Bug 948106 (CVE-2013-1921)

Summary: CVE-2013-1921 JBoss PicketBox: Insecure storage of masked passwords
Product: [Other] Security Response Reporter: Arun Babu Neelicattu <aneelica>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: asaldhan, djorm, grocha, jcacek, lgao, security-response-team, theute, weli
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-01-15 18:21:49 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 948109, 948147, 948148, 948149    
Bug Blocks: 948111, 970481, 980700, 991853    

Description Arun Babu Neelicattu 2013-04-04 03:28:16 UTC 
The data file used by PicketBox Vault to store encrypted passwords contains a copy of its own admin key. The file is encrypted using only this admin key, not the corresponding JKS key. A local attacker with permission to read the vault data file could read the admin key from the file, and use it to decrypt the file and read the stored passwords stored in cleartext.
Comment 7 errata-xmlrpc 2013-09-04 18:55:06 UTC 
This issue has been addressed in following products:

  Red Hat JBoss Enterprise Application Platform 6.1.1

Via RHSA-2013:1209 https://rhn.redhat.com/errata/RHSA-2013-1209.html
Comment 8 errata-xmlrpc 2013-09-04 18:57:59 UTC 
This issue has been addressed in following products:

  JBEAP 6 for RHEL 6

Via RHSA-2013:1208 https://rhn.redhat.com/errata/RHSA-2013-1208.html
Comment 9 errata-xmlrpc 2013-09-04 19:02:39 UTC 
This issue has been addressed in following products:

  JBEAP 6 for RHEL 5

Via RHSA-2013:1207 https://rhn.redhat.com/errata/RHSA-2013-1207.html
Comment 10 errata-xmlrpc 2013-10-16 16:56:27 UTC 
This issue has been addressed in following products:

  Red Hat JBoss Portal 6.1.0

Via RHSA-2013:1437 https://rhn.redhat.com/errata/RHSA-2013-1437.html
Comment 11 errata-xmlrpc 2014-01-15 17:46:06 UTC 
This issue has been addressed in following products:

  Red Hat JBoss Data Grid 6.2.0

Via RHSA-2014:0029 https://rhn.redhat.com/errata/RHSA-2014-0029.html