NonManagedConnectionFactory will log password in clear text when an exception occurs
CVE: CVE-2012-0034
Component: Cache
Severity: Low
Release date: 2012-01-01T00:00:00+00:00

The NonManagedConnectionFactory in JBoss Enterprise Application Platform (EAP) 5.1.2 and 5.2.0, Web Platform (EWP) 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensitive information by reading the log file.


Remediation:
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

Warning: Before applying this update, back up your existing JBoss
Enterprise Application Platform installation (including all applications
and configuration files).

All users of JBoss Enterprise Application Platform 5.1.2 on Red Hat
Enterprise Linux 4 are advised to upgrade to these updated packages. The
JBoss server process must be restarted for the update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

Warning: Before applying this update, back up your existing JBoss
Enterprise Application Platform installation (including all applications
and configuration files).

All users of JBoss Enterprise Application Platform 5.1.2 on Red Hat
Enterprise Linux 5 are advised to upgrade to these updated packages. The
JBoss server process must be restarted for the update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

Warning: Before applying this update, back up your existing JBoss
Enterprise Web Platform installation (including all applications and
configuration files).

All users of JBoss Enterprise Web Platform 5.1.2 on Red Hat Enterprise
Linux 5 are advised to upgrade to these updated packages. The JBoss server
process must be restarted for the update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

Warning: Before applying this update, back up your existing JBoss
Enterprise Application Platform installation (including all applications
and configuration files).

All users of JBoss Enterprise Application Platform 5.1.2 on Red Hat
Enterprise Linux 6 are advised to upgrade to these updated packages. The
JBoss server process must be restarted for the update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

Warning: Before applying this update, back up your existing JBoss
Enterprise Web Platform installation (including all applications and
configuration files).

All users of JBoss Enterprise Web Platform 5.1.2 on Red Hat Enterprise
Linux 6 are advised to upgrade to these updated packages. The JBoss server
process must be restarted for the update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

Warning: Before applying the update, back up your existing JBoss Enterprise
BRMS Platform installation (including its databases, applications,
configuration files, and so on).

The References section of this erratum contains a download link (you must
log in to download the update). Warning: Before applying the update, back
up your existing JBoss Enterprise BRMS Platform installation (including its
databases, applications, configuration files, and so on).

All users of JBoss Enterprise BRMS Platform 5.3.0 as provided from the Red
Hat Customer Portal are advised to upgrade to JBoss Enterprise BRMS
Platform 5.3.1.
The References section of this erratum contains a download link (you must
log in to download the update).

To apply this update:

1) Before applying this update, back up your existing JBoss Enterprise
Application Platform's "jboss-as/server/[PROFILE]/lib/jbosscache-core.jar"
file.

2) Download the update.

3) Rename the jbosscache-core-JBPAPP-7852-signed.jar file provided by the
ZIP file to jbosscache-core.jar, and then copy it to the
"jboss-as/server/[PROFILE]/lib/" directory, overwriting the old
jbosscache-core.jar.

4) Restart the JBoss server process.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing JBoss Enterprise SOA Platform installation (including its
databases, applications, configuration files, and so on).
The References section of this erratum contains a download link (you must
log in to download the update).

To apply this update:

1) Before applying this update, back up your existing JBoss Enterprise
Web Platform's "jboss-as-web/server/production/lib/jbosscache-core.jar"
file.

2) Download the update.

3) Rename the jbosscache-core-JBPAPP-7852-signed.jar file provided by the
ZIP file to jbosscache-core.jar, and then copy it to the
"jboss-as-web/server/production/lib/" directory, overwriting the old
jbosscache-core.jar.

4) Restart the JBoss server process.