Security vulnerabilities in JBoss AS 7?

[wendyschmitz]

Our company is in the process of evaluating JBoss AS 7 and would like to find out what the process is for handling security vulnerabitilities identified in JBoss. More specifically, is there a site where I can go to view and download security patches released by JBoss version, as well as information on how to install the patch/fix? Are security fixes available in the community version of JBoss or only for EAPs?

Thanks.

[nickarls]

Security patches have traditionally been EAP-related (I'm just guessing here since I don't recall any serious issues being reported in a long time). I guess if the bug is bad enough it will be backported (or at least available in the next release). There is a new patching system coming up which will probably be used: https://community.jboss.org/wiki/SingleInstallationPatching

[ctomc]

Hi,

to read about process best to look at security website

https://access.redhat.com/security/updates/advisory/

--

tomaz

[wendyschmitz]

Thanks for the resource.