Issued:

2015-08-24

Updated:

2015-08-24

RHSA-2015:1673 - Moderate: jboss-ec2-eap bug fix security update

Synopsis

Moderate: jboss-ec2-eap bug fix security update

Type/Severity

Security Advisory Moderate

Topic

An updated jboss-ec2-eap package that that fixes a security issue, fixes several bugs and adds various enhancements is now available for Red Hat JBoss Enterprise Application Platform 6.4.3 on Red Hat Enterprise Linux 6.

Description

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java EE applications. It is based on JBoss Application Server 7 and incorporates multiple open-source projects to provide a complete Java EE platform solution.

• The jboss-ec2-eap package provides scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services (AWS) Elastic Compute Cloud (EC2). With this update, the package has been updated to ensure compatibility with Red Hat JBoss Enterprise Application Platform 6.4.3. (BZ#1228766)

The following security issue is also fixed with this release:

It was discovered that under specific conditions that PicketLink IDP ignores role based authorization. This could lead to an authenticated user being able to access application resources that are not permitted for a given role. (CVE-2015-3158)

Users of Red Hat JBoss Enterprise Application Platform 6.4.2 jboss-ec2-eap are advised to upgrade to this updated package, which fixes these bugs and adds these enhancements.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, make sure to back up any modified configuration files, deployments, and all user data. After applying the update, restart the instance of Red Hat JBoss Enterprise Application Platform for the changes to take effect.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

Updated Packages

• jboss-ec2-eap-7.5.3-1.Final_redhat_2.ep6.el6.src.rpm
• jboss-ec2-eap-7.5.3-1.Final_redhat_2.ep6.el6.noarch.rpm
• jboss-ec2-eap-samples-7.5.3-1.Final_redhat_2.ep6.el6.noarch.rpm

Fixes

• This content is not included.BZ - 1216123

CVEs

• CVE-2015-3158

References

• https://access.redhat.com/security/updates/classification/#moderate
• This content is not included.This content is not included.https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/6.4/index.html

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.