Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2014-0002 (GCVE-0-2014-0002)
Vulnerability from cvelistv5 – Published: 2014-03-20 19:00 – Updated: 2024-08-06 08:58
VLAI?
EPSS
Summary
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:58:26.467Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "57125",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/57125"
},
{
"name": "RHSA-2014:0371",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0371.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"
},
{
"name": "57719",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/57719"
},
{
"name": "65901",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/65901"
},
{
"name": "57716",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/57716"
},
{
"name": "RHSA-2014:0372",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0372.html"
},
{
"name": "[camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E"
},
{
"name": "[camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-01-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-05-24T10:06:03",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "57125",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/57125"
},
{
"name": "RHSA-2014:0371",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0371.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"
},
{
"name": "57719",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/57719"
},
{
"name": "65901",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/65901"
},
{
"name": "57716",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/57716"
},
{
"name": "RHSA-2014:0372",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0372.html"
},
{
"name": "[camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E"
},
{
"name": "[camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2014-0002",
"datePublished": "2014-03-20T19:00:00",
"dateReserved": "2013-12-03T00:00:00",
"dateUpdated": "2024-08-06T08:58:26.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"2.11.3\", \"matchCriteriaId\": \"23ED67A5-FBB0-4151-A7C4-D7F9A82D9753\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:1.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0B06E9C0-DB2D-41D6-98C4-93D973929523\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:1.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A1BC313E-5651-4FBB-B9E6-E66DBA0139D5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:1.2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"83727178-A7C0-4C88-A148-E522B25A8300\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:1.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"139F899A-6652-42C2-8729-F28C63B60DBA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:1.4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1D65D943-3954-4C65-BCFE-993ABE20136B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:1.5.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2ECABA1F-7D64-4272-AA2E-801C9C5CFE67\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:1.6.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C03AED3D-FA8B-4730-B9DA-CFFCEF29A891\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:1.6.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C3D7D5F8-89C1-4CFD-8959-E50F0AF50DD0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:1.6.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C1E1D4FA-C1D6-44E9-9326-DDFD16DE9ECF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:1.6.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B8735662-1424-4F93-B3A3-8CB1D42F953F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:1.6.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"506DFDFF-1712-4B4A-814C-C8CAFB7B2EF9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:2.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F4EA86F9-21F1-4FB1-9412-A0BC76190C24\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:2.0.0:milestone1:*:*:*:*:*:*\", \"matchCriteriaId\": \"BEFC3427-C311-4DC3-BFF7-0EE28706F729\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:2.0.0:milestone2:*:*:*:*:*:*\", \"matchCriteriaId\": \"0C4B2BB5-1535-45A3-9FB1-0B4E6D93234B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:2.0.0:milestone3:*:*:*:*:*:*\", \"matchCriteriaId\": \"5BD846E7-8B3D-42D9-AA9C-26F2F9ACCE1D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:2.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"735DED49-ECF3-4DFE-8BF6-D47A9BA76AC8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:2.10.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8DB96EF4-A413-4632-9D5E-8A22483E4329\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:2.10.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D26D7344-D86B-4BD8-97A5-F33DDCE825D4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:2.10.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E8C16CB0-F061-49FA-81FF-4698E0AB6C75\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:2.10.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"753E5480-95BE-47D5-A020-0A7B95B41A4C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:2.10.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"02D4E217-4934-40FF-B797-2697625C4A69\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:2.10.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7E717996-F17E-4D82-8C18-D8590ECC8AB6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:2.10.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"43EC45F1-F990-4D58-90D7-86E7FE57B116\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:2.10.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B1D65BD5-BCCA-4C69-A9A4-E322AEBEE6F7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:2.11.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6392BFDC-B18A-435D-A296-36CCF0AF6CF2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:2.11.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"86CF9343-8A2C-40AB-88EC-266CB971A7D2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:2.11.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E6386086-1DDB-4FE9-A6A3-10B3071B1A48\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:2.12.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D8DD9514-FCDD-4BFE-A1FD-1A44E07671FA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:2.12.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8899BFF7-4077-46D4-BC20-B8FC31D76BA8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:camel:2.12.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9C90E281-33F1-4010-A5A4-CB551C2B59C6\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.\"}, {\"lang\": \"es\", \"value\": \"El componente XSLT en Apache Camel anterior a 2.11.4 y 2.12.x anterior a 2.12.3 permite a atacantes remotos leer archivos arbitrarios y posiblemente tener otro impacto no especificado a trav\\u00e9s de un documento XML que contiene una declaraci\\u00f3n de entidad externa en conjunci\\u00f3n con una referencia de entidad, relacionado con un problema de XML External Entity (XXE).\"}]",
"id": "CVE-2014-0002",
"lastModified": "2024-11-21T02:01:08.990",
"metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:P/A:P\", \"baseScore\": 7.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 10.0, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2014-03-21T04:38:59.027",
"references": "[{\"url\": \"http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Exploit\", \"Vendor Advisory\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2014-0371.html\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2014-0372.html\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://secunia.com/advisories/57125\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://secunia.com/advisories/57716\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://secunia.com/advisories/57719\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://www.securityfocus.com/bid/65901\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Vendor Advisory\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2014-0371.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2014-0372.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/57125\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://secunia.com/advisories/57716\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/57719\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/65901\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-264\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2014-0002\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2014-03-21T04:38:59.027\",\"lastModified\":\"2025-04-12T10:46:40.837\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.\"},{\"lang\":\"es\",\"value\":\"El componente XSLT en Apache Camel anterior a 2.11.4 y 2.12.x anterior a 2.12.3 permite a atacantes remotos leer archivos arbitrarios y posiblemente tener otro impacto no especificado a trav\u00e9s de un documento XML que contiene una declaraci\u00f3n de entidad externa en conjunci\u00f3n con una referencia de entidad, relacionado con un problema de XML External Entity (XXE).\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.11.3\",\"matchCriteriaId\":\"23ED67A5-FBB0-4151-A7C4-D7F9A82D9753\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:1.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B06E9C0-DB2D-41D6-98C4-93D973929523\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:1.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1BC313E-5651-4FBB-B9E6-E66DBA0139D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:1.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"83727178-A7C0-4C88-A148-E522B25A8300\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:1.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"139F899A-6652-42C2-8729-F28C63B60DBA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:1.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D65D943-3954-4C65-BCFE-993ABE20136B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:1.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2ECABA1F-7D64-4272-AA2E-801C9C5CFE67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:1.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C03AED3D-FA8B-4730-B9DA-CFFCEF29A891\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:1.6.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C3D7D5F8-89C1-4CFD-8959-E50F0AF50DD0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:1.6.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C1E1D4FA-C1D6-44E9-9326-DDFD16DE9ECF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:1.6.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8735662-1424-4F93-B3A3-8CB1D42F953F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:1.6.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"506DFDFF-1712-4B4A-814C-C8CAFB7B2EF9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:2.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4EA86F9-21F1-4FB1-9412-A0BC76190C24\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:2.0.0:milestone1:*:*:*:*:*:*\",\"matchCriteriaId\":\"BEFC3427-C311-4DC3-BFF7-0EE28706F729\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:2.0.0:milestone2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C4B2BB5-1535-45A3-9FB1-0B4E6D93234B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:2.0.0:milestone3:*:*:*:*:*:*\",\"matchCriteriaId\":\"5BD846E7-8B3D-42D9-AA9C-26F2F9ACCE1D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:2.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"735DED49-ECF3-4DFE-8BF6-D47A9BA76AC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:2.10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8DB96EF4-A413-4632-9D5E-8A22483E4329\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:2.10.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D26D7344-D86B-4BD8-97A5-F33DDCE825D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:2.10.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8C16CB0-F061-49FA-81FF-4698E0AB6C75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:2.10.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"753E5480-95BE-47D5-A020-0A7B95B41A4C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:2.10.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"02D4E217-4934-40FF-B797-2697625C4A69\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:2.10.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7E717996-F17E-4D82-8C18-D8590ECC8AB6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:2.10.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"43EC45F1-F990-4D58-90D7-86E7FE57B116\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:2.10.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1D65BD5-BCCA-4C69-A9A4-E322AEBEE6F7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:2.11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6392BFDC-B18A-435D-A296-36CCF0AF6CF2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:2.11.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"86CF9343-8A2C-40AB-88EC-266CB971A7D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:2.11.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E6386086-1DDB-4FE9-A6A3-10B3071B1A48\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:2.12.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D8DD9514-FCDD-4BFE-A1FD-1A44E07671FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:2.12.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8899BFF7-4077-46D4-BC20-B8FC31D76BA8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:camel:2.12.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9C90E281-33F1-4010-A5A4-CB551C2B59C6\"}]}]}],\"references\":[{\"url\":\"http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2014-0371.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2014-0372.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/57125\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/57716\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/57719\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securityfocus.com/bid/65901\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2014-0371.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2014-0372.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/57125\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/57716\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/57719\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/65901\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
FKIE_CVE-2014-0002
Vulnerability from fkie_nvd - Published: 2014-03-21 04:38 - Updated: 2025-04-12 10:46
Severity ?
Summary
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| apache | camel | * | |
| apache | camel | 1.0.0 | |
| apache | camel | 1.1.0 | |
| apache | camel | 1.2.0 | |
| apache | camel | 1.3.0 | |
| apache | camel | 1.4.0 | |
| apache | camel | 1.5.0 | |
| apache | camel | 1.6.0 | |
| apache | camel | 1.6.1 | |
| apache | camel | 1.6.2 | |
| apache | camel | 1.6.3 | |
| apache | camel | 1.6.4 | |
| apache | camel | 2.0.0 | |
| apache | camel | 2.0.0 | |
| apache | camel | 2.0.0 | |
| apache | camel | 2.0.0 | |
| apache | camel | 2.1.0 | |
| apache | camel | 2.10.0 | |
| apache | camel | 2.10.1 | |
| apache | camel | 2.10.2 | |
| apache | camel | 2.10.3 | |
| apache | camel | 2.10.4 | |
| apache | camel | 2.10.5 | |
| apache | camel | 2.10.6 | |
| apache | camel | 2.10.7 | |
| apache | camel | 2.11.0 | |
| apache | camel | 2.11.1 | |
| apache | camel | 2.11.2 | |
| apache | camel | 2.12.0 | |
| apache | camel | 2.12.1 | |
| apache | camel | 2.12.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "23ED67A5-FBB0-4151-A7C4-D7F9A82D9753",
"versionEndIncluding": "2.11.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:1.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0B06E9C0-DB2D-41D6-98C4-93D973929523",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:1.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A1BC313E-5651-4FBB-B9E6-E66DBA0139D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "83727178-A7C0-4C88-A148-E522B25A8300",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:1.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "139F899A-6652-42C2-8729-F28C63B60DBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:1.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1D65D943-3954-4C65-BCFE-993ABE20136B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:1.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2ECABA1F-7D64-4272-AA2E-801C9C5CFE67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:1.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C03AED3D-FA8B-4730-B9DA-CFFCEF29A891",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:1.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3D7D5F8-89C1-4CFD-8959-E50F0AF50DD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:1.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C1E1D4FA-C1D6-44E9-9326-DDFD16DE9ECF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:1.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "B8735662-1424-4F93-B3A3-8CB1D42F953F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:1.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "506DFDFF-1712-4B4A-814C-C8CAFB7B2EF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F4EA86F9-21F1-4FB1-9412-A0BC76190C24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:2.0.0:milestone1:*:*:*:*:*:*",
"matchCriteriaId": "BEFC3427-C311-4DC3-BFF7-0EE28706F729",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:2.0.0:milestone2:*:*:*:*:*:*",
"matchCriteriaId": "0C4B2BB5-1535-45A3-9FB1-0B4E6D93234B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:2.0.0:milestone3:*:*:*:*:*:*",
"matchCriteriaId": "5BD846E7-8B3D-42D9-AA9C-26F2F9ACCE1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:2.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "735DED49-ECF3-4DFE-8BF6-D47A9BA76AC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:2.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8DB96EF4-A413-4632-9D5E-8A22483E4329",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:2.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D26D7344-D86B-4BD8-97A5-F33DDCE825D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:2.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E8C16CB0-F061-49FA-81FF-4698E0AB6C75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:2.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "753E5480-95BE-47D5-A020-0A7B95B41A4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:2.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "02D4E217-4934-40FF-B797-2697625C4A69",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:2.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7E717996-F17E-4D82-8C18-D8590ECC8AB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:2.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "43EC45F1-F990-4D58-90D7-86E7FE57B116",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:2.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D65BD5-BCCA-4C69-A9A4-E322AEBEE6F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6392BFDC-B18A-435D-A296-36CCF0AF6CF2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:2.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "86CF9343-8A2C-40AB-88EC-266CB971A7D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:2.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E6386086-1DDB-4FE9-A6A3-10B3071B1A48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:camel:2.12.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D8DD9514-FCDD-4BFE-A1FD-1A44E07671FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:2.12.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8899BFF7-4077-46D4-BC20-B8FC31D76BA8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:camel:2.12.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9C90E281-33F1-4010-A5A4-CB551C2B59C6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."
},
{
"lang": "es",
"value": "El componente XSLT en Apache Camel anterior a 2.11.4 y 2.12.x anterior a 2.12.3 permite a atacantes remotos leer archivos arbitrarios y posiblemente tener otro impacto no especificado a trav\u00e9s de un documento XML que contiene una declaraci\u00f3n de entidad externa en conjunci\u00f3n con una referencia de entidad, relacionado con un problema de XML External Entity (XXE)."
}
],
"id": "CVE-2014-0002",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-03-21T04:38:59.027",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"
},
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0371.html"
},
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0372.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/57125"
},
{
"source": "secalert@redhat.com",
"url": "http://secunia.com/advisories/57716"
},
{
"source": "secalert@redhat.com",
"url": "http://secunia.com/advisories/57719"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/65901"
},
{
"source": "secalert@redhat.com",
"url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E"
},
{
"source": "secalert@redhat.com",
"url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0371.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0372.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/57125"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/57716"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/57719"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/65901"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
RHSA-2014_0452
Vulnerability from csaf_redhat - Published: 2014-04-30 18:49 - Updated: 2024-11-22 07:50Summary
Red Hat Security Advisory: Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update
Notes
Topic
Fuse ESB Enterprise/MQ Enterprise 7.1.0 R1 P3 (Patch 3 on Rollup Patch 1),
which addresses several security issues and contains multiple bug fixes, is
now available from the Red Hat Customer Portal.
The Red Hat Security Response Team has rated this update as having
Important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
Details
Fuse ESB Enterprise is an integration platform based on Apache ServiceMix.
Fuse MQ Enterprise, based on Apache ActiveMQ, is a standards-compliant
messaging system that is tailored for use in mission critical applications.
