CVE-2009-0027
Fixed in a distro release EPSS 2%
The request handler in JBossWS in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP06 and 4.3 before 4.3.0.CP04 does not properly validate the resource path during a request for a WSDL file with a custom web-service endpoint, which allows remote attackers to read arbitrary XML files via a crafted request.
Products: redhat jboss_enterprise_application_platform
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat jboss enterprise application platform 4.2.0 | glassfish-jsf | 0:1.2_10-0jpp.ep1.5.ep5.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | glassfish-jsf | 0:1.2_10-0jpp.ep1.5.ep5.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | hibernate3 | 1:3.2.4-1.SP1_CP07.0jpp.ep1.14.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | hibernate3 | 1:3.2.4-1.SP1_CP07.0jpp.ep1.14.1.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | hibernate3-javadoc | 1:3.2.4-1.SP1_CP07.0jpp.ep1.14.1.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | hibernate3-javadoc | 1:3.2.4-1.SP1_CP07.0jpp.ep1.14.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | jacorb | 0:2.3.0-1jpp.ep1.7.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | jacorb | 0:2.3.0-1jpp.ep1.7.1.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | jakarta-commons-fileupload | 1:1.1.1-3jpp.ep1.2.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | jakarta-commons-io | 0:1.1-0.20051005.2jpp_1rh |
| Red Hat jboss enterprise application platform 4.2.0 | jakarta-commons-logging-jboss | 0:1.1-4.ep1.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | jakarta-commons-logging-jboss | 0:1.1-4.1.ep1.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | jboss-cache | 0:1.4.1-6.SP11.1.ep1.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | jboss-cache | 0:1.4.1-6.SP11.1.ep1.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | jboss-jaxr | 0:1.2.0-SP2.0jpp.ep1.3.2.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | jboss-jaxr | 0:1.2.0-SP2.0jpp.ep1.3.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | jboss-remoting | 0:2.2.2-3.SP11.0jpp.ep1.1.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | jboss-remoting | 0:2.2.2-3.SP11.0jpp.ep1.1.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | jboss-seam | 0:1.2.1-1.ep1.18.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | jboss-seam | 0:1.2.1-1.ep1.12.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | jboss-seam-docs | 0:1.2.1-1.ep1.18.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | jboss-seam-docs | 0:1.2.1-1.ep1.12.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | jboss-vfs | 0:1.0.0-1.ep1.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | jboss-vfs | 0:1.0.0-1.ep1.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | jbossas | 0:4.2.0-4.GA_CP06.3.ep1.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | jbossas | 0:4.2.0-4.GA_CP06.3.1.ep1.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | jbossas-4.2.0.GA_CP06-bin | 0:4.2.0-4.GA_CP06.3.ep1.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | jbossas-4.2.0.GA_CP06-bin | 0:4.2.0-4.GA_CP06.3.1.ep1.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | jbossas-client | 0:4.2.0-4.GA_CP06.3.1.ep1.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | jbossas-client | 0:4.2.0-4.GA_CP06.3.ep1.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | jbossts | 1:4.2.3-1.SP5_CP04.1jpp.ep1.1.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | jbossts | 1:4.2.3-1.SP5_CP04.1jpp.ep1.2.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | jbossweb | 0:2.0.0-6.CP09.0jpp.ep1.1.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | jbossweb | 0:2.0.0-6.CP09.0jpp.ep1.1.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | jbossws-jboss42 | 0:1.2.1-1.1.ep1.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | jgroups | 1:2.4.5-2.1.ep1.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | jgroups | 1:2.4.5-2.ep1.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | rh-eap-docs | 0:4.2.0-5.GA_CP06.ep1.3.1.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | rh-eap-docs | 0:4.2.0-5.GA_CP06.ep1.3.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | rh-eap-docs-examples | 0:4.2.0-5.GA_CP06.ep1.3.1.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | rh-eap-docs-examples | 0:4.2.0-5.GA_CP06.ep1.3.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | tanukiwrapper | 0:3.2.1-2jpp.ep1.2.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | tanukiwrapper | 0:3.2.1-2jpp.ep1.2.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | tanukiwrapper-debuginfo | 0:3.2.1-2jpp.ep1.2.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | tanukiwrapper-debuginfo | 0:3.2.1-2jpp.ep1.2.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | ws-commons-policy | 0:1.0-2jpp.ep1.7.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | ws-commons-policy | 0:1.0-2jpp.ep1.7.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | ws-scout0 | 0:0.7-0.rc2.4.el5 |
| Red Hat jboss enterprise application platform 4.2.0 | ws-scout0 | 0:0.7-0.rc2.4.el4 |
