{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "JBoss Operations Network 3.1.1, which fixes one security issue, several\nbugs, and adds enhancements, is now available from the Red Hat Customer\nPortal.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.", "title": "Topic" }, { "category": "general", "text": "JBoss Operations Network (JBoss ON) is a middleware management solution\nthat provides a single point of control to deploy, manage, and monitor\nJBoss Enterprise Middleware, applications, and services.\n\nThis JBoss ON 3.1.1 release serves as a replacement for JBoss ON 3.1.0, and\nincludes several bug fixes and enhancements. Refer to the JBoss ON 3.1.1\nRelease Notes for information on the most significant of these changes. The\nRelease Notes will be available shortly from\nhttps://access.redhat.com/knowledge/docs/\n\nThe following security issue is also fixed with this release:\n\nIt was found that JBoss Web did not handle large numbers of parameters and\nlarge parameter values efficiently. A remote attacker could make JBoss Web\nuse an excessive amount of CPU time by sending an HTTP request containing a\nlarge number of parameters or large parameter values. This update\nintroduces limits on the number of parameters and headers processed per\nrequest to address this issue. The default limit is 512 for parameters and\n128 for headers. These defaults can be changed by setting the\norg.apache.tomcat.util.http.Parameters.MAX_COUNT and\norg.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties in\n\"jbossas/server/[PROFILE]/deploy/properties-service.xml\". (CVE-2012-0022)\n\nWarning: Before applying the update, back up your existing JBoss ON\ninstallation (including its databases, applications, configuration files,\nthe JBoss ON server's file system directory, and so on).\n\nAll users of JBoss Operations Network 3.1.0 as provided from the Red Hat\nCustomer Portal are advised to upgrade to JBoss Operations Network 3.1.1.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2012:1331", "url": "https://access.redhat.com/errata/RHSA-2012:1331" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/knowledge/docs/", "url": "https://access.redhat.com/knowledge/docs/" }, { "category": "external", "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=em&version=3.1.1", "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=em&version=3.1.1" }, { "category": "external", "summary": "783359", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=783359" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1331.json" } ], "title": "Red Hat Security Advisory: JBoss Operations Network 3.1.1 update", "tracking": { "current_release_date": "2026-01-28T22:34:41+00:00", "generator": { "date": "2026-01-28T22:34:41+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.16" } }, "id": "RHSA-2012:1331", "initial_release_date": "2012-10-03T15:08:00+00:00", "revision_history": [ { "date": "2012-10-03T15:08:00+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-02-20T12:45:18+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2026-01-28T22:34:41+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Operations Network 3.1", "product": { "name": "Red Hat JBoss Operations Network 3.1", "product_id": "Red Hat JBoss Operations Network 3.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_operations_network:3.1" } } } ], "category": "product_family", "name": "Red Hat JBoss Operations Network" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2012-0022", "discovery_date": "2012-01-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "783359" } ], "notes": [ { "category": "description", "text": "Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: large number of parameters DoS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Operations Network 3.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-0022" }, { "category": "external", "summary": "RHBZ#783359", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=783359" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-0022", "url": "https://www.cve.org/CVERecord?id=CVE-2012-0022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-0022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0022" } ], "release_date": "2012-01-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2012-10-03T15:08:00+00:00", "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss ON installation (including its databases, applications,\nconfiguration files, the JBoss ON server's file system directory, and so\non).\n\nRefer to the JBoss Operations Network 3.1.1 Release Notes for installation\ninformation.", "product_ids": [ "Red Hat JBoss Operations Network 3.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2012:1331" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, "products": [ "Red Hat JBoss Operations Network 3.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tomcat: large number of parameters DoS" } ] }