This release of Fuse ESB Enterprise/MQ Enterprise 7.1.0 R1 P3 is an update
to Fuse ESB Enterprise 7.1.0 and Fuse MQ Enterprise 7.1.0. It includes
various bug fixes, which are listed in the README file included with the
patch files.
The following security issues are also addressed with this release:
It was found that XStream could deserialize arbitrary user-supplied XML
content, representing objects of any type. A remote attacker able to pass
XML to XStream could use this flaw to perform a variety of attacks,
including remote code execution in the context of the server running the
XStream application. (CVE-2013-7285)
It was found that the Apache Camel XSLT component allowed XSL stylesheets
to call external Java methods. A remote attacker able to submit messages to
a Camel route could use this flaw to perform arbitrary remote code
execution in the context of the Camel server process. (CVE-2014-0003)
It was found that the ParserPool and Decrypter classes in the OpenSAML Java
implementation resolved external entities, permitting XML External Entity
(XXE) attacks. A remote attacker could use this flaw to read files
accessible to the user running the application server and, potentially,
perform other more advanced XXE attacks. (CVE-2013-6440)
It was found that the Apache Camel XSLT component would resolve entities in
XML messages when transforming them using an XSLT route. A remote attacker
able to submit messages to an XSLT Camel route could use this flaw to read
files accessible to the user running the application server and,
potentially, perform other more advanced XXE attacks. (CVE-2014-0002)
A denial of service flaw was found in the way Apache Commons FileUpload
handled small-sized buffers used by MultipartStream. A remote attacker
could use this flaw to create a malformed Content-Type header for a
multipart request, causing Apache Commons FileUpload to enter an infinite
loop when processing such an incoming request. (CVE-2014-0050)
The CVE-2014-0002 and CVE-2014-0003 issues were discovered by David Jorm of
the Red Hat Security Response Team, and the CVE-2013-6440 issue was
discovered by David Illsley, Ron Gutierrez of Gotham Digital Science, and
David Jorm of the Red Hat Security Response Team.
All users of Fuse ESB Enterprise/MQ Enterprise 7.1.0 as provided from the
Red Hat Customer Portal are advised to upgrade to Fuse ESB Enterprise/MQ
Enterprise 7.1.0 R1 P3.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Fuse ESB Enterprise/MQ Enterprise 7.1.0 R1 P3 (Patch 3 on Rollup Patch 1),\nwhich addresses several security issues and contains multiple bug fixes, is\nnow available from the Red Hat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nImportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Fuse ESB Enterprise is an integration platform based on Apache ServiceMix.\nFuse MQ Enterprise, based on Apache ActiveMQ, is a standards-compliant\nmessaging system that is tailored for use in mission critical applications.\n\nThis release of Fuse ESB Enterprise/MQ Enterprise 7.1.0 R1 P3 is an update\nto Fuse ESB Enterprise 7.1.0 and Fuse MQ Enterprise 7.1.0. It includes\nvarious bug fixes, which are listed in the README file included with the\npatch files.\n\nThe following security issues are also addressed with this release:\n\nIt was found that XStream could deserialize arbitrary user-supplied XML\ncontent, representing objects of any type. A remote attacker able to pass\nXML to XStream could use this flaw to perform a variety of attacks,\nincluding remote code execution in the context of the server running the\nXStream application. (CVE-2013-7285)\n\nIt was found that the Apache Camel XSLT component allowed XSL stylesheets\nto call external Java methods. A remote attacker able to submit messages to\na Camel route could use this flaw to perform arbitrary remote code\nexecution in the context of the Camel server process. (CVE-2014-0003)\n\nIt was found that the ParserPool and Decrypter classes in the OpenSAML Java\nimplementation resolved external entities, permitting XML External Entity\n(XXE) attacks. A remote attacker could use this flaw to read files\naccessible to the user running the application server and, potentially,\nperform other more advanced XXE attacks. (CVE-2013-6440)\n\nIt was found that the Apache Camel XSLT component would resolve entities in\nXML messages when transforming them using an XSLT route. A remote attacker\nable to submit messages to an XSLT Camel route could use this flaw to read\nfiles accessible to the user running the application server and,\npotentially, perform other more advanced XXE attacks. (CVE-2014-0002)\n\nA denial of service flaw was found in the way Apache Commons FileUpload\nhandled small-sized buffers used by MultipartStream. A remote attacker\ncould use this flaw to create a malformed Content-Type header for a\nmultipart request, causing Apache Commons FileUpload to enter an infinite\nloop when processing such an incoming request. (CVE-2014-0050)\n\nThe CVE-2014-0002 and CVE-2014-0003 issues were discovered by David Jorm of\nthe Red Hat Security Response Team, and the CVE-2013-6440 issue was\ndiscovered by David Illsley, Ron Gutierrez of Gotham Digital Science, and\nDavid Jorm of the Red Hat Security Response Team.\n\nAll users of Fuse ESB Enterprise/MQ Enterprise 7.1.0 as provided from the\nRed Hat Customer Portal are advised to upgrade to Fuse ESB Enterprise/MQ\nEnterprise 7.1.0 R1 P3.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0452",
"url": "https://access.redhat.com/errata/RHSA-2014:0452"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.esb.enterprise\u0026downloadType=securityPatches\u0026version=7.1.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.esb.enterprise\u0026downloadType=securityPatches\u0026version=7.1.0"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.mq.enterprise\u0026downloadType=securityPatches\u0026version=7.1.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.mq.enterprise\u0026downloadType=securityPatches\u0026version=7.1.0"
},
{
"category": "external",
"summary": "1043332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1043332"
},
{
"category": "external",
"summary": "1049675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
},
{
"category": "external",
"summary": "1049692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
},
{
"category": "external",
"summary": "1051277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
},
{
"category": "external",
"summary": "1062337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0452.json"
}
],
"title": "Red Hat Security Advisory: Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update",
"tracking": {
"current_release_date": "2024-11-22T07:50:58+00:00",
"generator": {
"date": "2024-11-22T07:50:58+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2014:0452",
"initial_release_date": "2014-04-30T18:49:57+00:00",
"revision_history": [
{
"date": "2014-04-30T18:49:57+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2014-04-30T18:49:57+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T07:50:58+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Fuse ESB Enterprise 7.1.0",
"product": {
"name": "Fuse ESB Enterprise 7.1.0",
"product_id": "Fuse ESB Enterprise 7.1.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:fuse_esb_enterprise:7.1.0"
}
}
},
{
"category": "product_name",
"name": "Fuse Management Console 7.1.0",
"product": {
"name": "Fuse Management Console 7.1.0",
"product_id": "Fuse Management Console 7.1.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:fuse_management_console:7.1.0"
}
}
},
{
"category": "product_name",
"name": "Fuse MQ Enterprise 7.1.0",
"product": {
"name": "Fuse MQ Enterprise 7.1.0",
"product_id": "Fuse MQ Enterprise 7.1.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:fuse_mq_enterprise:7.1.0"
}
}
}
],
"category": "product_family",
"name": "Fuse Enterprise Middleware"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"David Illsley"
]
},
{
"names": [
"Ron Gutierrez"
],
"organization": "Gotham Digital Science"
},
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2013-6440",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2013-12-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1043332"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the ParserPool and Decrypter classes in the OpenSAML Java implementation resolved external entities, permitting XML External Entity (XXE) attacks. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Java: XML eXternal Entity (XXE) flaw in ParserPool and Decrypter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-6440"
},
{
"category": "external",
"summary": "RHBZ#1043332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1043332"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-6440",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6440"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6440",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6440"
},
{
"category": "external",
"summary": "http://blog.sendsafely.com/post/69590974866/web-based-single-sign-on-and-the-dangers-of-saml-xml",
"url": "http://blog.sendsafely.com/post/69590974866/web-based-single-sign-on-and-the-dangers-of-saml-xml"
}
],
"release_date": "2013-12-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-30T18:49:57+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
"product_ids": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0452"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Java: XML eXternal Entity (XXE) flaw in ParserPool and Decrypter"
},
{
"cve": "CVE-2013-7285",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2013-12-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1051277"
}
],
"notes": [
{
"category": "description",
"text": "It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "XStream: remote code execution due to insecure XML deserialization",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-7285"
},
{
"category": "external",
"summary": "RHBZ#1051277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-7285",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-7285"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285"
},
{
"category": "external",
"summary": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html",
"url": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html"
},
{
"category": "external",
"summary": "http://xstream.codehaus.org/security.html",
"url": "http://xstream.codehaus.org/security.html"
},
{
"category": "external",
"summary": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/",
"url": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/"
}
],
"release_date": "2013-12-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-30T18:49:57+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
"product_ids": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0452"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "XStream: remote code execution due to insecure XML deserialization"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0002",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049675"
}
],
"notes": [
{
"category": "description",
"text": "The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: XML eXternal Entity (XXE) flaw in XSLT component",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0002"
},
{
"category": "external",
"summary": "RHBZ#1049675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0002",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002"
},
{
"category": "external",
"summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"
}
],
"release_date": "2014-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-30T18:49:57+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
"product_ids": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0452"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Camel: XML eXternal Entity (XXE) flaw in XSLT component"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0003",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049692"
}
],
"notes": [
{
"category": "description",
"text": "The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: remote code execution via XSL",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0003"
},
{
"category": "external",
"summary": "RHBZ#1049692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0003",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0003"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003"
},
{
"category": "external",
"summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc"
}
],
"release_date": "2014-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-30T18:49:57+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
"product_ids": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0452"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Camel: remote code execution via XSL"
},
{
"cve": "CVE-2014-0050",
"discovery_date": "2014-02-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1062337"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in the way Apache Commons FileUpload, which is embedded in Tomcat and JBoss Web, handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing Tomcat to enter an infinite loop when processing such an incoming request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0050"
},
{
"category": "external",
"summary": "RHBZ#1062337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0050",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0050"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050"
}
],
"release_date": "2014-02-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-30T18:49:57+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
"product_ids": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0452"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream"
}
]
}
RHSA-2014_0323
Vulnerability from csaf_redhat - Published: 2014-03-24 18:05 - Updated: 2024-11-22 07:39Summary
Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.0.0 security update
Notes
Topic
Red Hat JBoss Fuse and A-MQ 6.0.0 R1 P3 (Patch 3 on Rollup Patch 1), which
addresses three security issues and contains several bug fixes, is now
available from the Red Hat Customer Portal.
The Red Hat Security Response Team has rated this update as having
Important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
Details
Red Hat JBoss Fuse 6.0.0 is an integration platform based on Apache
ServiceMix. Red Hat JBoss A-MQ 6.0.0, based on Apache ActiveMQ, is a
standards compliant messaging system that is tailored for use in mission
critical applications.
This patch is an update to Red Hat JBoss Fuse 6.0.0 and Red Hat JBoss A-MQ
6.0.0. It includes bug fixes, which are documented in the readme file
included with the patch files.
The following security issues are fixed with this release:
It was found that XStream could deserialize arbitrary user-supplied XML
content, representing objects of any type. A remote attacker able to pass
XML to XStream could use this flaw to perform a variety of attacks,
including remote code execution in the context of the server running the
XStream application. (CVE-2013-7285)
It was found that the Apache Camel XSLT component allowed XSL stylesheets
to call external Java methods. A remote attacker able to submit messages to
a Camel route could use this flaw to perform arbitrary remote code
execution in the context of the Camel server process. (CVE-2014-0003)
It was found that the Apache Camel XSLT component would resolve entities in
XML messages when transforming them using an XSLT route. A remote attacker
able to submit messages to an XSLT Camel route could use this flaw to read
files accessible to the user running the application server and,
potentially, perform other more advanced XML External Entity (XXE) attacks.
(CVE-2014-0002)
The CVE-2014-0003 and CVE-2014-0002 issues were discovered by David Jorm of
the Red Hat Security Response Team.
All users of Red Hat JBoss Fuse 6.0.0 and Red Hat JBoss A-MQ 6.0.0 as
provided from the Red Hat Customer Portal are advised to apply this patch.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Fuse and A-MQ 6.0.0 R1 P3 (Patch 3 on Rollup Patch 1), which\naddresses three security issues and contains several bug fixes, is now\navailable from the Red Hat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nImportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Fuse 6.0.0 is an integration platform based on Apache\nServiceMix. Red Hat JBoss A-MQ 6.0.0, based on Apache ActiveMQ, is a\nstandards compliant messaging system that is tailored for use in mission\ncritical applications.\n\nThis patch is an update to Red Hat JBoss Fuse 6.0.0 and Red Hat JBoss A-MQ\n6.0.0. It includes bug fixes, which are documented in the readme file\nincluded with the patch files.\n\nThe following security issues are fixed with this release:\n\nIt was found that XStream could deserialize arbitrary user-supplied XML\ncontent, representing objects of any type. A remote attacker able to pass\nXML to XStream could use this flaw to perform a variety of attacks,\nincluding remote code execution in the context of the server running the\nXStream application. (CVE-2013-7285)\n\nIt was found that the Apache Camel XSLT component allowed XSL stylesheets\nto call external Java methods. A remote attacker able to submit messages to\na Camel route could use this flaw to perform arbitrary remote code\nexecution in the context of the Camel server process. (CVE-2014-0003)\n\nIt was found that the Apache Camel XSLT component would resolve entities in\nXML messages when transforming them using an XSLT route. A remote attacker\nable to submit messages to an XSLT Camel route could use this flaw to read\nfiles accessible to the user running the application server and,\npotentially, perform other more advanced XML External Entity (XXE) attacks.\n(CVE-2014-0002)\n\nThe CVE-2014-0003 and CVE-2014-0002 issues were discovered by David Jorm of\nthe Red Hat Security Response Team.\n\nAll users of Red Hat JBoss Fuse 6.0.0 and Red Hat JBoss A-MQ 6.0.0 as\nprovided from the Red Hat Customer Portal are advised to apply this patch.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0323",
"url": "https://access.redhat.com/errata/RHSA-2014:0323"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.0.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.0.0"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=securityPatches\u0026version=6.0.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=securityPatches\u0026version=6.0.0"
},
{
"category": "external",
"summary": "1049675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
},
{
"category": "external",
"summary": "1049692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
},
{
"category": "external",
"summary": "1051277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0323.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.0.0 security update",
"tracking": {
"current_release_date": "2024-11-22T07:39:01+00:00",
"generator": {
"date": "2024-11-22T07:39:01+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2014:0323",
"initial_release_date": "2014-03-24T18:05:04+00:00",
"revision_history": [
{
"date": "2014-03-24T18:05:04+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:32:42+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T07:39:01+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss A-MQ 6.0",
"product": {
"name": "Red Hat JBoss A-MQ 6.0",
"product_id": "Red Hat JBoss A-MQ 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_amq:6.0.0"
}
}
},
{
"category": "product_name",
"name": "Red Hat JBoss Fuse 6.0",
"product": {
"name": "Red Hat JBoss Fuse 6.0",
"product_id": "Red Hat JBoss Fuse 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_fuse:6.0.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Fuse"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2013-7285",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2013-12-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1051277"
}
],
"notes": [
{
"category": "description",
"text": "It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "XStream: remote code execution due to insecure XML deserialization",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss A-MQ 6.0",
"Red Hat JBoss Fuse 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-7285"
},
{
"category": "external",
"summary": "RHBZ#1051277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-7285",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-7285"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285"
},
{
"category": "external",
"summary": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html",
"url": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html"
},
{
"category": "external",
"summary": "http://xstream.codehaus.org/security.html",
"url": "http://xstream.codehaus.org/security.html"
},
{
"category": "external",
"summary": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/",
"url": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/"
}
],
"release_date": "2013-12-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-03-24T18:05:04+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the update).",
"product_ids": [
"Red Hat JBoss A-MQ 6.0",
"Red Hat JBoss Fuse 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0323"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss A-MQ 6.0",
"Red Hat JBoss Fuse 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "XStream: remote code execution due to insecure XML deserialization"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0002",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049675"
}
],
"notes": [
{
"category": "description",
"text": "The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: XML eXternal Entity (XXE) flaw in XSLT component",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss A-MQ 6.0",
"Red Hat JBoss Fuse 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0002"
},
{
"category": "external",
"summary": "RHBZ#1049675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0002",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002"
},
{
"category": "external",
"summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"
}
],
"release_date": "2014-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-03-24T18:05:04+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the update).",
"product_ids": [
"Red Hat JBoss A-MQ 6.0",
"Red Hat JBoss Fuse 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0323"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss A-MQ 6.0",
"Red Hat JBoss Fuse 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Camel: XML eXternal Entity (XXE) flaw in XSLT component"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0003",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049692"
}
],
"notes": [
{
"category": "description",
"text": "The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: remote code execution via XSL",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss A-MQ 6.0",
"Red Hat JBoss Fuse 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0003"
},
{
"category": "external",
"summary": "RHBZ#1049692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0003",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0003"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003"
},
{
"category": "external",
"summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc"
}
],
"release_date": "2014-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-03-24T18:05:04+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the update).",
"product_ids": [
"Red Hat JBoss A-MQ 6.0",
"Red Hat JBoss Fuse 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0323"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss A-MQ 6.0",
"Red Hat JBoss Fuse 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Camel: remote code execution via XSL"
}
]
}
RHSA-2014_0459
Vulnerability from csaf_redhat - Published: 2014-04-30 19:00 - Updated: 2024-12-08 10:41Summary
Red Hat Security Advisory: Red Hat JBoss Fuse Service Works 6.0.0 security update
Notes
Topic
Red Hat JBoss Fuse Service Works 6.0.0 roll up patch 1, which fixes
multiple security issues and various bugs, is now available from the Red
Hat Customer Portal.
