RHSA-2015:1010: Important: Red Hat JBoss Portal 6.2.0 security update
Red Hat JBoss Portal is the open source implementation of the Java EE suiteof services and Portal services running atop Red Hat JBoss EnterpriseApplication Platform.It was discovered that Axis incorrectly extracted the host name from anX.509 certificate subject's Common Name (CN) field. A man-in-the-middleattacker could use this flaw to spoof an SSL server using a speciallycrafted X.509 certificate. (CVE-2014-3596)This issue was discovered by David Jorm and Arun Neelicattu of Red HatProduct Security.All users of Red Hat JBoss Portal 6.2.0 as provided from the Red HatCustomer Portal are advised to apply this update.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2015:1010?
The severity of RHSA-2015:1010 is classified as important.
How do I fix RHSA-2015:1010?
You can fix RHSA-2015:1010 by applying the appropriate security patch available from Red Hat.
What versions of Red Hat JBoss Portal are affected by RHSA-2015:1010?
RHSA-2015:1010 affects Red Hat JBoss Portal versions that are supported under the advisory.
What issue does RHSA-2015:1010 address?
RHSA-2015:1010 addresses an issue where Axis incorrectly extracted the host name from an X.509 certificate subject.
Is there a workaround for RHSA-2015:1010?
A specific workaround for RHSA-2015:1010 is not documented; applying the security patch is the recommended action.