title: Red Hat Security Advisory: Red Hat JBoss BRMS 6.1.0 update
description: CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix WS: EJB3 role restrictions are not applied to jaxws handlers Java: Java XML Signature DoS Attack async-http-client: SSL/TLS certificate verification is disabled under certain conditions async-http-client: missing hostname verification for SSL certificates CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy JBossSX/PicketBox: World readable audit.log file CXF: HTML content posted to SOAP endpoint could cause OOM errors CXF: Large invalid content could cause temporary space to fill CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods Security: Wrong security context loaded when using SAML2 STS Login Module RESTeasy: External entities expanded by DocumentProvider Weld: Limited information disclosure via stale thread state jBPM: BPMN2 file processing XXE in Process Execution
cpes: cpe:/a:redhat:jboss_brms:6.0