- Issued:
- 2012-10-03
- Updated:
- 2012-10-03
RHSA-2012:1331 - Moderate: JBoss Operations Network 3.1.1 update
Synopsis
Moderate: JBoss Operations Network 3.1.1 update
Type/Severity
Security Advisory Moderate
Topic
JBoss Operations Network 3.1.1, which fixes one security issue, several bugs, and adds enhancements, is now available from the Red Hat Customer Portal.
The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
Description
JBoss Operations Network (JBoss ON) is a middleware management solution that provides a single point of control to deploy, manage, and monitor JBoss Enterprise Middleware, applications, and services.
This JBoss ON 3.1.1 release serves as a replacement for JBoss ON 3.1.0, and includes several bug fixes and enhancements. Refer to the JBoss ON 3.1.1 Release Notes for information on the most significant of these changes. The Release Notes will be available shortly from https://access.redhat.com/knowledge/docs/
The following security issue is also fixed with this release:
It was found that JBoss Web did not handle large numbers of parameters and large parameter values efficiently. A remote attacker could make JBoss Web use an excessive amount of CPU time by sending an HTTP request containing a large number of parameters or large parameter values. This update introduces limits on the number of parameters and headers processed per request to address this issue. The default limit is 512 for parameters and 128 for headers. These defaults can be changed by setting the org.apache.tomcat.util.http.Parameters.MAX_COUNT and org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties in "jbossas/server/[PROFILE]/deploy/properties-service.xml". (CVE-2012-0022)
Warning: Before applying the update, back up your existing JBoss ON installation (including its databases, applications, configuration files, the JBoss ON server's file system directory, and so on).
All users of JBoss Operations Network 3.1.0 as provided from the Red Hat Customer Portal are advised to upgrade to JBoss Operations Network 3.1.1.
Solution
The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing JBoss ON installation (including its databases, applications, configuration files, the JBoss ON server's file system directory, and so on).
Refer to the JBoss Operations Network 3.1.1 Release Notes for installation information.
Affected Products
| Product | Version | Arch |
|---|---|---|
| Red Hat JBoss Middleware | Text-Only Advisories | x86_64 |
Fixes
CVEs
References
- https://access.redhat.com/security/updates/classification/#moderate
- https://access.redhat.com/knowledge/docs/
- This content is not included.This content is not included.https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=em&version=3.1.1
Additional information
- The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
- Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.