{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the mod_cluster native component for JBoss Enterprise Web\nServer 1.0.2 that fixes one security issue is now available from the Red\nHat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from the\nCVE link in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The mod_cluster native component provides a native build of mod_cluster for\nthe Apache HTTP Server (httpd). mod_cluster is an httpd-based load\nbalancer. Like mod_jk, it uses a communication channel to forward requests\nfrom httpd to an application server node.\n\nIt was found that mod_cluster allowed worker nodes to register on any\nvirtual host (vhost), regardless of the security constraints applied to\nother vhosts. In a typical environment, there will be one vhost configured\ninternally for worker nodes, and another configured externally for serving\ncontent. A remote attacker could use this flaw to register an\nattacker-controlled worker node via an external vhost that is not\nconfigured to apply security constraints, then use that worker node to\nserve malicious content, intercept credentials, and hijack user sessions.\n(CVE-2011-4608)\n\nThis update also upgrades mod_cluster to version 1.0.10.GA_CP02.\n\nAll users of JBoss Enterprise Web Server 1.0.2 as provided from the Red\nHat Customer Portal are advised to apply this update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2012:0036",
        "url": "https://access.redhat.com/errata/RHSA-2012:0036"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver\u0026downloadType=securityPatches\u0026version=1.0.2",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver\u0026downloadType=securityPatches\u0026version=1.0.2"
      },
      {
        "category": "external",
        "summary": "767020",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=767020"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0036.json"
      }
    ],
    "title": "Red Hat Security Advisory: mod_cluster-native security update",
    "tracking": {
      "current_release_date": "2024-11-22T04:55:09+00:00",
      "generator": {
        "date": "2024-11-22T04:55:09+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2012:0036",
      "initial_release_date": "2012-01-18T19:16:00+00:00",
      "revision_history": [
        {
          "date": "2012-01-18T19:16:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:43:12+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T04:55:09+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Web Server 1.0",
                "product": {
                  "name": "Red Hat JBoss Web Server 1.0",
                  "product_id": "Red Hat JBoss Web Server 1.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Web Server"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2011-4608",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "discovery_date": "2011-12-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "767020"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "mod_cluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from an external vhost that does not enforce security constraints.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mod_cluster: malicious worker nodes can register on any vhost",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Web Server 1.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2011-4608"
        },
        {
          "category": "external",
          "summary": "RHBZ#767020",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=767020"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2011-4608",
          "url": "https://www.cve.org/CVERecord?id=CVE-2011-4608"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2011-4608",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4608"
        }
      ],
      "release_date": "2012-01-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-01-18T19:16:00+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).\n\nThe Apache HTTP Server must be restarted for this update to take effect.",
          "product_ids": [
            "Red Hat JBoss Web Server 1.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:0036"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Web Server 1.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "mod_cluster: malicious worker nodes can register on any vhost"
    }
  ]
}