and future (EDA andCEP) integration methodologies to dramatically improve business processexecution speed and quality.This roll up patch serves as a cumulative upgrade for Red Hat JBoss SOAPlatform 5.3.1. It includes various bug fixes. The following securityissues are also fixed with this release:A flaw was found in the way Apache Santuario XML Security for Javavalidated XML signatures. Santuario allowed a signature to specify anarbitrary canonicalization algorithm, which would be applied to theSignedInfo XML fragment. A remote attacker could exploit this to spoof anXML signature via a specially-crafted XML signature block. (CVE-2013-2172)It was discovered that the Spring OXM wrapper did not expose any propertyfor disabling entity resolution when using the JAXB unmarshaller. A remoteattacker could use this flaw to conduct XML External Entity (XXE) attackson web sites, and read files in the context of the user running theapplication server. The patch for this flaw disables external entityprocessing by default, and provides a configuration directive to re-enableit. (CVE-2013-4152)Warning: Before applying the update, back up your existing Red Hat JBossSOA Platform installation (including its databases, applications,configuration files, and so on).All users of Red Hat JBoss SOA Platform 5.3.1 as provided from the Red HatCustomer Portal are advised to apply this roll up patch.