The Red Hat Security Response Team has rated this update as having
Important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
Details
Red Hat JBoss Fuse Service Works is the next-generation ESB and business
process automation infrastructure. Red Hat JBoss Fuse Service Works allows
IT to leverage existing (MoM and EAI), modern (SOA and BPM-Rules), and
future (EDA and CEP) integration methodologies to dramatically improve
business process execution speed and quality.
This roll up patch serves as a cumulative upgrade for Red Hat JBoss Fuse
Service Works 6.0.0. It includes various bug fixes, which are listed in the
README file included with the patch files.
The following security issues are also fixed with this release:
It was found that the Apache Camel XSLT component allowed XSL stylesheets
to call external Java methods. A remote attacker able to submit messages to
a Camel route could use this flaw to perform arbitrary remote code
execution in the context of the Camel server process. (CVE-2014-0003)
It was found that when JBoss Web processed a series of HTTP requests in
which at least one request contained either multiple content-length
headers, or one content-length header with a chunked transfer-encoding
header, JBoss Web would incorrectly handle the request. A remote attacker
could use this flaw to poison a web cache, perform cross-site scripting
(XSS) attacks, or obtain sensitive information from other requests.
(CVE-2013-4286)
It was found that the Apache Camel XSLT component would resolve entities in
XML messages when transforming them using an XSLT route. A remote attacker
able to submit messages to an XSLT Camel route could use this flaw to read
files accessible to the user running the application server and,
potentially, perform other more advanced XML External Entity (XXE) attacks.
(CVE-2014-0002)
A denial of service flaw was found in the way Apache Commons FileUpload,
which is embedded in the JBoss Web component of JBoss EAP, handled
small-sized buffers used by MultipartStream. A remote attacker could use
this flaw to create a malformed Content-Type header for a multipart
request, causing JBoss Web to enter an infinite loop when processing such
an incoming request. (CVE-2014-0050)
The CVE-2014-0002 and CVE-2014-0003 issues were discovered by David Jorm of
the Red Hat Security Response Team.
All users of Red Hat JBoss Fuse Service Works 6.0.0 as provided from the
Red Hat Customer Portal are advised to apply this roll up patch.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Fuse Service Works 6.0.0 roll up patch 1, which fixes\nmultiple security issues and various bugs, is now available from the Red\nHat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nImportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Fuse Service Works is the next-generation ESB and business\nprocess automation infrastructure. Red Hat JBoss Fuse Service Works allows\nIT to leverage existing (MoM and EAI), modern (SOA and BPM-Rules), and\nfuture (EDA and CEP) integration methodologies to dramatically improve\nbusiness process execution speed and quality.\n\nThis roll up patch serves as a cumulative upgrade for Red Hat JBoss Fuse\nService Works 6.0.0. It includes various bug fixes, which are listed in the\nREADME file included with the patch files.\n\nThe following security issues are also fixed with this release:\n\nIt was found that the Apache Camel XSLT component allowed XSL stylesheets\nto call external Java methods. A remote attacker able to submit messages to\na Camel route could use this flaw to perform arbitrary remote code\nexecution in the context of the Camel server process. (CVE-2014-0003)\n\nIt was found that when JBoss Web processed a series of HTTP requests in\nwhich at least one request contained either multiple content-length\nheaders, or one content-length header with a chunked transfer-encoding\nheader, JBoss Web would incorrectly handle the request. A remote attacker\ncould use this flaw to poison a web cache, perform cross-site scripting\n(XSS) attacks, or obtain sensitive information from other requests.\n(CVE-2013-4286)\n\nIt was found that the Apache Camel XSLT component would resolve entities in\nXML messages when transforming them using an XSLT route. A remote attacker\nable to submit messages to an XSLT Camel route could use this flaw to read\nfiles accessible to the user running the application server and,\npotentially, perform other more advanced XML External Entity (XXE) attacks.\n(CVE-2014-0002)\n\nA denial of service flaw was found in the way Apache Commons FileUpload,\nwhich is embedded in the JBoss Web component of JBoss EAP, handled\nsmall-sized buffers used by MultipartStream. A remote attacker could use\nthis flaw to create a malformed Content-Type header for a multipart\nrequest, causing JBoss Web to enter an infinite loop when processing such\nan incoming request. (CVE-2014-0050)\n\nThe CVE-2014-0002 and CVE-2014-0003 issues were discovered by David Jorm of\nthe Red Hat Security Response Team.\n\nAll users of Red Hat JBoss Fuse Service Works 6.0.0 as provided from the\nRed Hat Customer Portal are advised to apply this roll up patch.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0459",
"url": "https://access.redhat.com/errata/RHSA-2014:0459"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse.serviceworks\u0026downloadType=securityPatches\u0026version=6.0.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse.serviceworks\u0026downloadType=securityPatches\u0026version=6.0.0"
},
{
"category": "external",
"summary": "1049675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
},
{
"category": "external",
"summary": "1049692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
},
{
"category": "external",
"summary": "1062337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
},
{
"category": "external",
"summary": "1069921",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0459.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Fuse Service Works 6.0.0 security update",
"tracking": {
"current_release_date": "2024-12-08T10:41:06+00:00",
"generator": {
"date": "2024-12-08T10:41:06+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.3"
}
},
"id": "RHSA-2014:0459",
"initial_release_date": "2014-04-30T19:00:31+00:00",
"revision_history": [
{
"date": "2014-04-30T19:00:31+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:32:11+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-12-08T10:41:06+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Fuse Service Works 6.0",
"product": {
"name": "Red Hat JBoss Fuse Service Works 6.0",
"product_id": "Red Hat JBoss Fuse Service Works 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_fuse_service_works:6.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Fuse Service Works"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2013-4286",
"discovery_date": "2014-02-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1069921"
}
],
"notes": [
{
"category": "description",
"text": "It was found that when Tomcat / JBoss Web processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encoding header, Tomcat / JBoss Web would incorrectly handle the request. A remote attacker could use this flaw to poison a web cache, perform cross-site scripting (XSS) attacks, or obtain sensitive information from other requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: multiple content-length header poisoning flaws",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4286"
},
{
"category": "external",
"summary": "RHBZ#1069921",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4286",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4286"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286"
}
],
"release_date": "2014-02-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-30T19:00:31+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0459"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: multiple content-length header poisoning flaws"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0002",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049675"
}
],
"notes": [
{
"category": "description",
"text": "The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: XML eXternal Entity (XXE) flaw in XSLT component",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0002"
},
{
"category": "external",
"summary": "RHBZ#1049675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0002",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002"
},
{
"category": "external",
"summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"
}
],
"release_date": "2014-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-30T19:00:31+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0459"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Camel: XML eXternal Entity (XXE) flaw in XSLT component"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0003",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049692"
}
],
"notes": [
{
"category": "description",
"text": "The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: remote code execution via XSL",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0003"
},
{
"category": "external",
"summary": "RHBZ#1049692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0003",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0003"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003"
},
{
"category": "external",
"summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc"
}
],
"release_date": "2014-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-30T19:00:31+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0459"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Camel: remote code execution via XSL"
},
{
"cve": "CVE-2014-0050",
"discovery_date": "2014-02-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1062337"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in the way Apache Commons FileUpload, which is embedded in Tomcat and JBoss Web, handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing Tomcat to enter an infinite loop when processing such an incoming request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0050"
},
{
"category": "external",
"summary": "RHBZ#1062337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0050",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0050"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050"
}
],
"release_date": "2014-02-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-30T19:00:31+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0459"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream"
}
]
}
RHSA-2014:0371
Vulnerability from csaf_redhat - Published: 2014-04-03 21:19 - Updated: 2025-11-21 17:47Summary
Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.0.1 update
Notes
Topic
Red Hat JBoss BPM Suite 6.0.1, which fixes multiple security issues,
various bugs, and adds enhancements, is now available from the Red Hat
Customer Portal.
The Red Hat Security Response Team has rated this update as having
Important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
Details
Red Hat JBoss BPM Suite is a business rules management system for the
management, storage, creation, modification, and deployment of JBoss rules.
This release of Red Hat JBoss BPM Suite 6.0.1 serves as a replacement for
Red Hat JBoss BPM Suite 6.0.0, and includes bug fixes and enhancements.
Refer to the Red Hat JBoss BPM Suite 6.0.1 Release Notes for information on
the most significant of these changes. The Release Notes will be available
at https://access.redhat.com/site/documentation/Red_Hat_JBoss_BPM_Suite/
The following security issues are fixed with this release:
It was discovered that JBoss BPM Suite allowed remote authenticated users
to submit arbitrary Java code in MVFLEX Expression Language (MVEL) or JBoss
Rules expressions, resulting in arbitrary code execution within the
security context of the application server. Refer to the Solution section
for details on the fix for this issue. (CVE-2013-6468)
It was found that XStream could deserialize arbitrary user-supplied XML
content, representing objects of any type. A remote attacker able to pass
XML to XStream could use this flaw to perform a variety of attacks,
including remote code execution in the context of the server running the
XStream application. (CVE-2013-7285)
It was found that the Apache Camel XSLT component allowed XSL stylesheets
to call external Java methods. A remote attacker able to submit messages to
a Camel route could use this flaw to perform arbitrary remote code
execution in the context of the Camel server process. (CVE-2014-0003)
It was found that RESTEasy was vulnerable to XML External Entity (XXE)
attacks. If a remote attacker submitted a request containing an external
XML entity to a RESTEasy endpoint, the entity would be resolved, allowing
the attacker to read files accessible to the user running the application
server. This flaw affected DOM (Document Object Model) Document and JAXB
(Java Architecture for XML Binding) input. (CVE-2011-5245, CVE-2012-0818)
It was discovered that bouncycastle leaked timing information when
decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites
were used. A remote attacker could possibly use this flaw to retrieve plain
text from the encrypted packets by using a TLS/SSL server as a padding
oracle. (CVE-2013-1624)
It was found that the Apache Camel XSLT component would resolve entities in
XML messages when transforming them using an XSLT route. A remote attacker
able to submit messages to an XSLT Camel route could use this flaw to read
files accessible to the user running the application server and,
potentially, perform other more advanced XML External Entity (XXE) attacks.
(CVE-2014-0002)
The CVE-2014-0002 and CVE-2014-0003 issues were discovered by David Jorm of
the Red Hat Security Response Team, and the CVE-2013-6468 issue was
discovered by Marc Schoenefeld of the Red Hat Security Response Team.
Red Hat would like to thank Grégory Draperi for independently reporting
CVE-2013-6468.
