tags 611130 + wontfix
severity 611130 important
thanks

Hi,

I was checking again what is the status of this bug and I found a statement
in RedHat bugtracker posted by David Jorm:

Statement:

This flaw affects applications using unencrypted client-side view states on 
Mojarra as shipped with JBoss Communications Platform 1.2.11 and 5.1.1, JBoss 
Enterprise Application Platform 4.2.0, 4.3.0 and 5.1.1, JBoss Enterprise BRMS 
Platform 5.1.0, JBoss Enterprise Portal Platform 4.3 and 5.1.1, JBoss 
Enterprise SOA Platform 4.2.0, 4.3.0 and 5.1.0, JBoss Enterprise Web Platform 
5.1.1 and JBoss Web Framework Kit 1.1.0 and 1.2.0. Unencrypted client-side view 
states are fundamentally insecure and should not be used. Developers are 
advised to always enable encryption when creating JavaServer Faces (JSF) 
applications using client-side view state. When using the Mojarra 
implementation of JSF, this is achieved by adding the following snippet to the 
application's web.xml:
<context-param>
   <param-name>javax.faces.STATE_SAVING_METHOD</param-name>
   <param-value>client</param-value>
</context-param>
<env-entry>
   <env-entry-name>ClientStateSavingPassword</env-entry-name>
   <env-entry-type>java.lang.String</env-entry-type>
   <env-entry-value>INSERT_YOUR_PASSWORD</env-entry-value>
</env-entry>


So, IMO this looks like it is not going to be fixed anytime soon if ever.

Cheers,

-- 
Miguel Landaeta, miguel at miguel.cc
secure email with PGP 0x6E608B637D8967E9 available at http://keyserver.pgp.com/
"Faith means not wanting to know what is true." -- Nietzsche

Attachment: signature.asc
Description: Digital signature

__
This is the maintainer address of Debian's Java team
<http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-java-maintainers>. 
Please use
debian-j...@lists.debian.org for discussions and questions.

Reply via email to