Bug 798841 (CVE-2012-1094)

Summary: CVE-2012-1094 mod_cluster registers and exposes the root context of a JBoss AS 7 server by default, despite ROOT being in the excluded-contexts list
Product: [Other] Security Response Reporter: David Jorm <djorm>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: 99313119, mjc
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-03-12 02:39:56 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On:    
Bug Blocks: 798845    

Description David Jorm 2012-03-01 03:54:48 UTC 
mod_cluster registers and exposes the root context of a JBoss AS 7 server by default, despite ROOT being in the excluded-contexts list. The excluded-contexts list requires the hostname to be set as well as the path to correctly identify a context. Due to a mismatch between AS 7 and mod_cluster concerning the default hostname, the contents of the excluded-contexts list are not matched by mod_cluster. This issue is resolved by automatically prepending the default hostname to the path when parsing the excluded-contexts list.
Comment 1 David Jorm 2012-03-01 04:57:29 UTC 
This flaw does not affect OpenShift, as mod_cluster is not being used.
Comment 2 Julian Coleman 2012-03-05 12:06:43 UTC 
No SOA-P/BRMS-P/EDS-P products are based on AS 7 at this time.
Comment 3 David Jorm 2012-03-12 02:39:20 UTC 
This issue is now resolved in JBoss AS 7.1.1.Final.
Comment 4 David Jorm 2012-03-12 02:39:56 UTC 
Statement:

Not vulnerable. This issue only affects community JBoss AS 7 prior to 7.1.1. It does not affect components shipped with any Red Hat products.