All users of Red Hat JBoss BPM Suite 6.0.0 as provided from the Red Hat
Customer Portal are advised to upgrade to Red Hat JBoss BPM Suite 6.0.1.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss BPM Suite 6.0.1, which fixes multiple security issues,\nvarious bugs, and adds enhancements, is now available from the Red Hat\nCustomer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nImportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss BPM Suite is a business rules management system for the\nmanagement, storage, creation, modification, and deployment of JBoss rules.\n\nThis release of Red Hat JBoss BPM Suite 6.0.1 serves as a replacement for\nRed Hat JBoss BPM Suite 6.0.0, and includes bug fixes and enhancements.\nRefer to the Red Hat JBoss BPM Suite 6.0.1 Release Notes for information on\nthe most significant of these changes. The Release Notes will be available\nat https://access.redhat.com/site/documentation/Red_Hat_JBoss_BPM_Suite/\n\nThe following security issues are fixed with this release:\n\nIt was discovered that JBoss BPM Suite allowed remote authenticated users\nto submit arbitrary Java code in MVFLEX Expression Language (MVEL) or JBoss\nRules expressions, resulting in arbitrary code execution within the\nsecurity context of the application server. Refer to the Solution section\nfor details on the fix for this issue. (CVE-2013-6468)\n\nIt was found that XStream could deserialize arbitrary user-supplied XML\ncontent, representing objects of any type. A remote attacker able to pass\nXML to XStream could use this flaw to perform a variety of attacks,\nincluding remote code execution in the context of the server running the\nXStream application. (CVE-2013-7285)\n\nIt was found that the Apache Camel XSLT component allowed XSL stylesheets\nto call external Java methods. A remote attacker able to submit messages to\na Camel route could use this flaw to perform arbitrary remote code\nexecution in the context of the Camel server process. (CVE-2014-0003)\n\nIt was found that RESTEasy was vulnerable to XML External Entity (XXE)\nattacks. If a remote attacker submitted a request containing an external\nXML entity to a RESTEasy endpoint, the entity would be resolved, allowing\nthe attacker to read files accessible to the user running the application\nserver. This flaw affected DOM (Document Object Model) Document and JAXB\n(Java Architecture for XML Binding) input. (CVE-2011-5245, CVE-2012-0818)\n\nIt was discovered that bouncycastle leaked timing information when\ndecrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites\nwere used. A remote attacker could possibly use this flaw to retrieve plain\ntext from the encrypted packets by using a TLS/SSL server as a padding\noracle. (CVE-2013-1624)\n\nIt was found that the Apache Camel XSLT component would resolve entities in\nXML messages when transforming them using an XSLT route. A remote attacker\nable to submit messages to an XSLT Camel route could use this flaw to read\nfiles accessible to the user running the application server and,\npotentially, perform other more advanced XML External Entity (XXE) attacks.\n(CVE-2014-0002)\n\nThe CVE-2014-0002 and CVE-2014-0003 issues were discovered by David Jorm of\nthe Red Hat Security Response Team, and the CVE-2013-6468 issue was\ndiscovered by Marc Schoenefeld of the Red Hat Security Response Team.\n\nRed Hat would like to thank Gr\u00e9gory Draperi for independently reporting\nCVE-2013-6468.\n\nAll users of Red Hat JBoss BPM Suite 6.0.0 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss BPM Suite 6.0.1.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0371",
"url": "https://access.redhat.com/errata/RHSA-2014:0371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=distributions\u0026version=6.0.1",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=distributions\u0026version=6.0.1"
},
{
"category": "external",
"summary": "https://access.redhat.com/site/documentation/Red_Hat_JBoss_BPM_Suite/",
"url": "https://access.redhat.com/site/documentation/Red_Hat_JBoss_BPM_Suite/"
},
{
"category": "external",
"summary": "785631",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=785631"
},
{
"category": "external",
"summary": "908428",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=908428"
},
{
"category": "external",
"summary": "1049675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
},
{
"category": "external",
"summary": "1049692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
},
{
"category": "external",
"summary": "1051261",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051261"
},
{
"category": "external",
"summary": "1051277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
},
{
"category": "external",
"summary": "1058457",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1058457"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0371.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.0.1 update",
"tracking": {
"current_release_date": "2025-11-21T17:47:41+00:00",
"generator": {
"date": "2025-11-21T17:47:41+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2014:0371",
"initial_release_date": "2014-04-03T21:19:56+00:00",
"revision_history": [
{
"date": "2014-04-03T21:19:56+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:32:55+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T17:47:41+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss BPMS 6.0",
"product": {
"name": "Red Hat JBoss BPMS 6.0",
"product_id": "Red Hat JBoss BPMS 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_bpms:6.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Process Automation Manager"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2011-5245",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2012-01-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "785631"
}
],
"notes": [
{
"category": "description",
"text": "The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTEasy: XML eXternal Entity (XXE) flaw",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2011-5245"
},
{
"category": "external",
"summary": "RHBZ#785631",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=785631"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2011-5245",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-5245"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2011-5245",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-5245"
}
],
"release_date": "2011-12-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:19:56+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BPM Suite are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0371"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTEasy: XML eXternal Entity (XXE) flaw"
},
{
"cve": "CVE-2012-0818",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2012-01-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "785631"
}
],
"notes": [
{
"category": "description",
"text": "RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTEasy: XML eXternal Entity (XXE) flaw",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-0818"
},
{
"category": "external",
"summary": "RHBZ#785631",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=785631"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-0818",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-0818"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-0818",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0818"
}
],
"release_date": "2011-12-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:19:56+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BPM Suite are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0371"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTEasy: XML eXternal Entity (XXE) flaw"
},
{
"cve": "CVE-2013-1624",
"cwe": {
"id": "CWE-385",
"name": "Covert Timing Channel"
},
"discovery_date": "2013-02-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "908428"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that bouncycastle leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: TLS CBC padding timing attack",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-1624"
},
{
"category": "external",
"summary": "RHBZ#908428",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=908428"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-1624",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-1624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1624"
},
{
"category": "external",
"summary": "http://www.isg.rhul.ac.uk/tls/",
"url": "http://www.isg.rhul.ac.uk/tls/"
},
{
"category": "external",
"summary": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf",
"url": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf"
}
],
"release_date": "2013-02-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:19:56+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BPM Suite are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0371"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "bouncycastle: TLS CBC padding timing attack"
},
{
"acknowledgments": [
{
"names": [
"Marc Schoenefeld"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
},
{
"names": [
"Gr\u00e9gory Draperi"
]
}
],
"cve": "CVE-2013-6468",
"discovery_date": "2013-08-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1051261"
}
],
"notes": [
{
"category": "description",
"text": "JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a (1) MVFLEX Expression Language (MVEL) or (2) Drools expression.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Drools: Remote Java Code Execution in MVEL",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-6468"
},
{
"category": "external",
"summary": "RHBZ#1051261",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051261"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-6468",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6468"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6468",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6468"
}
],
"release_date": "2014-04-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:19:56+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BPM Suite are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0371"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Drools: Remote Java Code Execution in MVEL"
},
{
"cve": "CVE-2013-7285",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2013-12-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1051277"
}
],
"notes": [
{
"category": "description",
"text": "It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "XStream: remote code execution due to insecure XML deserialization",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-7285"
},
{
"category": "external",
"summary": "RHBZ#1051277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-7285",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-7285"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285"
},
{
"category": "external",
"summary": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html",
"url": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html"
},
{
"category": "external",
"summary": "http://xstream.codehaus.org/security.html",
"url": "http://xstream.codehaus.org/security.html"
},
{
"category": "external",
"summary": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/",
"url": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/"
}
],
"release_date": "2013-12-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:19:56+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BPM Suite are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0371"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "XStream: remote code execution due to insecure XML deserialization"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0002",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049675"
}
],
"notes": [
{
"category": "description",
"text": "The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: XML eXternal Entity (XXE) flaw in XSLT component",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0002"
},
{
"category": "external",
"summary": "RHBZ#1049675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0002",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002"
},
{
"category": "external",
"summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"
}
],
"release_date": "2014-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:19:56+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BPM Suite are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0371"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Camel: XML eXternal Entity (XXE) flaw in XSLT component"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0003",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049692"
}
],
"notes": [
{
"category": "description",
"text": "The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: remote code execution via XSL",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0003"
},
{
"category": "external",
"summary": "RHBZ#1049692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0003",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0003"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003"
},
{
"category": "external",
"summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc"
}
],
"release_date": "2014-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:19:56+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BPM Suite are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0371"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Camel: remote code execution via XSL"
}
]
}
RHSA-2014:0459
Vulnerability from csaf_redhat - Published: 2014-04-30 19:00 - Updated: 2025-11-21 17:48Summary
Red Hat Security Advisory: Red Hat JBoss Fuse Service Works 6.0.0 security update
Notes
Topic
Red Hat JBoss Fuse Service Works 6.0.0 roll up patch 1, which fixes
multiple security issues and various bugs, is now available from the Red
Hat Customer Portal.
The Red Hat Security Response Team has rated this update as having
Important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
Details
Red Hat JBoss Fuse Service Works is the next-generation ESB and business
process automation infrastructure. Red Hat JBoss Fuse Service Works allows
IT to leverage existing (MoM and EAI), modern (SOA and BPM-Rules), and
future (EDA and CEP) integration methodologies to dramatically improve
business process execution speed and quality.
This roll up patch serves as a cumulative upgrade for Red Hat JBoss Fuse
Service Works 6.0.0. It includes various bug fixes, which are listed in the
README file included with the patch files.
The following security issues are also fixed with this release:
It was found that the Apache Camel XSLT component allowed XSL stylesheets
to call external Java methods. A remote attacker able to submit messages to
a Camel route could use this flaw to perform arbitrary remote code
execution in the context of the Camel server process. (CVE-2014-0003)
It was found that when JBoss Web processed a series of HTTP requests in
which at least one request contained either multiple content-length
headers, or one content-length header with a chunked transfer-encoding
header, JBoss Web would incorrectly handle the request. A remote attacker
could use this flaw to poison a web cache, perform cross-site scripting
(XSS) attacks, or obtain sensitive information from other requests.
(CVE-2013-4286)
It was found that the Apache Camel XSLT component would resolve entities in
XML messages when transforming them using an XSLT route. A remote attacker
able to submit messages to an XSLT Camel route could use this flaw to read
files accessible to the user running the application server and,
potentially, perform other more advanced XML External Entity (XXE) attacks.
(CVE-2014-0002)
A denial of service flaw was found in the way Apache Commons FileUpload,
which is embedded in the JBoss Web component of JBoss EAP, handled
small-sized buffers used by MultipartStream. A remote attacker could use
this flaw to create a malformed Content-Type header for a multipart
request, causing JBoss Web to enter an infinite loop when processing such
an incoming request. (CVE-2014-0050)
The CVE-2014-0002 and CVE-2014-0003 issues were discovered by David Jorm of
the Red Hat Security Response Team.
All users of Red Hat JBoss Fuse Service Works 6.0.0 as provided from the
Red Hat Customer Portal are advised to apply this roll up patch.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Fuse Service Works 6.0.0 roll up patch 1, which fixes\nmultiple security issues and various bugs, is now available from the Red\nHat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nImportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Fuse Service Works is the next-generation ESB and business\nprocess automation infrastructure. Red Hat JBoss Fuse Service Works allows\nIT to leverage existing (MoM and EAI), modern (SOA and BPM-Rules), and\nfuture (EDA and CEP) integration methodologies to dramatically improve\nbusiness process execution speed and quality.\n\nThis roll up patch serves as a cumulative upgrade for Red Hat JBoss Fuse\nService Works 6.0.0. It includes various bug fixes, which are listed in the\nREADME file included with the patch files.\n\nThe following security issues are also fixed with this release:\n\nIt was found that the Apache Camel XSLT component allowed XSL stylesheets\nto call external Java methods. A remote attacker able to submit messages to\na Camel route could use this flaw to perform arbitrary remote code\nexecution in the context of the Camel server process. (CVE-2014-0003)\n\nIt was found that when JBoss Web processed a series of HTTP requests in\nwhich at least one request contained either multiple content-length\nheaders, or one content-length header with a chunked transfer-encoding\nheader, JBoss Web would incorrectly handle the request. A remote attacker\ncould use this flaw to poison a web cache, perform cross-site scripting\n(XSS) attacks, or obtain sensitive information from other requests.\n(CVE-2013-4286)\n\nIt was found that the Apache Camel XSLT component would resolve entities in\nXML messages when transforming them using an XSLT route. A remote attacker\nable to submit messages to an XSLT Camel route could use this flaw to read\nfiles accessible to the user running the application server and,\npotentially, perform other more advanced XML External Entity (XXE) attacks.\n(CVE-2014-0002)\n\nA denial of service flaw was found in the way Apache Commons FileUpload,\nwhich is embedded in the JBoss Web component of JBoss EAP, handled\nsmall-sized buffers used by MultipartStream. A remote attacker could use\nthis flaw to create a malformed Content-Type header for a multipart\nrequest, causing JBoss Web to enter an infinite loop when processing such\nan incoming request. (CVE-2014-0050)\n\nThe CVE-2014-0002 and CVE-2014-0003 issues were discovered by David Jorm of\nthe Red Hat Security Response Team.\n\nAll users of Red Hat JBoss Fuse Service Works 6.0.0 as provided from the\nRed Hat Customer Portal are advised to apply this roll up patch.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0459",
"url": "https://access.redhat.com/errata/RHSA-2014:0459"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse.serviceworks\u0026downloadType=securityPatches\u0026version=6.0.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse.serviceworks\u0026downloadType=securityPatches\u0026version=6.0.0"
},
{
"category": "external",
"summary": "1049675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
},
{
"category": "external",
"summary": "1049692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
},
{
"category": "external",
"summary": "1062337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
},
{
"category": "external",
"summary": "1069921",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0459.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Fuse Service Works 6.0.0 security update",
"tracking": {
"current_release_date": "2025-11-21T17:48:07+00:00",
"generator": {
"date": "2025-11-21T17:48:07+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2014:0459",
"initial_release_date": "2014-04-30T19:00:31+00:00",
"revision_history": [
{
"date": "2014-04-30T19:00:31+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:32:11+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T17:48:07+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Fuse Service Works 6.0",
"product": {
"name": "Red Hat JBoss Fuse Service Works 6.0",
"product_id": "Red Hat JBoss Fuse Service Works 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_fuse_service_works:6.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Fuse Service Works"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2013-4286",
"discovery_date": "2014-02-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1069921"
}
],
"notes": [
{
"category": "description",
"text": "It was found that when Tomcat / JBoss Web processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encoding header, Tomcat / JBoss Web would incorrectly handle the request. A remote attacker could use this flaw to poison a web cache, perform cross-site scripting (XSS) attacks, or obtain sensitive information from other requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: multiple content-length header poisoning flaws",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4286"
},
{
"category": "external",
"summary": "RHBZ#1069921",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1069921"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4286",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4286"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4286"
}
],
"release_date": "2014-02-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-30T19:00:31+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0459"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: multiple content-length header poisoning flaws"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0002",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049675"
}
],
"notes": [
{
"category": "description",
"text": "The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: XML eXternal Entity (XXE) flaw in XSLT component",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0002"
},
{
"category": "external",
"summary": "RHBZ#1049675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0002",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002"
},
{
"category": "external",
"summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"
}
],
"release_date": "2014-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-30T19:00:31+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0459"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Camel: XML eXternal Entity (XXE) flaw in XSLT component"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0003",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049692"
}
],
"notes": [
{
"category": "description",
"text": "The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: remote code execution via XSL",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0003"
},
{
"category": "external",
"summary": "RHBZ#1049692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0003",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0003"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003"
},
{
"category": "external",
"summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc"
}
],
"release_date": "2014-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-30T19:00:31+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0459"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Camel: remote code execution via XSL"
},
{
"cve": "CVE-2014-0050",
"discovery_date": "2014-02-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1062337"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in the way Apache Commons FileUpload, which is embedded in Tomcat and JBoss Web, handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing Tomcat to enter an infinite loop when processing such an incoming request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse Service Works 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0050"
},
{
"category": "external",
"summary": "RHBZ#1062337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0050",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0050"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050"
}
],
"release_date": "2014-02-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-30T19:00:31+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Fuse Service Works installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss Fuse Service Works\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss Fuse Service Works server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss Fuse Service Works 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0459"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse Service Works 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream"
}
]
}
RHSA-2014_0372
Vulnerability from csaf_redhat - Published: 2014-04-03 21:30 - Updated: 2024-11-22 08:11Summary
Red Hat Security Advisory: Red Hat JBoss BRMS 6.0.1 update
Notes
Topic
Red Hat JBoss BRMS 6.0.1, which fixes multiple security issues, various
bugs, and adds enhancements, is now available from the Red Hat Customer
Portal.
