-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: JBoss Operations Network 3.1.2 update
Advisory ID:       RHSA-2013:0187-01
Product:           JBoss Operations Network
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2013-0187.html
Issue date:        2013-01-23
CVE Names:         CVE-2012-5920 
=====================================================================

1. Summary:

JBoss Operations Network 3.1.2, which fixes one security issue and several
bugs, is now available from the Red Hat Customer Portal.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

2. Description:

JBoss Operations Network (JBoss ON) is a middleware management solution
that provides a single point of control to deploy, manage, and monitor
JBoss Enterprise Middleware, applications, and services.

This JBoss ON 3.1.2 release serves as a replacement for JBoss ON 3.1.1, and
includes several bug fixes. Refer to the JBoss ON 3.1.2 Release Notes for
information on the most significant of these changes. The Release Notes
will be available shortly from https://access.redhat.com/knowledge/docs/

The following security issue is also fixed with this release:

A cross-site scripting (XSS) flaw was found in Google Web Toolkit (GWT), a
core part of the JBoss ON web interface. If a remote attacker could trick a
user, who was logged into the JBoss ON web interface, into visiting a
specially-crafted URL, it could possibly lead to arbitrary web script
execution in the context of the user's JBoss ON session. (CVE-2012-5920)

Warning: Before applying the update, back up your existing JBoss ON
installation (including its databases, applications, configuration files,
the JBoss ON server's file system directory, and so on).

All users of JBoss Operations Network 3.1.1 as provided from the Red Hat
Customer Portal are advised to upgrade to JBoss Operations Network 3.1.2.

3. Solution:

The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing JBoss ON installation (including its databases, applications,
configuration files, the JBoss ON server's file system directory, and so
on).

Refer to the JBoss Operations Network 3.1.2 Release Notes for installation
information.

4. Bugs fixed (http://bugzilla.redhat.com/):

871690 - CVE-2012-5920 GWT: unknown XSS flaw

5. References:

https://www.redhat.com/security/data/cve/CVE-2012-5920.html
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=em&version=3.1.2
https://developers.google.com/web-toolkit/release-notes#Release_Notes_Current
https://access.redhat.com/knowledge/docs/

6. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2013 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFRAFsuXlSAg2UNWIIRAoIpAJ41lcJfSCnjLt/MuybQPPRyssfrJQCfcUU5
QcJou7EXNnVFLk5ejl/pb58=
=bfcd
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce