{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss BRMS 6.2.0, which fixes three security issues, several\nbugs, and adds various enhancements, is now available from the Red Hat\nCustomer Portal.\n\nRed Hat Product Security has rated this update as having Critical security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss BRMS is a business rules management system for the\nmanagement, storage, creation, modification, and deployment of JBoss Rules.\n\nThis release of Red Hat JBoss BRMS 6.2.0 serves as a replacement for Red\nHat JBoss BRMS 6.1.2, and includes bug fixes and enhancements. Refer to the\nRed Hat JBoss BRMS 6.2.0 Release Notes for information on the most\nsignificant of these changes. The Release Notes are available at\nhttps://access.redhat.com/documentation/en/red-hat-jboss-brms/\n\nThe following security issues are also fixed with this release:\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nFurther information about this security flaw may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nIt was found that batik was vulnerable to XML External Entity attacks when\nparsing SVG files. A remote attacker able to send malicious SVG content to\nthe affected server could use this flaw to read files accessible to the\nuser running the application server, and potentially perform other more\nadvanced XXE attacks. (CVE-2015-0250)\n\nIt was found that jsoup did not properly validate user-supplied HTML\ncontent; certain HTML snippets could get past the validator without being\ndetected as unsafe. A remote attacker could use a specially crafted HTML\nsnippet to execute arbitrary web script in the user\u0027s browser.\n(CVE-2015-6748)\n\nAll users of Red Hat JBoss BRMS 6.1.2 as provided from the Red Hat Customer\nPortal are advised to upgrade to Red Hat JBoss BRMS 6.2.0.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2559",
        "url": "https://access.redhat.com/errata/RHSA-2015:2559"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=distributions\u0026version=6.2.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=distributions\u0026version=6.2.0"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en/red-hat-jboss-brms/",
        "url": "https://access.redhat.com/documentation/en/red-hat-jboss-brms/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/2045023",
        "url": "https://access.redhat.com/solutions/2045023"
      },
      {
        "category": "external",
        "summary": "1203762",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203762"
      },
      {
        "category": "external",
        "summary": "1258310",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1258310"
      },
      {
        "category": "external",
        "summary": "1279330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2559.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss BRMS 6.2.0 update",
    "tracking": {
      "current_release_date": "2024-12-15T18:42:30+00:00",
      "generator": {
        "date": "2024-12-15T18:42:30+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2015:2559",
      "initial_release_date": "2015-12-07T20:46:42+00:00",
      "revision_history": [
        {
          "date": "2015-12-07T20:46:42+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:35:49+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-15T18:42:30+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss BRMS 6.2",
                "product": {
                  "name": "Red Hat JBoss BRMS 6.2",
                  "product_id": "Red Hat JBoss BRMS 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_brms:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Decision Manager"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-0250",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2015-03-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1203762"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that batik was vulnerable to XML External Entity attacks when parsing SVG files. A remote attacker able to send malicious SVG content to the affected server could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "batik: XML External Entity (XXE) injection in SVG parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BRMS 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-0250"
        },
        {
          "category": "external",
          "summary": "RHBZ#1203762",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203762"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-0250",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-0250"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-0250",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0250"
        },
        {
          "category": "external",
          "summary": "http://xmlgraphics.apache.org/security.html",
          "url": "http://xmlgraphics.apache.org/security.html"
        }
      ],
      "release_date": "2012-07-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:42+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss BRMS 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2559"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss BRMS 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "batik: XML External Entity (XXE) injection in SVG parsing"
    },
    {
      "cve": "CVE-2015-6748",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2015-08-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1258310"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that jsoup did not properly validate user-supplied HTML content; certain HTML snippets could get past the validator without being detected as unsafe. A remote attacker could use a specially crafted HTML snippet to execute arbitrary web script in the user\u0027s browser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jsoup: XSS vulnerability related to incomplete tags at EOF",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BRMS 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-6748"
        },
        {
          "category": "external",
          "summary": "RHBZ#1258310",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1258310"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-6748",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-6748"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-6748",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-6748"
        }
      ],
      "release_date": "2015-08-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:42+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss BRMS 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2559"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss BRMS 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jsoup: XSS vulnerability related to incomplete tags at EOF"
    },
    {
      "cve": "CVE-2015-7501",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2015-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1279330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BRMS 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "RHBZ#1279330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
        },
        {
          "category": "external",
          "summary": "RHSB-2045023",
          "url": "https://access.redhat.com/solutions/2045023"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
          "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"
        }
      ],
      "release_date": "2015-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:42+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss BRMS 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2559"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss BRMS 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss BPM Suite 6.2.0, which fixes three security issues, several\nbugs, and adds various enhancements, is now available from the Red Hat\nCustomer Portal.\n\nRed Hat Product Security has rated this update as having Critical security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss BPM Suite is a business rules and processes management system\nfor the management, storage, creation, modification, and deployment of\nJBoss rules and BPMN2-compliant business processes.\n\nThis release of Red Hat JBoss BPM Suite 6.2.0 serves as a replacement for\nRed Hat JBoss BPM Suite 6.1.2, and includes bug fixes and enhancements.\nRefer to the Red Hat JBoss BPM Suite 6.2.0 Release Notes for information on\nthe most significant of these changes. The Release Notes are available at\nhttps://access.redhat.com/documentation/en/red-hat-jboss-brms/\n\nThe following security issues are also fixed with this release:\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nFurther information about this security flaw may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nIt was found that batik was vulnerable to XML External Entity attacks when\nparsing SVG files. A remote attacker able to send malicious SVG content to\nthe affected server could use this flaw to read files accessible to the\nuser running the application server, and potentially perform other more\nadvanced XXE attacks. (CVE-2015-0250)\n\nIt was found that jsoup did not properly validate user-supplied HTML\ncontent; certain HTML snippets could get past the validator without being\ndetected as unsafe. A remote attacker could use a specially crafted HTML\nsnippet to execute arbitrary web script in the user\u0027s browser.\n(CVE-2015-6748)\n\nAll users of Red Hat JBoss BPM Suite 6.1.2 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss BPM Suite 6.2.0.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2560",
        "url": "https://access.redhat.com/errata/RHSA-2015:2560"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=distributions\u0026version=6.2.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=distributions\u0026version=6.2.0"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en/red-hat-jboss-bpm-suite/",
        "url": "https://access.redhat.com/documentation/en/red-hat-jboss-bpm-suite/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/2045023",
        "url": "https://access.redhat.com/solutions/2045023"
      },
      {
        "category": "external",
        "summary": "1203762",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203762"
      },
      {
        "category": "external",
        "summary": "1258310",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1258310"
      },
      {
        "category": "external",
        "summary": "1279330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2560.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.2.0 update",
    "tracking": {
      "current_release_date": "2024-12-15T18:42:34+00:00",
      "generator": {
        "date": "2024-12-15T18:42:34+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2015:2560",
      "initial_release_date": "2015-12-07T20:46:36+00:00",
      "revision_history": [
        {
          "date": "2015-12-07T20:46:36+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:36:08+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-15T18:42:34+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss BPMS 6.2",
                "product": {
                  "name": "Red Hat JBoss BPMS 6.2",
                  "product_id": "Red Hat JBoss BPMS 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_bpms:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Process Automation Manager"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-0250",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2015-03-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1203762"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that batik was vulnerable to XML External Entity attacks when parsing SVG files. A remote attacker able to send malicious SVG content to the affected server could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "batik: XML External Entity (XXE) injection in SVG parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BPMS 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-0250"
        },
        {
          "category": "external",
          "summary": "RHBZ#1203762",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203762"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-0250",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-0250"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-0250",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0250"
        },
        {
          "category": "external",
          "summary": "http://xmlgraphics.apache.org/security.html",
          "url": "http://xmlgraphics.apache.org/security.html"
        }
      ],
      "release_date": "2012-07-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:36+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss BPMS 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2560"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss BPMS 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "batik: XML External Entity (XXE) injection in SVG parsing"
    },
    {
      "cve": "CVE-2015-6748",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2015-08-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1258310"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that jsoup did not properly validate user-supplied HTML content; certain HTML snippets could get past the validator without being detected as unsafe. A remote attacker could use a specially crafted HTML snippet to execute arbitrary web script in the user\u0027s browser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jsoup: XSS vulnerability related to incomplete tags at EOF",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BPMS 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-6748"
        },
        {
          "category": "external",
          "summary": "RHBZ#1258310",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1258310"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-6748",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-6748"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-6748",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-6748"
        }
      ],
      "release_date": "2015-08-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:36+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss BPMS 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2560"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss BPMS 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jsoup: XSS vulnerability related to incomplete tags at EOF"
    },
    {
      "cve": "CVE-2015-7501",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2015-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1279330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BPMS 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "RHBZ#1279330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
        },
        {
          "category": "external",
          "summary": "RHSB-2045023",
          "url": "https://access.redhat.com/solutions/2045023"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
          "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"
        }
      ],
      "release_date": "2015-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:36+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss BPMS 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2560"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss BPMS 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the Apache Commons Collections component that fixes one\nsecurity issue is now available from the Red Hat Customer Portal for Red\nHat JBoss BRMS 6.1.0.\n\nRed Hat Product Security has rated this update as having Critical security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Apache Commons Collections is a library built upon Java JDK classes by\nproviding new interfaces, implementations and utilities.\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nFurther information about this security flaw may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nAll users of Red Hat JBoss BRMS 6.1.0 as provided from the Red\nHat Customer Portal are advised to apply this security update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2578",
        "url": "https://access.redhat.com/errata/RHSA-2015:2578"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=securityPatches\u0026version=6.1.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=securityPatches\u0026version=6.1.0"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/2045023",
        "url": "https://access.redhat.com/solutions/2045023"
      },
      {
        "category": "external",
        "summary": "1279330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2578.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss BRMS 6.1.0 commons-collections security update",
    "tracking": {
      "current_release_date": "2024-12-15T18:42:38+00:00",
      "generator": {
        "date": "2024-12-15T18:42:38+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2015:2578",
      "initial_release_date": "2015-12-08T16:18:42+00:00",
      "revision_history": [
        {
          "date": "2015-12-08T16:18:42+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:38:08+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-15T18:42:38+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss BRMS 6.1",
                "product": {
                  "name": "Red Hat JBoss BRMS 6.1",
                  "product_id": "Red Hat JBoss BRMS 6.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_brms:6.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Decision Manager"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-7501",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2015-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1279330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BRMS 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "RHBZ#1279330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
        },
        {
          "category": "external",
          "summary": "RHSB-2045023",
          "url": "https://access.redhat.com/solutions/2045023"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
          "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"
        }
      ],
      "release_date": "2015-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-08T16:18:42+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss BRMS installation (including its databases,\napplications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss BRMS server by\nstopping the JBoss Application Server process before installing this\nupdate, and then after installing the update, restart the Red Hat JBoss\nBRMS server by starting the JBoss Application Server process.",
          "product_ids": [
            "Red Hat JBoss BRMS 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2578"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss BRMS 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the Apache Commons Collections component that fixes one\nsecurity issue is now available from the Red Hat Customer Portal for Red\nHat JBoss BPM Suite 6.1.0.\n\nRed Hat Product Security has rated this update as having Critical security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Apache Commons Collections is a library built upon Java JDK classes by\nproviding new interfaces, implementations and utilities.\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nFurther information about this security flaw may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nAll users of Red Hat JBoss BPM Suite 6.1.0 as provided from the Red Hat\nCustomer Portal are advised to apply this security update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2579",
        "url": "https://access.redhat.com/errata/RHSA-2015:2579"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=securityPatches\u0026version=6.1.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=securityPatches\u0026version=6.1.0"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/2045023",
        "url": "https://access.redhat.com/solutions/2045023"
      },
      {
        "category": "external",
        "summary": "1279330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2579.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.1.0 commons-collections security update",
    "tracking": {
      "current_release_date": "2024-12-15T18:42:42+00:00",
      "generator": {
        "date": "2024-12-15T18:42:42+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2015:2579",
      "initial_release_date": "2015-12-08T16:18:35+00:00",
      "revision_history": [
        {
          "date": "2015-12-08T16:18:35+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:36:09+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-15T18:42:42+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss BPMS 6.0",
                "product": {
                  "name": "Red Hat JBoss BPMS 6.0",
                  "product_id": "Red Hat JBoss BPMS 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_bpms:6.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Process Automation Manager"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-7501",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2015-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1279330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BPMS 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "RHBZ#1279330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
        },
        {
          "category": "external",
          "summary": "RHSB-2045023",
          "url": "https://access.redhat.com/solutions/2045023"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
          "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"
        }
      ],
      "release_date": "2015-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-08T16:18:35+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the updates). Before applying the updates, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss BPMS 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2579"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss BPMS 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the Apache Commons Collections component that fixes one\nsecurity issue is now available from the Red Hat Customer Portal for Red\nHat JBoss BRMS 5.3.1.\n\nRed Hat Product Security has rated this update as having Critical security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Apache Commons Collections is a library built upon Java JDK classes by\nproviding new interfaces, implementations and utilities.\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nFurther information about this security flaw may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nAll users of Red Hat JBoss BRMS 5.3.1 as provided from the Red Hat Customer\nPortal are advised to apply this security update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2670",
        "url": "https://access.redhat.com/errata/RHSA-2015:2670"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=securityPatches\u0026version=5.3.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=securityPatches\u0026version=5.3.1"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/2045023",
        "url": "https://access.redhat.com/solutions/2045023"
      },
      {
        "category": "external",
        "summary": "1279330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2670.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss BRMS 5.3.1 commons-collections security update",
    "tracking": {
      "current_release_date": "2024-12-15T18:42:17+00:00",
      "generator": {
        "date": "2024-12-15T18:42:17+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2015:2670",
      "initial_release_date": "2015-12-18T21:17:13+00:00",
      "revision_history": [
        {
          "date": "2015-12-18T21:17:13+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:37:16+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-15T18:42:17+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "JBoss Enterprise BRMS Platform 5.3",
                "product": {
                  "name": "JBoss Enterprise BRMS Platform 5.3",
                  "product_id": "JBoss Enterprise BRMS Platform 5.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_brms_platform:5.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Decision Manager"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-7501",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2015-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1279330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "JBoss Enterprise BRMS Platform 5.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "RHBZ#1279330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
        },
        {
          "category": "external",
          "summary": "RHSB-2045023",
          "url": "https://access.redhat.com/solutions/2045023"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
          "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"
        }
      ],
      "release_date": "2015-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-18T21:17:13+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss BRMS installation (including its databases,\napplications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss BRMS server by\nstopping the JBoss Application Server process before installing this\nupdate, and then after installing the update, restart the Red Hat JBoss\nBRMS server by starting the JBoss Application Server process.",
          "product_ids": [
            "JBoss Enterprise BRMS Platform 5.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2670"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "JBoss Enterprise BRMS Platform 5.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated jakarta-commons-collections packages that fix one security issue\nare now available for Red Hat Enterprise Linux 5.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Jakarta/Apache Commons Collections library provides new interfaces,\nimplementations, and utilities to extend the features of the Java\nCollections Framework.\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nWith this update, deserialization of certain classes in the\ncommons-collections library is no longer allowed. Applications that require\nthose classes to be deserialized can use the system property\n\"org.apache.commons.collections.enableUnsafeSerialization\" to re-enable\ntheir deserialization.\n\nFurther information about this security flaw may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nAll users of jakarta-commons-collections are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this issue.\nAll running applications using the commons-collections library must be\nrestarted for the update to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2671",
        "url": "https://access.redhat.com/errata/RHSA-2015:2671"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/2045023",
        "url": "https://access.redhat.com/solutions/2045023"
      },
      {
        "category": "external",
        "summary": "1279330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2671.json"
      }
    ],
    "title": "Red Hat Security Advisory: jakarta-commons-collections security update",
    "tracking": {
      "current_release_date": "2024-12-15T18:42:47+00:00",
      "generator": {
        "date": "2024-12-15T18:42:47+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2015:2671",
      "initial_release_date": "2015-12-21T06:05:27+00:00",
      "revision_history": [
        {
          "date": "2015-12-21T06:05:27+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2015-12-21T06:05:28+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-15T18:42:47+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
                "product": {
                  "name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
                  "product_id": "5Client-5.11.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:5::client"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
                "product": {
                  "name": "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
                  "product_id": "5Client-Workstation-5.11.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:5::client_workstation"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux (v. 5 server)",
                "product": {
                  "name": "Red Hat Enterprise Linux (v. 5 server)",
                  "product_id": "5Server-5.11.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:5::server"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
                "product": {
                  "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
                  "product_id": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-testframework-javadoc@3.2-2jpp.4?arch=i386"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-0:3.2-2jpp.4.i386",
                "product": {
                  "name": "jakarta-commons-collections-0:3.2-2jpp.4.i386",
                  "product_id": "jakarta-commons-collections-0:3.2-2jpp.4.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections@3.2-2jpp.4?arch=i386"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
                "product": {
                  "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
                  "product_id": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-testframework@3.2-2jpp.4?arch=i386"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
                "product": {
                  "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
                  "product_id": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-debuginfo@3.2-2jpp.4?arch=i386"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
                "product": {
                  "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
                  "product_id": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-javadoc@3.2-2jpp.4?arch=i386"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
                "product": {
                  "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
                  "product_id": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-tomcat5@3.2-2jpp.4?arch=i386"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i386"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
                "product": {
                  "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
                  "product_id": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-testframework@3.2-2jpp.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
                "product": {
                  "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
                  "product_id": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-debuginfo@3.2-2jpp.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
                "product": {
                  "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
                  "product_id": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-testframework-javadoc@3.2-2jpp.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
                "product": {
                  "name": "jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
                  "product_id": "jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections@3.2-2jpp.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
                "product": {
                  "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
                  "product_id": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-javadoc@3.2-2jpp.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
                "product": {
                  "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
                  "product_id": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-tomcat5@3.2-2jpp.4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-0:3.2-2jpp.4.src",
                "product": {
                  "name": "jakarta-commons-collections-0:3.2-2jpp.4.src",
                  "product_id": "jakarta-commons-collections-0:3.2-2jpp.4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections@3.2-2jpp.4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
                "product": {
                  "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
                  "product_id": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-testframework-javadoc@3.2-2jpp.4?arch=ia64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
                "product": {
                  "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
                  "product_id": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-tomcat5@3.2-2jpp.4?arch=ia64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
                "product": {
                  "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
                  "product_id": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-debuginfo@3.2-2jpp.4?arch=ia64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-0:3.2-2jpp.4.ia64",
                "product": {
                  "name": "jakarta-commons-collections-0:3.2-2jpp.4.ia64",
                  "product_id": "jakarta-commons-collections-0:3.2-2jpp.4.ia64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections@3.2-2jpp.4?arch=ia64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
                "product": {
                  "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
                  "product_id": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-testframework@3.2-2jpp.4?arch=ia64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
                "product": {
                  "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
                  "product_id": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-javadoc@3.2-2jpp.4?arch=ia64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ia64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
                "product": {
                  "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
                  "product_id": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-testframework-javadoc@3.2-2jpp.4?arch=ppc"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
                "product": {
                  "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
                  "product_id": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-debuginfo@3.2-2jpp.4?arch=ppc"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
                "product": {
                  "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
                  "product_id": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-javadoc@3.2-2jpp.4?arch=ppc"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-0:3.2-2jpp.4.ppc",
                "product": {
                  "name": "jakarta-commons-collections-0:3.2-2jpp.4.ppc",
                  "product_id": "jakarta-commons-collections-0:3.2-2jpp.4.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections@3.2-2jpp.4?arch=ppc"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
                "product": {
                  "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
                  "product_id": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-tomcat5@3.2-2jpp.4?arch=ppc"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
                "product": {
                  "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
                  "product_id": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-testframework@3.2-2jpp.4?arch=ppc"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
                "product": {
                  "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
                  "product_id": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-tomcat5@3.2-2jpp.4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
                "product": {
                  "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
                  "product_id": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-testframework-javadoc@3.2-2jpp.4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-0:3.2-2jpp.4.s390x",
                "product": {
                  "name": "jakarta-commons-collections-0:3.2-2jpp.4.s390x",
                  "product_id": "jakarta-commons-collections-0:3.2-2jpp.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections@3.2-2jpp.4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
                "product": {
                  "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
                  "product_id": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-javadoc@3.2-2jpp.4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
                "product": {
                  "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
                  "product_id": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-debuginfo@3.2-2jpp.4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
                "product": {
                  "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
                  "product_id": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-testframework@3.2-2jpp.4?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.src as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.src",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.src as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.src",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.src as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.src",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Server-5.11.Z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-7501",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2015-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1279330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386",
          "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64",
          "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc",
          "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x",
          "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src",
          "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
          "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
          "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
          "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
          "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
          "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
          "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
          "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
          "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
          "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
          "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
          "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
          "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
          "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
          "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
          "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
          "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
          "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
          "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
          "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
          "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
          "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
          "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
          "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
          "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
          "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
          "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386",
          "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64",
          "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc",
          "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x",
          "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src",
          "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
          "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
          "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
          "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
          "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
          "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
          "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
          "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
          "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
          "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
          "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
          "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
          "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
          "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
          "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
          "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
          "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
          "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
          "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
          "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
          "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
          "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
          "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
          "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
          "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
          "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "RHBZ#1279330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
        },
        {
          "category": "external",
          "summary": "RHSB-2045023",
          "url": "https://access.redhat.com/solutions/2045023"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
          "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"
        }
      ],
      "release_date": "2015-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-21T06:05:27+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src",
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
            "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
            "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
            "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2671"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src",
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
            "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
            "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
            "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat JBoss Operations Network 3.1.2 that fixes one\nsecurity issue is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having Critical security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "JBoss Operations Network provides an integrated solution for managing\nJBoss middleware, other network infrastructure, and applications built\non Red Hat Enterprise Application Platform (EAP). The Apache Commons\nCollections library provides new interfaces, implementations, and\nutilities to extend the features of the Java Collections Framework.\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nFurther information about this security flaw may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nAll users of JBoss Operations Network 3.1.2 as provided from the Red Hat\nCustomer Portal are advised to apply this update. This patch supersedes\nthe 3.2.1 Hotfix 10.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:0040",
        "url": "https://access.redhat.com/errata/RHSA-2016:0040"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=em\u0026downloadType=securityPatches\u0026version=3.1.2",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=em\u0026downloadType=securityPatches\u0026version=3.1.2"
      },
      {
        "category": "external",
        "summary": "1279330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0040.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Operations Network 3.1.2 Hotfix 11 update",
    "tracking": {
      "current_release_date": "2026-05-14T22:18:34+00:00",
      "generator": {
        "date": "2026-05-14T22:18:34+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2016:0040",
      "initial_release_date": "2016-01-14T18:34:55+00:00",
      "revision_history": [
        {
          "date": "2016-01-14T18:34:55+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:36:06+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:18:34+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Operations Network 3.1",
                "product": {
                  "name": "Red Hat JBoss Operations Network 3.1",
                  "product_id": "Red Hat JBoss Operations Network 3.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_operations_network:3.1.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Operations Network"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-7501",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2015-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1279330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Operations Network 3.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "RHBZ#1279330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
        },
        {
          "category": "external",
          "summary": "RHSB-2045023",
          "url": "https://access.redhat.com/solutions/2045023"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
          "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"
        }
      ],
      "release_date": "2015-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-01-14T18:34:55+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nNote: This update provides fixes for the server, agent, and core GUI\ncomponents of Red Hat JBoss Operations Network. It is recommended to apply\nall the patches provided by this update.",
          "product_ids": [