The Red Hat Security Response Team has rated this update as having
Important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
Details
Red Hat JBoss BRMS is a business rules management system for the
management, storage, creation, modification, and deployment of JBoss Rules.
This release of Red Hat JBoss BRMS 6.0.1 serves as a replacement for Red
Hat JBoss BRMS 6.0.0, and includes bug fixes and enhancements. Refer to the
Red Hat JBoss BRMS 6.0.1 Release Notes for information on the most
significant of these changes. The Release Notes will be available shortly
at https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_BRMS/
The following security issues are fixed with this release:
It was discovered that JBoss BRMS allowed remote authenticated users to
submit arbitrary Java code in MVFLEX Expression Language (MVEL) or JBoss
Rules expressions, resulting in arbitrary code execution within the
security context of the application server. Refer to the Solution section
for details on the fix for this issue. (CVE-2013-6468)
It was found that XStream could deserialize arbitrary user-supplied XML
content, representing objects of any type. A remote attacker able to pass
XML to XStream could use this flaw to perform a variety of attacks,
including remote code execution in the context of the server running the
XStream application. (CVE-2013-7285)
It was found that the Apache Camel XSLT component allowed XSL stylesheets
to call external Java methods. A remote attacker able to submit messages to
a Camel route could use this flaw to perform arbitrary remote code
execution in the context of the Camel server process. (CVE-2014-0003)
It was found that RESTEasy was vulnerable to XML External Entity (XXE)
attacks. If a remote attacker submitted a request containing an external
XML entity to a RESTEasy endpoint, the entity would be resolved, allowing
the attacker to read files accessible to the user running the application
server. This flaw affected DOM (Document Object Model) Document and JAXB
(Java Architecture for XML Binding) input. (CVE-2011-5245, CVE-2012-0818)
It was discovered that bouncycastle leaked timing information when
decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites
were used. A remote attacker could possibly use this flaw to retrieve plain
text from the encrypted packets by using a TLS/SSL server as a padding
oracle. (CVE-2013-1624)
It was found that the Apache Camel XSLT component would resolve entities in
XML messages when transforming them using an XSLT route. A remote attacker
able to submit messages to an XSLT Camel route could use this flaw to read
files accessible to the user running the application server and,
potentially, perform other more advanced XML External Entity (XXE) attacks.
(CVE-2014-0002)
The CVE-2014-0002 and CVE-2014-0003 issues were discovered by David Jorm of
the Red Hat Security Response Team, and the CVE-2013-6468 issue was
discovered by Marc Schoenefeld of the Red Hat Security Response Team.
Red Hat would like to thank Grégory Draperi for independently reporting
CVE-2013-6468.
All users of Red Hat JBoss BRMS 6.0.0 as provided from the Red Hat Customer
Portal are advised to upgrade to Red Hat JBoss BRMS 6.0.1.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss BRMS 6.0.1, which fixes multiple security issues, various\nbugs, and adds enhancements, is now available from the Red Hat Customer\nPortal.\n\nThe Red Hat Security Response Team has rated this update as having\nImportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss BRMS is a business rules management system for the\nmanagement, storage, creation, modification, and deployment of JBoss Rules.\n\nThis release of Red Hat JBoss BRMS 6.0.1 serves as a replacement for Red\nHat JBoss BRMS 6.0.0, and includes bug fixes and enhancements. Refer to the\nRed Hat JBoss BRMS 6.0.1 Release Notes for information on the most\nsignificant of these changes. The Release Notes will be available shortly\nat https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_BRMS/\n\nThe following security issues are fixed with this release:\n\nIt was discovered that JBoss BRMS allowed remote authenticated users to\nsubmit arbitrary Java code in MVFLEX Expression Language (MVEL) or JBoss\nRules expressions, resulting in arbitrary code execution within the\nsecurity context of the application server. Refer to the Solution section\nfor details on the fix for this issue. (CVE-2013-6468)\n\nIt was found that XStream could deserialize arbitrary user-supplied XML\ncontent, representing objects of any type. A remote attacker able to pass\nXML to XStream could use this flaw to perform a variety of attacks,\nincluding remote code execution in the context of the server running the\nXStream application. (CVE-2013-7285)\n\nIt was found that the Apache Camel XSLT component allowed XSL stylesheets\nto call external Java methods. A remote attacker able to submit messages to\na Camel route could use this flaw to perform arbitrary remote code\nexecution in the context of the Camel server process. (CVE-2014-0003)\n\nIt was found that RESTEasy was vulnerable to XML External Entity (XXE)\nattacks. If a remote attacker submitted a request containing an external\nXML entity to a RESTEasy endpoint, the entity would be resolved, allowing\nthe attacker to read files accessible to the user running the application\nserver. This flaw affected DOM (Document Object Model) Document and JAXB\n(Java Architecture for XML Binding) input. (CVE-2011-5245, CVE-2012-0818)\n\nIt was discovered that bouncycastle leaked timing information when\ndecrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites\nwere used. A remote attacker could possibly use this flaw to retrieve plain\ntext from the encrypted packets by using a TLS/SSL server as a padding\noracle. (CVE-2013-1624)\n\nIt was found that the Apache Camel XSLT component would resolve entities in\nXML messages when transforming them using an XSLT route. A remote attacker\nable to submit messages to an XSLT Camel route could use this flaw to read\nfiles accessible to the user running the application server and,\npotentially, perform other more advanced XML External Entity (XXE) attacks.\n(CVE-2014-0002)\n\nThe CVE-2014-0002 and CVE-2014-0003 issues were discovered by David Jorm of\nthe Red Hat Security Response Team, and the CVE-2013-6468 issue was\ndiscovered by Marc Schoenefeld of the Red Hat Security Response Team.\n\nRed Hat would like to thank Gr\u00e9gory Draperi for independently reporting\nCVE-2013-6468.\n\nAll users of Red Hat JBoss BRMS 6.0.0 as provided from the Red Hat Customer\nPortal are advised to upgrade to Red Hat JBoss BRMS 6.0.1.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0372",
"url": "https://access.redhat.com/errata/RHSA-2014:0372"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=distributions\u0026version=6.0.1",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=distributions\u0026version=6.0.1"
},
{
"category": "external",
"summary": "https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_BRMS/",
"url": "https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_BRMS/"
},
{
"category": "external",
"summary": "785631",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=785631"
},
{
"category": "external",
"summary": "908428",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=908428"
},
{
"category": "external",
"summary": "1049675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
},
{
"category": "external",
"summary": "1049692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
},
{
"category": "external",
"summary": "1051261",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051261"
},
{
"category": "external",
"summary": "1051277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0372.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss BRMS 6.0.1 update",
"tracking": {
"current_release_date": "2024-11-22T08:11:47+00:00",
"generator": {
"date": "2024-11-22T08:11:47+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2014:0372",
"initial_release_date": "2014-04-03T21:30:03+00:00",
"revision_history": [
{
"date": "2014-04-03T21:30:03+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:32:57+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T08:11:47+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss BRMS 6.0",
"product": {
"name": "Red Hat JBoss BRMS 6.0",
"product_id": "Red Hat JBoss BRMS 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_brms:6.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Decision Manager"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2011-5245",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2012-01-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "785631"
}
],
"notes": [
{
"category": "description",
"text": "The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTEasy: XML eXternal Entity (XXE) flaw",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2011-5245"
},
{
"category": "external",
"summary": "RHBZ#785631",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=785631"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2011-5245",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-5245"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2011-5245",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-5245"
}
],
"release_date": "2011-12-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:30:03+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BRMS are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0372"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTEasy: XML eXternal Entity (XXE) flaw"
},
{
"cve": "CVE-2012-0818",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2012-01-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "785631"
}
],
"notes": [
{
"category": "description",
"text": "RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTEasy: XML eXternal Entity (XXE) flaw",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-0818"
},
{
"category": "external",
"summary": "RHBZ#785631",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=785631"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-0818",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-0818"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-0818",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0818"
}
],
"release_date": "2011-12-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:30:03+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BRMS are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0372"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTEasy: XML eXternal Entity (XXE) flaw"
},
{
"cve": "CVE-2013-1624",
"cwe": {
"id": "CWE-385",
"name": "Covert Timing Channel"
},
"discovery_date": "2013-02-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "908428"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that bouncycastle leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: TLS CBC padding timing attack",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-1624"
},
{
"category": "external",
"summary": "RHBZ#908428",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=908428"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-1624",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-1624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1624"
},
{
"category": "external",
"summary": "http://www.isg.rhul.ac.uk/tls/",
"url": "http://www.isg.rhul.ac.uk/tls/"
},
{
"category": "external",
"summary": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf",
"url": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf"
}
],
"release_date": "2013-02-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:30:03+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BRMS are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0372"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "bouncycastle: TLS CBC padding timing attack"
},
{
"acknowledgments": [
{
"names": [
"Marc Schoenefeld"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
},
{
"names": [
"Gr\u00e9gory Draperi"
]
}
],
"cve": "CVE-2013-6468",
"discovery_date": "2013-08-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1051261"
}
],
"notes": [
{
"category": "description",
"text": "JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a (1) MVFLEX Expression Language (MVEL) or (2) Drools expression.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Drools: Remote Java Code Execution in MVEL",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-6468"
},
{
"category": "external",
"summary": "RHBZ#1051261",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051261"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-6468",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6468"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6468",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6468"
}
],
"release_date": "2014-04-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:30:03+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BRMS are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0372"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Drools: Remote Java Code Execution in MVEL"
},
{
"cve": "CVE-2013-7285",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2013-12-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1051277"
}
],
"notes": [
{
"category": "description",
"text": "It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "XStream: remote code execution due to insecure XML deserialization",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-7285"
},
{
"category": "external",
"summary": "RHBZ#1051277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-7285",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-7285"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285"
},
{
"category": "external",
"summary": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html",
"url": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html"
},
{
"category": "external",
"summary": "http://xstream.codehaus.org/security.html",
"url": "http://xstream.codehaus.org/security.html"
},
{
"category": "external",
"summary": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/",
"url": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/"
}
],
"release_date": "2013-12-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:30:03+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BRMS are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0372"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "XStream: remote code execution due to insecure XML deserialization"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0002",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049675"
}
],
"notes": [
{
"category": "description",
"text": "The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: XML eXternal Entity (XXE) flaw in XSLT component",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0002"
},
{
"category": "external",
"summary": "RHBZ#1049675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0002",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002"
},
{
"category": "external",
"summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"
}
],
"release_date": "2014-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:30:03+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BRMS are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0372"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Camel: XML eXternal Entity (XXE) flaw in XSLT component"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0003",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049692"
}
],
"notes": [
{
"category": "description",
"text": "The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: remote code execution via XSL",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0003"
},
{
"category": "external",
"summary": "RHBZ#1049692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0003",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0003"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003"
},
{
"category": "external",
"summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc"
}
],
"release_date": "2014-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:30:03+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BRMS are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0372"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Camel: remote code execution via XSL"
}
]
}
RHSA-2014:0372
Vulnerability from csaf_redhat - Published: 2014-04-03 21:30 - Updated: 2025-11-21 17:47Summary
Red Hat Security Advisory: Red Hat JBoss BRMS 6.0.1 update
Notes
Topic
Red Hat JBoss BRMS 6.0.1, which fixes multiple security issues, various
bugs, and adds enhancements, is now available from the Red Hat Customer
Portal.
The Red Hat Security Response Team has rated this update as having
Important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
Details
Red Hat JBoss BRMS is a business rules management system for the
management, storage, creation, modification, and deployment of JBoss Rules.
This release of Red Hat JBoss BRMS 6.0.1 serves as a replacement for Red
Hat JBoss BRMS 6.0.0, and includes bug fixes and enhancements. Refer to the
Red Hat JBoss BRMS 6.0.1 Release Notes for information on the most
significant of these changes. The Release Notes will be available shortly
at https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_BRMS/
The following security issues are fixed with this release:
It was discovered that JBoss BRMS allowed remote authenticated users to
submit arbitrary Java code in MVFLEX Expression Language (MVEL) or JBoss
Rules expressions, resulting in arbitrary code execution within the
security context of the application server. Refer to the Solution section
for details on the fix for this issue. (CVE-2013-6468)
It was found that XStream could deserialize arbitrary user-supplied XML
content, representing objects of any type. A remote attacker able to pass
XML to XStream could use this flaw to perform a variety of attacks,
including remote code execution in the context of the server running the
XStream application. (CVE-2013-7285)
It was found that the Apache Camel XSLT component allowed XSL stylesheets
to call external Java methods. A remote attacker able to submit messages to
a Camel route could use this flaw to perform arbitrary remote code
execution in the context of the Camel server process. (CVE-2014-0003)
It was found that RESTEasy was vulnerable to XML External Entity (XXE)
attacks. If a remote attacker submitted a request containing an external
XML entity to a RESTEasy endpoint, the entity would be resolved, allowing
the attacker to read files accessible to the user running the application
server. This flaw affected DOM (Document Object Model) Document and JAXB
(Java Architecture for XML Binding) input. (CVE-2011-5245, CVE-2012-0818)
It was discovered that bouncycastle leaked timing information when
decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites
were used. A remote attacker could possibly use this flaw to retrieve plain
text from the encrypted packets by using a TLS/SSL server as a padding
oracle. (CVE-2013-1624)
It was found that the Apache Camel XSLT component would resolve entities in
XML messages when transforming them using an XSLT route. A remote attacker
able to submit messages to an XSLT Camel route could use this flaw to read
files accessible to the user running the application server and,
potentially, perform other more advanced XML External Entity (XXE) attacks.
(CVE-2014-0002)
The CVE-2014-0002 and CVE-2014-0003 issues were discovered by David Jorm of
the Red Hat Security Response Team, and the CVE-2013-6468 issue was
discovered by Marc Schoenefeld of the Red Hat Security Response Team.
Red Hat would like to thank Grégory Draperi for independently reporting
CVE-2013-6468.
All users of Red Hat JBoss BRMS 6.0.0 as provided from the Red Hat Customer
Portal are advised to upgrade to Red Hat JBoss BRMS 6.0.1.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss BRMS 6.0.1, which fixes multiple security issues, various\nbugs, and adds enhancements, is now available from the Red Hat Customer\nPortal.\n\nThe Red Hat Security Response Team has rated this update as having\nImportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss BRMS is a business rules management system for the\nmanagement, storage, creation, modification, and deployment of JBoss Rules.\n\nThis release of Red Hat JBoss BRMS 6.0.1 serves as a replacement for Red\nHat JBoss BRMS 6.0.0, and includes bug fixes and enhancements. Refer to the\nRed Hat JBoss BRMS 6.0.1 Release Notes for information on the most\nsignificant of these changes. The Release Notes will be available shortly\nat https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_BRMS/\n\nThe following security issues are fixed with this release:\n\nIt was discovered that JBoss BRMS allowed remote authenticated users to\nsubmit arbitrary Java code in MVFLEX Expression Language (MVEL) or JBoss\nRules expressions, resulting in arbitrary code execution within the\nsecurity context of the application server. Refer to the Solution section\nfor details on the fix for this issue. (CVE-2013-6468)\n\nIt was found that XStream could deserialize arbitrary user-supplied XML\ncontent, representing objects of any type. A remote attacker able to pass\nXML to XStream could use this flaw to perform a variety of attacks,\nincluding remote code execution in the context of the server running the\nXStream application. (CVE-2013-7285)\n\nIt was found that the Apache Camel XSLT component allowed XSL stylesheets\nto call external Java methods. A remote attacker able to submit messages to\na Camel route could use this flaw to perform arbitrary remote code\nexecution in the context of the Camel server process. (CVE-2014-0003)\n\nIt was found that RESTEasy was vulnerable to XML External Entity (XXE)\nattacks. If a remote attacker submitted a request containing an external\nXML entity to a RESTEasy endpoint, the entity would be resolved, allowing\nthe attacker to read files accessible to the user running the application\nserver. This flaw affected DOM (Document Object Model) Document and JAXB\n(Java Architecture for XML Binding) input. (CVE-2011-5245, CVE-2012-0818)\n\nIt was discovered that bouncycastle leaked timing information when\ndecrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites\nwere used. A remote attacker could possibly use this flaw to retrieve plain\ntext from the encrypted packets by using a TLS/SSL server as a padding\noracle. (CVE-2013-1624)\n\nIt was found that the Apache Camel XSLT component would resolve entities in\nXML messages when transforming them using an XSLT route. A remote attacker\nable to submit messages to an XSLT Camel route could use this flaw to read\nfiles accessible to the user running the application server and,\npotentially, perform other more advanced XML External Entity (XXE) attacks.\n(CVE-2014-0002)\n\nThe CVE-2014-0002 and CVE-2014-0003 issues were discovered by David Jorm of\nthe Red Hat Security Response Team, and the CVE-2013-6468 issue was\ndiscovered by Marc Schoenefeld of the Red Hat Security Response Team.\n\nRed Hat would like to thank Gr\u00e9gory Draperi for independently reporting\nCVE-2013-6468.\n\nAll users of Red Hat JBoss BRMS 6.0.0 as provided from the Red Hat Customer\nPortal are advised to upgrade to Red Hat JBoss BRMS 6.0.1.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0372",
"url": "https://access.redhat.com/errata/RHSA-2014:0372"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=distributions\u0026version=6.0.1",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=distributions\u0026version=6.0.1"
},
{
"category": "external",
"summary": "https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_BRMS/",
"url": "https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_BRMS/"
},
{
"category": "external",
"summary": "785631",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=785631"
},
{
"category": "external",
"summary": "908428",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=908428"
},
{
"category": "external",
"summary": "1049675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
},
{
"category": "external",
"summary": "1049692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
},
{
"category": "external",
"summary": "1051261",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051261"
},
{
"category": "external",
"summary": "1051277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0372.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss BRMS 6.0.1 update",
"tracking": {
"current_release_date": "2025-11-21T17:47:41+00:00",
"generator": {
"date": "2025-11-21T17:47:41+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2014:0372",
"initial_release_date": "2014-04-03T21:30:03+00:00",
"revision_history": [
{
"date": "2014-04-03T21:30:03+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:32:57+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T17:47:41+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss BRMS 6.0",
"product": {
"name": "Red Hat JBoss BRMS 6.0",
"product_id": "Red Hat JBoss BRMS 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_brms:6.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Decision Manager"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2011-5245",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2012-01-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "785631"
}
],
"notes": [
{
"category": "description",
"text": "The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTEasy: XML eXternal Entity (XXE) flaw",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2011-5245"
},
{
"category": "external",
"summary": "RHBZ#785631",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=785631"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2011-5245",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-5245"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2011-5245",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-5245"
}
],
"release_date": "2011-12-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:30:03+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BRMS are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0372"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTEasy: XML eXternal Entity (XXE) flaw"
},
{
"cve": "CVE-2012-0818",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2012-01-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "785631"
}
],
"notes": [
{
"category": "description",
"text": "RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTEasy: XML eXternal Entity (XXE) flaw",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-0818"
},
{
"category": "external",
"summary": "RHBZ#785631",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=785631"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-0818",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-0818"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-0818",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0818"
}
],
"release_date": "2011-12-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:30:03+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BRMS are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0372"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTEasy: XML eXternal Entity (XXE) flaw"
},
{
"cve": "CVE-2013-1624",
"cwe": {
"id": "CWE-385",
"name": "Covert Timing Channel"
},
"discovery_date": "2013-02-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "908428"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that bouncycastle leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: TLS CBC padding timing attack",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-1624"
},
{
"category": "external",
"summary": "RHBZ#908428",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=908428"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-1624",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-1624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1624"
},
{
"category": "external",
"summary": "http://www.isg.rhul.ac.uk/tls/",
"url": "http://www.isg.rhul.ac.uk/tls/"
},
{
"category": "external",
"summary": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf",
"url": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf"
}
],
"release_date": "2013-02-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:30:03+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BRMS are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0372"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "bouncycastle: TLS CBC padding timing attack"
},
{
"acknowledgments": [
{
"names": [
"Marc Schoenefeld"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
},
{
"names": [
"Gr\u00e9gory Draperi"
]
}
],
"cve": "CVE-2013-6468",
"discovery_date": "2013-08-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1051261"
}
],
"notes": [
{
"category": "description",
"text": "JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a (1) MVFLEX Expression Language (MVEL) or (2) Drools expression.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Drools: Remote Java Code Execution in MVEL",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-6468"
},
{
"category": "external",
"summary": "RHBZ#1051261",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051261"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-6468",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6468"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6468",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6468"
}
],
"release_date": "2014-04-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:30:03+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BRMS are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0372"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Drools: Remote Java Code Execution in MVEL"
},
{
"cve": "CVE-2013-7285",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2013-12-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1051277"
}
],
"notes": [
{
"category": "description",
"text": "It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "XStream: remote code execution due to insecure XML deserialization",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-7285"
},
{
"category": "external",
"summary": "RHBZ#1051277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-7285",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-7285"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285"
},
{
"category": "external",
"summary": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html",
"url": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html"
},
{
"category": "external",
"summary": "http://xstream.codehaus.org/security.html",
"url": "http://xstream.codehaus.org/security.html"
},
{
"category": "external",
"summary": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/",
"url": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/"
}
],
"release_date": "2013-12-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:30:03+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BRMS are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0372"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "XStream: remote code execution due to insecure XML deserialization"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0002",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049675"
}
],
"notes": [
{
"category": "description",
"text": "The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: XML eXternal Entity (XXE) flaw in XSLT component",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0002"
},
{
"category": "external",
"summary": "RHBZ#1049675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0002",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002"
},
{
"category": "external",
"summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"
}
],
"release_date": "2014-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:30:03+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BRMS are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0372"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Camel: XML eXternal Entity (XXE) flaw in XSLT component"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0003",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049692"
}
],
"notes": [
{
"category": "description",
"text": "The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: remote code execution via XSL",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0003"
},
{
"category": "external",
"summary": "RHBZ#1049692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0003",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0003"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003"
},
{
"category": "external",
"summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc"
}
],
"release_date": "2014-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:30:03+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BRMS are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BRMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0372"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BRMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Camel: remote code execution via XSL"
}
]
}
RHSA-2014:0452
Vulnerability from csaf_redhat - Published: 2014-04-30 18:49 - Updated: 2025-11-21 17:48Summary
Red Hat Security Advisory: Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update
Notes
Topic
Fuse ESB Enterprise/MQ Enterprise 7.1.0 R1 P3 (Patch 3 on Rollup Patch 1),
which addresses several security issues and contains multiple bug fixes, is
now available from the Red Hat Customer Portal.
The Red Hat Security Response Team has rated this update as having
Important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
Details
Fuse ESB Enterprise is an integration platform based on Apache ServiceMix.
Fuse MQ Enterprise, based on Apache ActiveMQ, is a standards-compliant
messaging system that is tailored for use in mission critical applications.
This release of Fuse ESB Enterprise/MQ Enterprise 7.1.0 R1 P3 is an update
to Fuse ESB Enterprise 7.1.0 and Fuse MQ Enterprise 7.1.0. It includes
various bug fixes, which are listed in the README file included with the
patch files.
The following security issues are also addressed with this release:
It was found that XStream could deserialize arbitrary user-supplied XML
content, representing objects of any type. A remote attacker able to pass
XML to XStream could use this flaw to perform a variety of attacks,
including remote code execution in the context of the server running the
XStream application. (CVE-2013-7285)
It was found that the Apache Camel XSLT component allowed XSL stylesheets
to call external Java methods. A remote attacker able to submit messages to
a Camel route could use this flaw to perform arbitrary remote code
execution in the context of the Camel server process. (CVE-2014-0003)
It was found that the ParserPool and Decrypter classes in the OpenSAML Java
implementation resolved external entities, permitting XML External Entity
(XXE) attacks. A remote attacker could use this flaw to read files
accessible to the user running the application server and, potentially,
perform other more advanced XXE attacks. (CVE-2013-6440)
It was found that the Apache Camel XSLT component would resolve entities in
XML messages when transforming them using an XSLT route. A remote attacker
able to submit messages to an XSLT Camel route could use this flaw to read
files accessible to the user running the application server and,
potentially, perform other more advanced XXE attacks. (CVE-2014-0002)
A denial of service flaw was found in the way Apache Commons FileUpload
handled small-sized buffers used by MultipartStream. A remote attacker
could use this flaw to create a malformed Content-Type header for a
multipart request, causing Apache Commons FileUpload to enter an infinite
loop when processing such an incoming request. (CVE-2014-0050)
The CVE-2014-0002 and CVE-2014-0003 issues were discovered by David Jorm of
the Red Hat Security Response Team, and the CVE-2013-6440 issue was
discovered by David Illsley, Ron Gutierrez of Gotham Digital Science, and
David Jorm of the Red Hat Security Response Team.
