5. Known Issues with this release

Following is a list of known issues at the time of release.

JBPAPP-1809: A warning may occur in the log files for the tomcat user, which informs that there are no write permissions on the directory. A workaround currently exists for this issue that involves adding write permission to the tomcat group directory tomcat/conf.
JBPAPP-1837: Following RPM installation on Red Hat Enterprise Linux 4, the /var/log/httpd22 directory is not automatically created, forcing the httpd startup script to fail. The current workaround is to manually create this directory.
JBPAPP-1838: Once installation of the Enterprise Web Server has been completed via zip, a bug exists where the httpd/.postinstall script does not modify the conf/httpd.conf file to point to the correct ServerRoot directory. A workaround which exists for this involves replacing the reference to the /etc/httpd directory within the httpd/.postinstall script with the /etc/httpd22 directory.
JBPAPP-1788: Tomcat 6 on Solaris is stopped by the use of the command ews/etc/init.d/tomcat6 stop and though the server is successfully terminated, the output displays command usage errors. This is an issue with CATALINA_PID not being propagated for Tomcat 6 and will be fixed in a future release.

Security Known Issues

CVE-2010-2086: JBoss Enterprise Web Server 1.0.0 ships with Apache MyFaces 1.1.0. Apache MyFaces 1.1.0 does not support encrypted view state. When the application's view state is not encrypted, it is possible for an attacker to supply a new or modified view object as part of a request. This allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
JBoss Enterprise Web Server 1.0.1 and later does not ship with Apache MyFaces. Upgrading to JBoss Enterprise Web Server 1.0.1 or later is recommended to mitigate this issue.