| Red Hat jboss enterprise application platform 4.2.0 | xalan-j2 | 0:2.7.0-2jpp.ep1.5.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | glassfish-jaxb | 0:2.1.4-1.6.ep1.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | glassfish-jaxb | 0:2.1.4-1.6.1.ep1.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | glassfish-jaxb-javadoc | 0:2.1.4-1.6.ep1.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | glassfish-jaxb-javadoc | 0:2.1.4-1.6.1.ep1.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | glassfish-jsf | 0:1.2_10-0jpp.ep1.5.ep5.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | glassfish-jsf | 0:1.2_10-0jpp.ep1.5.ep5.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | hibernate3 | 1:3.2.4-1.SP1_CP07.0jpp.ep1.14.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | hibernate3 | 1:3.2.4-1.SP1_CP07.0jpp.ep1.14.1.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | hibernate3-javadoc | 1:3.2.4-1.SP1_CP07.0jpp.ep1.14.1.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | hibernate3-javadoc | 1:3.2.4-1.SP1_CP07.0jpp.ep1.14.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | jacorb | 0:2.3.0-1jpp.ep1.7.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | jacorb | 0:2.3.0-1jpp.ep1.7.1.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | jakarta-commons-fileupload | 1:1.1.1-3jpp.ep1.2.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | jakarta-commons-io | 0:1.1-0.20051005.2jpp_1rh |
| Red Hat jboss enterprise application platform 4.3.0 | jakarta-commons-logging-jboss | 0:1.1-4.1.ep1.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | jakarta-commons-logging-jboss | 0:1.1-4.ep1.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | jboss-cache | 0:1.4.1-6.SP11.1.ep1.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | jboss-cache | 0:1.4.1-6.SP11.1.ep1.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | jboss-jaxr | 0:1.2.0-SP2.0jpp.ep1.3.2.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | jboss-jaxr | 0:1.2.0-SP2.0jpp.ep1.3.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | jboss-messaging | 0:1.4.0-2.SP3_CP07.1.ep1.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | jboss-messaging | 0:1.4.0-2.SP3_CP07.1.ep1.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | jboss-remoting | 0:2.2.2-3.SP11.0jpp.ep1.1.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | jboss-remoting | 0:2.2.2-3.SP11.0jpp.ep1.1.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | jboss-seam | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.14.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | jboss-seam | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.10.el5.1 |
| Red Hat jboss enterprise application platform 4.3.0 | jboss-seam-docs | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.14.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | jboss-seam-docs | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.10.el5.1 |
| Red Hat jboss enterprise application platform 4.3.0 | jboss-vfs | 0:1.0.0-1.ep1.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | jboss-vfs | 0:1.0.0-1.ep1.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | jbossas | 0:4.3.0-3.GA_CP04.3.ep1.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | jbossas | 0:4.3.0-3.GA_CP04.2.1.ep1.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | jbossas-4.3.0.GA_CP04-bin | 0:4.3.0-3.GA_CP04.3.ep1.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | jbossas-4.3.0.GA_CP04-bin | 0:4.3.0-3.GA_CP04.2.1.ep1.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | jbossas-client | 0:4.3.0-3.GA_CP04.3.ep1.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | jbossas-client | 0:4.3.0-3.GA_CP04.2.1.ep1.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | jbossts | 1:4.2.3-1.SP5_CP04.1jpp.ep1.1.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | jbossts | 1:4.2.3-1.SP5_CP04.1jpp.ep1.2.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | jbossweb | 0:2.0.0-6.CP09.0jpp.ep1.1.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | jbossweb | 0:2.0.0-6.CP09.0jpp.ep1.1.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | jbossws | 0:2.0.1-3.SP2_CP05.4.ep1.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | jbossws | 0:2.0.1-3.SP2_CP05.3.1.ep1.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | jbossws-common | 0:1.0.0-2.GA_CP03.1.ep1.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | jbossws-common | 0:1.0.0-2.GA_CP03.1.ep1.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | jbossws-framework | 0:2.0.1-1.GA_CP03.2.ep1.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | jbossws-framework | 0:2.0.1-1.GA_CP03.2.ep1.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | jgroups | 1:2.4.5-2.ep1.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | jgroups | 1:2.4.5-2.1.ep1.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | rh-eap-docs | 0:4.3.0-4.GA_CP04.ep1.3.1.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | rh-eap-docs | 0:4.3.0-4.GA_CP04.ep1.3.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | rh-eap-docs-examples | 0:4.3.0-4.GA_CP04.ep1.3.1.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | rh-eap-docs-examples | 0:4.3.0-4.GA_CP04.ep1.3.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | tanukiwrapper | 0:3.2.1-2jpp.ep1.2.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | tanukiwrapper | 0:3.2.1-2jpp.ep1.2.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | tanukiwrapper-debuginfo | 0:3.2.1-2jpp.ep1.2.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | tanukiwrapper-debuginfo | 0:3.2.1-2jpp.ep1.2.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | ws-commons-policy | 0:1.0-2jpp.ep1.7.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | ws-commons-policy | 0:1.0-2jpp.ep1.7.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | ws-scout0 | 0:0.7-0.rc2.4.el4 |
| Red Hat jboss enterprise application platform 4.3.0 | ws-scout0 | 0:0.7-0.rc2.4.el5 |
| Red Hat jboss enterprise application platform 4.3.0 | xalan-j2 | 0:2.7.0-2jpp.ep1.5.el4 |