All users of Fuse ESB Enterprise/MQ Enterprise 7.1.0 as provided from the
Red Hat Customer Portal are advised to upgrade to Fuse ESB Enterprise/MQ
Enterprise 7.1.0 R1 P3.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Fuse ESB Enterprise/MQ Enterprise 7.1.0 R1 P3 (Patch 3 on Rollup Patch 1),\nwhich addresses several security issues and contains multiple bug fixes, is\nnow available from the Red Hat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nImportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Fuse ESB Enterprise is an integration platform based on Apache ServiceMix.\nFuse MQ Enterprise, based on Apache ActiveMQ, is a standards-compliant\nmessaging system that is tailored for use in mission critical applications.\n\nThis release of Fuse ESB Enterprise/MQ Enterprise 7.1.0 R1 P3 is an update\nto Fuse ESB Enterprise 7.1.0 and Fuse MQ Enterprise 7.1.0. It includes\nvarious bug fixes, which are listed in the README file included with the\npatch files.\n\nThe following security issues are also addressed with this release:\n\nIt was found that XStream could deserialize arbitrary user-supplied XML\ncontent, representing objects of any type. A remote attacker able to pass\nXML to XStream could use this flaw to perform a variety of attacks,\nincluding remote code execution in the context of the server running the\nXStream application. (CVE-2013-7285)\n\nIt was found that the Apache Camel XSLT component allowed XSL stylesheets\nto call external Java methods. A remote attacker able to submit messages to\na Camel route could use this flaw to perform arbitrary remote code\nexecution in the context of the Camel server process. (CVE-2014-0003)\n\nIt was found that the ParserPool and Decrypter classes in the OpenSAML Java\nimplementation resolved external entities, permitting XML External Entity\n(XXE) attacks. A remote attacker could use this flaw to read files\naccessible to the user running the application server and, potentially,\nperform other more advanced XXE attacks. (CVE-2013-6440)\n\nIt was found that the Apache Camel XSLT component would resolve entities in\nXML messages when transforming them using an XSLT route. A remote attacker\nable to submit messages to an XSLT Camel route could use this flaw to read\nfiles accessible to the user running the application server and,\npotentially, perform other more advanced XXE attacks. (CVE-2014-0002)\n\nA denial of service flaw was found in the way Apache Commons FileUpload\nhandled small-sized buffers used by MultipartStream. A remote attacker\ncould use this flaw to create a malformed Content-Type header for a\nmultipart request, causing Apache Commons FileUpload to enter an infinite\nloop when processing such an incoming request. (CVE-2014-0050)\n\nThe CVE-2014-0002 and CVE-2014-0003 issues were discovered by David Jorm of\nthe Red Hat Security Response Team, and the CVE-2013-6440 issue was\ndiscovered by David Illsley, Ron Gutierrez of Gotham Digital Science, and\nDavid Jorm of the Red Hat Security Response Team.\n\nAll users of Fuse ESB Enterprise/MQ Enterprise 7.1.0 as provided from the\nRed Hat Customer Portal are advised to upgrade to Fuse ESB Enterprise/MQ\nEnterprise 7.1.0 R1 P3.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0452",
"url": "https://access.redhat.com/errata/RHSA-2014:0452"
},
{
"category": "external",
"summary": "1049692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
},
{
"category": "external",
"summary": "1051277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.esb.enterprise\u0026downloadType=securityPatches\u0026version=7.1.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.esb.enterprise\u0026downloadType=securityPatches\u0026version=7.1.0"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.mq.enterprise\u0026downloadType=securityPatches\u0026version=7.1.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.mq.enterprise\u0026downloadType=securityPatches\u0026version=7.1.0"
},
{
"category": "external",
"summary": "1043332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1043332"
},
{
"category": "external",
"summary": "1049675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
},
{
"category": "external",
"summary": "1062337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0452.json"
}
],
"title": "Red Hat Security Advisory: Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update",
"tracking": {
"current_release_date": "2025-11-21T17:48:04+00:00",
"generator": {
"date": "2025-11-21T17:48:04+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2014:0452",
"initial_release_date": "2014-04-30T18:49:57+00:00",
"revision_history": [
{
"date": "2014-04-30T18:49:57+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2014-04-30T18:49:57+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T17:48:04+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Fuse ESB Enterprise 7.1.0",
"product": {
"name": "Fuse ESB Enterprise 7.1.0",
"product_id": "Fuse ESB Enterprise 7.1.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:fuse_esb_enterprise:7.1.0"
}
}
},
{
"category": "product_name",
"name": "Fuse Management Console 7.1.0",
"product": {
"name": "Fuse Management Console 7.1.0",
"product_id": "Fuse Management Console 7.1.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:fuse_management_console:7.1.0"
}
}
},
{
"category": "product_name",
"name": "Fuse MQ Enterprise 7.1.0",
"product": {
"name": "Fuse MQ Enterprise 7.1.0",
"product_id": "Fuse MQ Enterprise 7.1.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:fuse_mq_enterprise:7.1.0"
}
}
}
],
"category": "product_family",
"name": "Fuse Enterprise Middleware"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"David Illsley"
]
},
{
"names": [
"Ron Gutierrez"
],
"organization": "Gotham Digital Science"
},
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2013-6440",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2013-12-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1043332"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the ParserPool and Decrypter classes in the OpenSAML Java implementation resolved external entities, permitting XML External Entity (XXE) attacks. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Java: XML eXternal Entity (XXE) flaw in ParserPool and Decrypter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-6440"
},
{
"category": "external",
"summary": "RHBZ#1043332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1043332"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-6440",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6440"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6440",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6440"
},
{
"category": "external",
"summary": "http://blog.sendsafely.com/post/69590974866/web-based-single-sign-on-and-the-dangers-of-saml-xml",
"url": "http://blog.sendsafely.com/post/69590974866/web-based-single-sign-on-and-the-dangers-of-saml-xml"
}
],
"release_date": "2013-12-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-30T18:49:57+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
"product_ids": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0452"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Java: XML eXternal Entity (XXE) flaw in ParserPool and Decrypter"
},
{
"cve": "CVE-2013-7285",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2013-12-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1051277"
}
],
"notes": [
{
"category": "description",
"text": "It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "XStream: remote code execution due to insecure XML deserialization",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-7285"
},
{
"category": "external",
"summary": "RHBZ#1051277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-7285",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-7285"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285"
},
{
"category": "external",
"summary": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html",
"url": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html"
},
{
"category": "external",
"summary": "http://xstream.codehaus.org/security.html",
"url": "http://xstream.codehaus.org/security.html"
},
{
"category": "external",
"summary": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/",
"url": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/"
}
],
"release_date": "2013-12-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-30T18:49:57+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
"product_ids": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0452"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "XStream: remote code execution due to insecure XML deserialization"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0002",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049675"
}
],
"notes": [
{
"category": "description",
"text": "The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: XML eXternal Entity (XXE) flaw in XSLT component",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0002"
},
{
"category": "external",
"summary": "RHBZ#1049675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0002",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002"
},
{
"category": "external",
"summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"
}
],
"release_date": "2014-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-30T18:49:57+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
"product_ids": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0452"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Camel: XML eXternal Entity (XXE) flaw in XSLT component"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0003",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049692"
}
],
"notes": [
{
"category": "description",
"text": "The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: remote code execution via XSL",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0003"
},
{
"category": "external",
"summary": "RHBZ#1049692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0003",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0003"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003"
},
{
"category": "external",
"summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc"
}
],
"release_date": "2014-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-30T18:49:57+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
"product_ids": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0452"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Camel: remote code execution via XSL"
},
{
"cve": "CVE-2014-0050",
"discovery_date": "2014-02-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1062337"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in the way Apache Commons FileUpload, which is embedded in Tomcat and JBoss Web, handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing Tomcat to enter an infinite loop when processing such an incoming request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0050"
},
{
"category": "external",
"summary": "RHBZ#1062337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0050",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0050"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0050"
}
],
"release_date": "2014-02-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-30T18:49:57+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
"product_ids": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0452"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Fuse ESB Enterprise 7.1.0",
"Fuse MQ Enterprise 7.1.0",
"Fuse Management Console 7.1.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream"
}
]
}
RHSA-2014_0371
Vulnerability from csaf_redhat - Published: 2014-04-03 21:19 - Updated: 2024-11-22 08:11Summary
Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.0.1 update
Notes
Topic
Red Hat JBoss BPM Suite 6.0.1, which fixes multiple security issues,
various bugs, and adds enhancements, is now available from the Red Hat
Customer Portal.
The Red Hat Security Response Team has rated this update as having
Important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
Details
Red Hat JBoss BPM Suite is a business rules management system for the
management, storage, creation, modification, and deployment of JBoss rules.
This release of Red Hat JBoss BPM Suite 6.0.1 serves as a replacement for
Red Hat JBoss BPM Suite 6.0.0, and includes bug fixes and enhancements.
Refer to the Red Hat JBoss BPM Suite 6.0.1 Release Notes for information on
the most significant of these changes. The Release Notes will be available
at https://access.redhat.com/site/documentation/Red_Hat_JBoss_BPM_Suite/
The following security issues are fixed with this release:
It was discovered that JBoss BPM Suite allowed remote authenticated users
to submit arbitrary Java code in MVFLEX Expression Language (MVEL) or JBoss
Rules expressions, resulting in arbitrary code execution within the
security context of the application server. Refer to the Solution section
for details on the fix for this issue. (CVE-2013-6468)
It was found that XStream could deserialize arbitrary user-supplied XML
content, representing objects of any type. A remote attacker able to pass
XML to XStream could use this flaw to perform a variety of attacks,
including remote code execution in the context of the server running the
XStream application. (CVE-2013-7285)
It was found that the Apache Camel XSLT component allowed XSL stylesheets
to call external Java methods. A remote attacker able to submit messages to
a Camel route could use this flaw to perform arbitrary remote code
execution in the context of the Camel server process. (CVE-2014-0003)
It was found that RESTEasy was vulnerable to XML External Entity (XXE)
attacks. If a remote attacker submitted a request containing an external
XML entity to a RESTEasy endpoint, the entity would be resolved, allowing
the attacker to read files accessible to the user running the application
server. This flaw affected DOM (Document Object Model) Document and JAXB
(Java Architecture for XML Binding) input. (CVE-2011-5245, CVE-2012-0818)
It was discovered that bouncycastle leaked timing information when
decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites
were used. A remote attacker could possibly use this flaw to retrieve plain
text from the encrypted packets by using a TLS/SSL server as a padding
oracle. (CVE-2013-1624)
It was found that the Apache Camel XSLT component would resolve entities in
XML messages when transforming them using an XSLT route. A remote attacker
able to submit messages to an XSLT Camel route could use this flaw to read
files accessible to the user running the application server and,
potentially, perform other more advanced XML External Entity (XXE) attacks.
(CVE-2014-0002)
The CVE-2014-0002 and CVE-2014-0003 issues were discovered by David Jorm of
the Red Hat Security Response Team, and the CVE-2013-6468 issue was
discovered by Marc Schoenefeld of the Red Hat Security Response Team.
Red Hat would like to thank Grégory Draperi for independently reporting
CVE-2013-6468.
All users of Red Hat JBoss BPM Suite 6.0.0 as provided from the Red Hat
Customer Portal are advised to upgrade to Red Hat JBoss BPM Suite 6.0.1.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss BPM Suite 6.0.1, which fixes multiple security issues,\nvarious bugs, and adds enhancements, is now available from the Red Hat\nCustomer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nImportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss BPM Suite is a business rules management system for the\nmanagement, storage, creation, modification, and deployment of JBoss rules.\n\nThis release of Red Hat JBoss BPM Suite 6.0.1 serves as a replacement for\nRed Hat JBoss BPM Suite 6.0.0, and includes bug fixes and enhancements.\nRefer to the Red Hat JBoss BPM Suite 6.0.1 Release Notes for information on\nthe most significant of these changes. The Release Notes will be available\nat https://access.redhat.com/site/documentation/Red_Hat_JBoss_BPM_Suite/\n\nThe following security issues are fixed with this release:\n\nIt was discovered that JBoss BPM Suite allowed remote authenticated users\nto submit arbitrary Java code in MVFLEX Expression Language (MVEL) or JBoss\nRules expressions, resulting in arbitrary code execution within the\nsecurity context of the application server. Refer to the Solution section\nfor details on the fix for this issue. (CVE-2013-6468)\n\nIt was found that XStream could deserialize arbitrary user-supplied XML\ncontent, representing objects of any type. A remote attacker able to pass\nXML to XStream could use this flaw to perform a variety of attacks,\nincluding remote code execution in the context of the server running the\nXStream application. (CVE-2013-7285)\n\nIt was found that the Apache Camel XSLT component allowed XSL stylesheets\nto call external Java methods. A remote attacker able to submit messages to\na Camel route could use this flaw to perform arbitrary remote code\nexecution in the context of the Camel server process. (CVE-2014-0003)\n\nIt was found that RESTEasy was vulnerable to XML External Entity (XXE)\nattacks. If a remote attacker submitted a request containing an external\nXML entity to a RESTEasy endpoint, the entity would be resolved, allowing\nthe attacker to read files accessible to the user running the application\nserver. This flaw affected DOM (Document Object Model) Document and JAXB\n(Java Architecture for XML Binding) input. (CVE-2011-5245, CVE-2012-0818)\n\nIt was discovered that bouncycastle leaked timing information when\ndecrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites\nwere used. A remote attacker could possibly use this flaw to retrieve plain\ntext from the encrypted packets by using a TLS/SSL server as a padding\noracle. (CVE-2013-1624)\n\nIt was found that the Apache Camel XSLT component would resolve entities in\nXML messages when transforming them using an XSLT route. A remote attacker\nable to submit messages to an XSLT Camel route could use this flaw to read\nfiles accessible to the user running the application server and,\npotentially, perform other more advanced XML External Entity (XXE) attacks.\n(CVE-2014-0002)\n\nThe CVE-2014-0002 and CVE-2014-0003 issues were discovered by David Jorm of\nthe Red Hat Security Response Team, and the CVE-2013-6468 issue was\ndiscovered by Marc Schoenefeld of the Red Hat Security Response Team.\n\nRed Hat would like to thank Gr\u00e9gory Draperi for independently reporting\nCVE-2013-6468.\n\nAll users of Red Hat JBoss BPM Suite 6.0.0 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss BPM Suite 6.0.1.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0371",
"url": "https://access.redhat.com/errata/RHSA-2014:0371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=distributions\u0026version=6.0.1",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=distributions\u0026version=6.0.1"
},
{
"category": "external",
"summary": "https://access.redhat.com/site/documentation/Red_Hat_JBoss_BPM_Suite/",
"url": "https://access.redhat.com/site/documentation/Red_Hat_JBoss_BPM_Suite/"
},
{
"category": "external",
"summary": "785631",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=785631"
},
{
"category": "external",
"summary": "908428",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=908428"
},
{
"category": "external",
"summary": "1049675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
},
{
"category": "external",
"summary": "1049692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
},
{
"category": "external",
"summary": "1051261",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051261"
},
{
"category": "external",
"summary": "1051277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
},
{
"category": "external",
"summary": "1058457",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1058457"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0371.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.0.1 update",
"tracking": {
"current_release_date": "2024-11-22T08:11:52+00:00",
"generator": {
"date": "2024-11-22T08:11:52+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2014:0371",
"initial_release_date": "2014-04-03T21:19:56+00:00",
"revision_history": [
{
"date": "2014-04-03T21:19:56+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:32:55+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T08:11:52+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss BPMS 6.0",
"product": {
"name": "Red Hat JBoss BPMS 6.0",
"product_id": "Red Hat JBoss BPMS 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_bpms:6.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Process Automation Manager"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2011-5245",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2012-01-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "785631"
}
],
"notes": [
{
"category": "description",
"text": "The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTEasy: XML eXternal Entity (XXE) flaw",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2011-5245"
},
{
"category": "external",
"summary": "RHBZ#785631",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=785631"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2011-5245",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-5245"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2011-5245",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-5245"
}
],
"release_date": "2011-12-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:19:56+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BPM Suite are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0371"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTEasy: XML eXternal Entity (XXE) flaw"
},
{
"cve": "CVE-2012-0818",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2012-01-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "785631"
}
],
"notes": [
{
"category": "description",
"text": "RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "RESTEasy: XML eXternal Entity (XXE) flaw",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-0818"
},
{
"category": "external",
"summary": "RHBZ#785631",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=785631"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-0818",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-0818"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-0818",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0818"
}
],
"release_date": "2011-12-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:19:56+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BPM Suite are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0371"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "RESTEasy: XML eXternal Entity (XXE) flaw"
},
{
"cve": "CVE-2013-1624",
"cwe": {
"id": "CWE-385",
"name": "Covert Timing Channel"
},
"discovery_date": "2013-02-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "908428"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that bouncycastle leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: TLS CBC padding timing attack",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-1624"
},
{
"category": "external",
"summary": "RHBZ#908428",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=908428"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-1624",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-1624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1624"
},
{
"category": "external",
"summary": "http://www.isg.rhul.ac.uk/tls/",
"url": "http://www.isg.rhul.ac.uk/tls/"
},
{
"category": "external",
"summary": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf",
"url": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf"
}
],
"release_date": "2013-02-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:19:56+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BPM Suite are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0371"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "bouncycastle: TLS CBC padding timing attack"
},
{
"acknowledgments": [
{
"names": [
"Marc Schoenefeld"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
},
{
"names": [
"Gr\u00e9gory Draperi"
]
}
],
"cve": "CVE-2013-6468",
"discovery_date": "2013-08-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1051261"
}
],
"notes": [
{
"category": "description",
"text": "JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a (1) MVFLEX Expression Language (MVEL) or (2) Drools expression.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Drools: Remote Java Code Execution in MVEL",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-6468"
},
{
"category": "external",
"summary": "RHBZ#1051261",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051261"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-6468",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6468"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6468",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6468"
}
],
"release_date": "2014-04-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:19:56+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BPM Suite are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0371"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Drools: Remote Java Code Execution in MVEL"
},
{
"cve": "CVE-2013-7285",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2013-12-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1051277"
}
],
"notes": [
{
"category": "description",
"text": "It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "XStream: remote code execution due to insecure XML deserialization",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-7285"
},
{
"category": "external",
"summary": "RHBZ#1051277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-7285",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-7285"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285"
},
{
"category": "external",
"summary": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html",
"url": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html"
},
{
"category": "external",
"summary": "http://xstream.codehaus.org/security.html",
"url": "http://xstream.codehaus.org/security.html"
},
{
"category": "external",
"summary": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/",
"url": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/"
}
],
"release_date": "2013-12-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:19:56+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BPM Suite are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0371"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "XStream: remote code execution due to insecure XML deserialization"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0002",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049675"
}
],
"notes": [
{
"category": "description",
"text": "The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: XML eXternal Entity (XXE) flaw in XSLT component",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0002"
},
{
"category": "external",
"summary": "RHBZ#1049675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0002",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002"
},
{
"category": "external",
"summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"
}
],
"release_date": "2014-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:19:56+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BPM Suite are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0371"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Camel: XML eXternal Entity (XXE) flaw in XSLT component"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0003",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049692"
}
],
"notes": [
{
"category": "description",
"text": "The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: remote code execution via XSL",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0003"
},
{
"category": "external",
"summary": "RHBZ#1049692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0003",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0003"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003"
},
{
"category": "external",
"summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc"
}
],
"release_date": "2014-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T21:19:56+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the updates). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server process.\n\nThe fix for CVE-2013-6468 enables the Java Security Manager (JSM) to\nsandbox the evaluation of MVEL expressions. This introduces performance\ndegradation in high load environments. The following ways of running Red\nHat JBoss BPM Suite are considered secure while mitigating performance\ndegradation:\n\n1. In high load environments where performance is critical, it is\nrecommended to only deploy applications that have been developed on other\nsystems and properly reviewed. It is also recommended not to create any\nusers with the Analyst role on such systems. If these safeguards are\nfollowed, it is safe to leave JSM disabled on these systems so it does not\nintroduce any performance degradation.\n\n2. In testing and development environments without high loads, or in\nenvironments where rule authoring is exposed to external networks, it is\nrecommended to have JSM enabled in order to achieve security benefits of\nproperly sandboxed evaluation of MVEL expressions.\n\nAllowing users with the Analyst role to log in to the Business Central\nconsole when JSM is disabled is not secure and not recommended.",
"product_ids": [
"Red Hat JBoss BPMS 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0371"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss BPMS 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Camel: remote code execution via XSL"
}
]
}
RHSA-2014:0323
Vulnerability from csaf_redhat - Published: 2014-03-24 18:05 - Updated: 2025-11-21 17:47Summary
Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.0.0 security update
Notes
Topic
Red Hat JBoss Fuse and A-MQ 6.0.0 R1 P3 (Patch 3 on Rollup Patch 1), which
addresses three security issues and contains several bug fixes, is now
available from the Red Hat Customer Portal.
