Skip to navigation

Security Advisory Moderate: JBoss Operations Network 3.1.2 update

Advisory: RHSA-2013:0187-1
Type: Security Advisory
Severity: Moderate
Issued on: 2013-01-23
Last updated on: 2013-01-23
Affected Products:
CVEs (cve.mitre.org): CVE-2012-5920

Details

JBoss Operations Network 3.1.2, which fixes one security issue and several
bugs, is now available from the Red Hat Customer Portal.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

JBoss Operations Network (JBoss ON) is a middleware management solution
that provides a single point of control to deploy, manage, and monitor
JBoss Enterprise Middleware, applications, and services.

This JBoss ON 3.1.2 release serves as a replacement for JBoss ON 3.1.1, and
includes several bug fixes. Refer to the JBoss ON 3.1.2 Release Notes for
information on the most significant of these changes. The Release Notes
will be available shortly from https://access.redhat.com/knowledge/docs/

The following security issue is also fixed with this release:

A cross-site scripting (XSS) flaw was found in Google Web Toolkit (GWT), a
core part of the JBoss ON web interface. If a remote attacker could trick a
user, who was logged into the JBoss ON web interface, into visiting a
specially-crafted URL, it could possibly lead to arbitrary web script
execution in the context of the user's JBoss ON session. (CVE-2012-5920)

Warning: Before applying the update, back up your existing JBoss ON
installation (including its databases, applications, configuration files,
the JBoss ON server's file system directory, and so on).

All users of JBoss Operations Network 3.1.1 as provided from the Red Hat
Customer Portal are advised to upgrade to JBoss Operations Network 3.1.2.


Solution

The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing JBoss ON installation (including its databases, applications,
configuration files, the JBoss ON server's file system directory, and so
on).

Refer to the JBoss Operations Network 3.1.2 Release Notes for installation
information.

Updated packages


Bugs fixed (see bugzilla for more information)

871690 - CVE-2012-5920 GWT: unknown XSS flaw


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/