Bug 692584 (CVE-2011-1483)

Summary:	CVE-2011-1483 JBossWS remote Denial of Service
Product:	[Other] Security Response	Reporter:	Marc Schoenefeld <mschoene>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	asoldano, atangrin, ccrouch, djorm, fnasser, jawilson, jmorgan, klape, ldimaggi, mjc, myarboro, rzhang, security-response-team, vdanen
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-09-19 05:51:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	725919
Bug Blocks:	735463

Comment 2 Marc Schoenefeld 2011-04-01 15:21:08 UTC

JBossWS native does not properly protect against recursive entity resolution with embedded DTDs. A remote attacker could cause a Denial-Of-Service by CPU resource exhaustion with a carefully crafted POST request to a deployed web service.

Comment 6 errata-xmlrpc 2011-09-15 17:52:09 UTC

This issue has been addressed in following products:

    JBoss Enterprise Web Platform 5.1.1

Via RHSA-2011:1304 https://rhn.redhat.com/errata/RHSA-2011-1304.html

Comment 7 errata-xmlrpc 2011-09-15 17:52:19 UTC

This issue has been addressed in following products:

  JBEWP 5 for RHEL 4
  JBEWP 5 for RHEL 5
  JBEWP 5 for RHEL 6

Via RHSA-2011:1303 https://rhn.redhat.com/errata/RHSA-2011-1303.html

Comment 8 errata-xmlrpc 2011-09-15 17:52:30 UTC

This issue has been addressed in following products:

    JBoss Enterprise Application Platform 5.1.1

Via RHSA-2011:1302 https://rhn.redhat.com/errata/RHSA-2011-1302.html

Comment 9 errata-xmlrpc 2011-09-15 17:52:40 UTC

This issue has been addressed in following products:

  JBEAP 5 for RHEL 4
  JBEAP 5 for RHEL 5
  JBEAP 5 for RHEL 6

Via RHSA-2011:1301 https://rhn.redhat.com/errata/RHSA-2011-1301.html

Comment 10 errata-xmlrpc 2011-09-15 18:06:22 UTC

This issue has been addressed in following products:

  JBEAP 4.3.0 for RHEL 4
  JBEAP 4.3.0 for RHEL 5

Via RHSA-2011:1306 https://rhn.redhat.com/errata/RHSA-2011-1306.html

Comment 11 errata-xmlrpc 2011-09-15 18:26:38 UTC

This issue has been addressed in following products:

    JBoss Enterprise Portal Platform 4.3.CP06

Via RHSA-2011:1307 https://rhn.redhat.com/errata/RHSA-2011-1307.html

Comment 12 errata-xmlrpc 2011-09-15 18:26:48 UTC

This issue has been addressed in following products:

    JBoss Enterprise SOA Platform 4.2.CP05
    JBoss Enterprise SOA Platform 4.3.CP05
    JBoss Enterprise SOA Platform 5.1.0

Via RHSA-2011:1305 https://rhn.redhat.com/errata/RHSA-2011-1305.html

Comment 13 errata-xmlrpc 2011-09-15 18:37:01 UTC

This issue has been addressed in following products:

    JBoss Communications Platform 1.2.11
    JBoss Communications Platform 5.1.1

Via RHSA-2011:1308 https://rhn.redhat.com/errata/RHSA-2011-1308.html

Comment 14 errata-xmlrpc 2011-09-15 18:47:21 UTC

This issue has been addressed in following products:

    JBoss Enterprise Portal Platform 5.1.1

Via RHSA-2011:1311 https://rhn.redhat.com/errata/RHSA-2011-1311.html

Comment 15 errata-xmlrpc 2011-09-15 18:47:31 UTC

This issue has been addressed in following products:

    JBoss Enterprise Application Platform 4.2.0.CP09

Via RHSA-2011:1310 https://rhn.redhat.com/errata/RHSA-2011-1310.html

Comment 16 errata-xmlrpc 2011-09-15 18:58:02 UTC

This issue has been addressed in following products:

  JBEAP 4.2.0 for RHEL 4
  JBEAP 4.2.0 for RHEL 5

Via RHSA-2011:1309 https://rhn.redhat.com/errata/RHSA-2011-1309.html

Comment 17 errata-xmlrpc 2011-09-15 19:18:28 UTC

This issue has been addressed in following products:

    JBoss Enterprise Application Platform 4.3

Via RHSA-2011:1312 https://rhn.redhat.com/errata/RHSA-2011-1312.html

Comment 18 errata-xmlrpc 2011-09-15 19:49:41 UTC

This issue has been addressed in following products:

    JBoss Enterprise BRMS Platform 5.1.0

Via RHSA-2011:1313 https://rhn.redhat.com/errata/RHSA-2011-1313.html

Comment 19 David Jorm 2011-09-19 07:03:24 UTC

Upstream patch commits:

http://source.jboss.org/changelog/JBossWS/?cs=13995
http://source.jboss.org/changelog/JBossWS/?cs=13996