The Red Hat Security Response Team has rated this update as having
Important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
Details
Red Hat JBoss Fuse 6.0.0 is an integration platform based on Apache
ServiceMix. Red Hat JBoss A-MQ 6.0.0, based on Apache ActiveMQ, is a
standards compliant messaging system that is tailored for use in mission
critical applications.
This patch is an update to Red Hat JBoss Fuse 6.0.0 and Red Hat JBoss A-MQ
6.0.0. It includes bug fixes, which are documented in the readme file
included with the patch files.
The following security issues are fixed with this release:
It was found that XStream could deserialize arbitrary user-supplied XML
content, representing objects of any type. A remote attacker able to pass
XML to XStream could use this flaw to perform a variety of attacks,
including remote code execution in the context of the server running the
XStream application. (CVE-2013-7285)
It was found that the Apache Camel XSLT component allowed XSL stylesheets
to call external Java methods. A remote attacker able to submit messages to
a Camel route could use this flaw to perform arbitrary remote code
execution in the context of the Camel server process. (CVE-2014-0003)
It was found that the Apache Camel XSLT component would resolve entities in
XML messages when transforming them using an XSLT route. A remote attacker
able to submit messages to an XSLT Camel route could use this flaw to read
files accessible to the user running the application server and,
potentially, perform other more advanced XML External Entity (XXE) attacks.
(CVE-2014-0002)
The CVE-2014-0003 and CVE-2014-0002 issues were discovered by David Jorm of
the Red Hat Security Response Team.
All users of Red Hat JBoss Fuse 6.0.0 and Red Hat JBoss A-MQ 6.0.0 as
provided from the Red Hat Customer Portal are advised to apply this patch.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Fuse and A-MQ 6.0.0 R1 P3 (Patch 3 on Rollup Patch 1), which\naddresses three security issues and contains several bug fixes, is now\navailable from the Red Hat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nImportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Fuse 6.0.0 is an integration platform based on Apache\nServiceMix. Red Hat JBoss A-MQ 6.0.0, based on Apache ActiveMQ, is a\nstandards compliant messaging system that is tailored for use in mission\ncritical applications.\n\nThis patch is an update to Red Hat JBoss Fuse 6.0.0 and Red Hat JBoss A-MQ\n6.0.0. It includes bug fixes, which are documented in the readme file\nincluded with the patch files.\n\nThe following security issues are fixed with this release:\n\nIt was found that XStream could deserialize arbitrary user-supplied XML\ncontent, representing objects of any type. A remote attacker able to pass\nXML to XStream could use this flaw to perform a variety of attacks,\nincluding remote code execution in the context of the server running the\nXStream application. (CVE-2013-7285)\n\nIt was found that the Apache Camel XSLT component allowed XSL stylesheets\nto call external Java methods. A remote attacker able to submit messages to\na Camel route could use this flaw to perform arbitrary remote code\nexecution in the context of the Camel server process. (CVE-2014-0003)\n\nIt was found that the Apache Camel XSLT component would resolve entities in\nXML messages when transforming them using an XSLT route. A remote attacker\nable to submit messages to an XSLT Camel route could use this flaw to read\nfiles accessible to the user running the application server and,\npotentially, perform other more advanced XML External Entity (XXE) attacks.\n(CVE-2014-0002)\n\nThe CVE-2014-0003 and CVE-2014-0002 issues were discovered by David Jorm of\nthe Red Hat Security Response Team.\n\nAll users of Red Hat JBoss Fuse 6.0.0 and Red Hat JBoss A-MQ 6.0.0 as\nprovided from the Red Hat Customer Portal are advised to apply this patch.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0323",
"url": "https://access.redhat.com/errata/RHSA-2014:0323"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.0.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.0.0"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=securityPatches\u0026version=6.0.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=securityPatches\u0026version=6.0.0"
},
{
"category": "external",
"summary": "1049675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
},
{
"category": "external",
"summary": "1049692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
},
{
"category": "external",
"summary": "1051277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0323.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.0.0 security update",
"tracking": {
"current_release_date": "2025-11-21T17:47:29+00:00",
"generator": {
"date": "2025-11-21T17:47:29+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2014:0323",
"initial_release_date": "2014-03-24T18:05:04+00:00",
"revision_history": [
{
"date": "2014-03-24T18:05:04+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:32:42+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T17:47:29+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss A-MQ 6.0",
"product": {
"name": "Red Hat JBoss A-MQ 6.0",
"product_id": "Red Hat JBoss A-MQ 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_amq:6.0.0"
}
}
},
{
"category": "product_name",
"name": "Red Hat JBoss Fuse 6.0",
"product": {
"name": "Red Hat JBoss Fuse 6.0",
"product_id": "Red Hat JBoss Fuse 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_fuse:6.0.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Fuse"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2013-7285",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2013-12-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1051277"
}
],
"notes": [
{
"category": "description",
"text": "It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "XStream: remote code execution due to insecure XML deserialization",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss A-MQ 6.0",
"Red Hat JBoss Fuse 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-7285"
},
{
"category": "external",
"summary": "RHBZ#1051277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051277"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-7285",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-7285"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7285"
},
{
"category": "external",
"summary": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html",
"url": "http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html"
},
{
"category": "external",
"summary": "http://xstream.codehaus.org/security.html",
"url": "http://xstream.codehaus.org/security.html"
},
{
"category": "external",
"summary": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/",
"url": "https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/"
}
],
"release_date": "2013-12-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-03-24T18:05:04+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the update).",
"product_ids": [
"Red Hat JBoss A-MQ 6.0",
"Red Hat JBoss Fuse 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0323"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss A-MQ 6.0",
"Red Hat JBoss Fuse 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "XStream: remote code execution due to insecure XML deserialization"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0002",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049675"
}
],
"notes": [
{
"category": "description",
"text": "The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: XML eXternal Entity (XXE) flaw in XSLT component",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss A-MQ 6.0",
"Red Hat JBoss Fuse 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0002"
},
{
"category": "external",
"summary": "RHBZ#1049675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0002",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002"
},
{
"category": "external",
"summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"
}
],
"release_date": "2014-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-03-24T18:05:04+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the update).",
"product_ids": [
"Red Hat JBoss A-MQ 6.0",
"Red Hat JBoss Fuse 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0323"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss A-MQ 6.0",
"Red Hat JBoss Fuse 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Camel: XML eXternal Entity (XXE) flaw in XSLT component"
},
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Security Response Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0003",
"discovery_date": "2014-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1049692"
}
],
"notes": [
{
"category": "description",
"text": "The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Camel: remote code execution via XSL",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss A-MQ 6.0",
"Red Hat JBoss Fuse 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0003"
},
{
"category": "external",
"summary": "RHBZ#1049692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0003",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0003"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003"
},
{
"category": "external",
"summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc"
}
],
"release_date": "2014-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-03-24T18:05:04+00:00",
"details": "The References section of this erratum contains download links (you must\nlog in to download the update).",
"product_ids": [
"Red Hat JBoss A-MQ 6.0",
"Red Hat JBoss Fuse 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0323"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss A-MQ 6.0",
"Red Hat JBoss Fuse 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Camel: remote code execution via XSL"
}
]
}
GSD-2014-0002
Vulnerability from gsd - Updated: 2023-12-13 01:22Details
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2014-0002",
"description": "The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"id": "GSD-2014-0002",
"references": [
"https://access.redhat.com/errata/RHSA-2014:0459",
"https://access.redhat.com/errata/RHSA-2014:0452",
"https://access.redhat.com/errata/RHSA-2014:0372",
"https://access.redhat.com/errata/RHSA-2014:0371",
"https://access.redhat.com/errata/RHSA-2014:0323"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2014-0002"
],
"details": "The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"id": "GSD-2014-0002",
"modified": "2023-12-13T01:22:44.736637Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2014-0002",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E",
"refsource": "MISC",
"url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E"
},
{
"name": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E",
"refsource": "MISC",
"url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E"
},
{
"name": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc",
"refsource": "MISC",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"
},
{
"name": "http://rhn.redhat.com/errata/RHSA-2014-0371.html",
"refsource": "MISC",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0371.html"
},
{
"name": "http://rhn.redhat.com/errata/RHSA-2014-0372.html",
"refsource": "MISC",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0372.html"
},
{
"name": "http://secunia.com/advisories/57125",
"refsource": "MISC",
"url": "http://secunia.com/advisories/57125"
},
{
"name": "http://secunia.com/advisories/57716",
"refsource": "MISC",
"url": "http://secunia.com/advisories/57716"
},
{
"name": "http://secunia.com/advisories/57719",
"refsource": "MISC",
"url": "http://secunia.com/advisories/57719"
},
{
"name": "http://www.securityfocus.com/bid/65901",
"refsource": "MISC",
"url": "http://www.securityfocus.com/bid/65901"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "(,2.11.3],[2.12-alpha0,2.12.2]",
"affected_versions": "All versions up to 2.11.3, all versions starting from 2.12-alpha0 up to 2.12.2",
"cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe_ids": [
"CWE-1035",
"CWE-264",
"CWE-937"
],
"date": "2019-05-24",
"description": "The XSLT component in this package allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"fixed_versions": [
"2.11.4",
"2.12.3"
],
"identifier": "CVE-2014-0002",
"identifiers": [
"CVE-2014-0002"
],
"not_impacted": "All versions after 2.11.3 before 2.12-alpha0, all versions after 2.12.2",
"package_slug": "maven/org.apache.camel/camel-core",
"pubdate": "2014-03-21",
"solution": "Upgrade to versions 2.11.4, 2.12.3 or above.",
"title": "Read arbitrary files",
"urls": [
"http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc",
"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0002",
"https://access.redhat.com/security/cve/CVE-2014-0002",
"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0002"
],
"uuid": "ab141d72-2fe3-48db-8777-28a6dcc3e902"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apache:camel:1.1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:2.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:1.4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:2.10.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.11.3",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:1.2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:1.6.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:2.10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:2.11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:2.10.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:2.10.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:1.5.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:2.11.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:2.10.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:1.6.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:1.6.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:2.10.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:2.10.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:1.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:1.3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:2.11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:1.6.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:2.1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:2.10.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:2.0.0:milestone1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:2.0.0:milestone2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:2.0.0:milestone3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apache:camel:2.12.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:2.12.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:camel:2.12.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2014-0002"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc",
"refsource": "CONFIRM",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"
},
{
"name": "57125",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/57125"
},
{
"name": "65901",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/65901"
},
{
"name": "57716",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/57716"
},
{
"name": "RHSA-2014:0371",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0371.html"
},
{
"name": "57719",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/57719"
},
{
"name": "RHSA-2014:0372",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0372.html"
},
{
"name": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E",
"refsource": "MISC",
"tags": [],
"url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E"
},
{
"name": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E",
"refsource": "MISC",
"tags": [],
"url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"userInteractionRequired": false
}
},
"lastModifiedDate": "2023-02-13T00:29Z",
"publishedDate": "2014-03-21T04:38Z"
}
}
}
GHSA-2FW5-RVF2-JQ56
Vulnerability from github – Published: 2018-10-16 23:13 – Updated: 2023-02-15 22:19
VLAI?
Summary
Apache Camel's XSLT component allows remote attackers to read arbitrary files
Details
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.camel:camel-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.11.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.camel:camel-core"
},
"ranges": [
{
"events": [
{
"introduced": "2.12.0"
},
{
"fixed": "2.12.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-0002"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T20:51:56Z",
"nvd_published_at": "2014-03-21T04:38:00Z",
"severity": "HIGH"
},
"details": "The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
"id": "GHSA-2fw5-rvf2-jq56",
"modified": "2023-02-15T22:19:10Z",
"published": "2018-10-16T23:13:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0002"
},
{
"type": "WEB",
"url": "https://github.com/apache/camel/commit/2ec54fa0c13ae65bdcccff764af081a79fcc05f"
},
{
"type": "WEB",
"url": "https://github.com/apache/camel/commit/341d4e6cca71c53c90962d1c3d45fc9e05cc50c6"
},
{
"type": "WEB",
"url": "https://github.com/apache/camel/commit/54b65c1d30848835f26bd138c0ba407bc1e560d"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/camel"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/CAMEL-7129"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200229061309/http://www.securityfocus.com/bid/65901"
},
{
"type": "WEB",
"url": "http://camel.apache.org/security-advisories.data/CVE-2014-0002.txt.asc"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0371.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0372.html"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Apache Camel\u0027s XSLT component allows remote attackers to read arbitrary files"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…