            "Red Hat JBoss Operations Network 3.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:0040"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Operations Network 3.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Operations Network 3.3 update 5, which fixes two security\nissues and several bugs, is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having Critical security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Operations Network is a Middleware management solution that\nprovides a single point of control to deploy, manage, and monitor JBoss\nEnterprise Middleware, applications, and services.\n\nThis JBoss Operations Network 3.3.5 release serves as a replacement for\nJBoss Operations Network 3.3.4, and includes several bug fixes. Refer to\nthe Customer Portal page linked in the References section for information\non the most significant of these changes.\n\nThe following security issues are also fixed with this release:\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the commons-\ncollections library. (CVE-2015-7501)\n\nA flaw was discovered in the way applications using Groovy used the\nstandard Java serialization mechanism. A remote attacker could use a\nspecially crafted serialized object that would execute code directly\nwhen deserialized. All applications which rely on serialization and do\nnot isolate the code which deserializes objects are subject to this\nvulnerability. (CVE-2015-3253)\n\nAll users of JBoss Operations Network 3.3.4 as provided from the Red Hat\nCustomer Portal are advised to upgrade to JBoss Operations Network 3.3.5.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:0118",
        "url": "https://access.redhat.com/errata/RHSA-2016:0118"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=em\u0026downloadType=securityPatches\u0026version=3.3",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=em\u0026downloadType=securityPatches\u0026version=3.3"
      },
      {
        "category": "external",
        "summary": "1158947",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1158947"
      },
      {
        "category": "external",
        "summary": "1187680",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1187680"
      },
      {
        "category": "external",
        "summary": "1203799",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203799"
      },
      {
        "category": "external",
        "summary": "1206084",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1206084"
      },
      {
        "category": "external",
        "summary": "1231199",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1231199"
      },
      {
        "category": "external",
        "summary": "1234991",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1234991"
      },
      {
        "category": "external",
        "summary": "1243934",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1243934"
      },
      {
        "category": "external",
        "summary": "1255196",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1255196"
      },
      {
        "category": "external",
        "summary": "1261907",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1261907"
      },
      {
        "category": "external",
        "summary": "1269420",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1269420"
      },
      {
        "category": "external",
        "summary": "1277389",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1277389"
      },
      {
        "category": "external",
        "summary": "1278215",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1278215"
      },
      {
        "category": "external",
        "summary": "1279330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
      },
      {
        "category": "external",
        "summary": "1293350",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1293350"
      },
      {
        "category": "external",
        "summary": "1293368",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1293368"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0118.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Operations Network 3.3.5 update",
    "tracking": {
      "current_release_date": "2026-05-14T22:18:34+00:00",
      "generator": {
        "date": "2026-05-14T22:18:34+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2016:0118",
      "initial_release_date": "2016-02-03T15:00:55+00:00",
      "revision_history": [
        {
          "date": "2016-02-03T15:00:55+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:37:30+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:18:34+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Operations Network 3.3",
                "product": {
                  "name": "Red Hat JBoss Operations Network 3.3",
                  "product_id": "Red Hat JBoss Operations Network 3.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_operations_network:3.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Operations Network"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-3253",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2015-07-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1243934"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "groovy: remote execution of untrusted code in class MethodClosure",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Operations Network 3.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "RHBZ#1243934",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1243934"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-3253",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/oss-sec/2015/q3/121",
          "url": "http://seclists.org/oss-sec/2015/q3/121"
        }
      ],
      "release_date": "2015-07-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-02-03T15:00:55+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nRefer to the JBoss Operations Network 3.3.5 Release Notes for\ninstallation information.",
          "product_ids": [
            "Red Hat JBoss Operations Network 3.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:0118"
        },
        {
          "category": "workaround",
          "details": "Apply the following patch on the MethodClosure class (src/main/org/codehaus/groovy/runtime/MethodClosure.java):\n\n    public class MethodClosure extends Closure {\n        +    private Object readResolve() {\n        +        throw new UnsupportedOperationException();\n        +    \n        }\n\nAlternatively, you should make sure to use a custom security policy file (using the standard Java security manager) or make sure that you do not rely on serialization to communicate remotely.",
          "product_ids": [
            "Red Hat JBoss Operations Network 3.3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Operations Network 3.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "groovy: remote execution of untrusted code in class MethodClosure"
    },
    {
      "cve": "CVE-2015-7501",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2015-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1279330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Operations Network 3.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "RHBZ#1279330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
        },
        {
          "category": "external",
          "summary": "RHSB-2045023",
          "url": "https://access.redhat.com/solutions/2045023"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
          "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"
        }
      ],
      "release_date": "2015-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-02-03T15:00:55+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Operations Network installation (including its databases,\napplications, configuration files, the JBoss Operations Network server\u0027s\nfile system directory, and so on).\n\nRefer to the JBoss Operations Network 3.3.5 Release Notes for\ninstallation information.",
          "product_ids": [
            "Red Hat JBoss Operations Network 3.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:0118"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Operations Network 3.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation"
    }
  ]
}