PT-2012-1508 · Red Hat · Jboss Enterprise Portal Platform+1

Published 2012-11-23 · Updated 2023-02-13 · CVE-2011-1096

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Portal Platform versions prior to 5.2.2

Description The issue allows remote attackers to obtain plaintext data via a chosen-ciphertext attack on SOAP responses. This is related to the use of block ciphers in cipher-block chaining (CBC) mode in the W3C XML Encryption Standard, as used in the JBoss Web Services (JBossWS) component.

Recommendations For JBoss Enterprise Portal Platform versions prior to 5.2.2, update to version 5.2.2 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2011-1096

RHSA-2013:0191

RHSA-2013:0192

RHSA-2013:0193

RHSA-2013:0195

RHSA-2013:0196

RHSA-2013:0197

Affected Products

Jboss Enterprise Portal Platform

Jbossws

References · 32

• http://rhn.redhat.com/errata/RHSA-2013-1437.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0198.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0193.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1344.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1301.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0195.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0196.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0194.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0191.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0261.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0221.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0192.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1330.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1096 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-0197.html · Vendor Advisory