Issued:

2013-10-15

Updated:

2013-10-15

RHSA-2013:1428 - Important: jakarta-commons-fileupload security update

Synopsis

Important: jakarta-commons-fileupload security update

Type/Severity

Security Advisory Important

Topic

An updated jakarta-commons-fileupload package that fixes one security issue is now available for Red Hat JBoss Web Server 1.0.2 for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Description

The Apache Commons FileUpload component can be used to add a file upload capability to your applications.

A flaw was found in the way the DiskFileItem class handled NULL characters in file names. A remote attacker able to supply a serialized instance of the DiskFileItem class, which will be deserialized on a server, could use this flaw to write arbitrary content to any location on the server that is accessible to the user running the application server process. (CVE-2013-2186)

Warning: Before applying the update, back up your existing Red Hat JBoss Enterprise Web Server installation (including all applications and configuration files).

All users of Red Hat JBoss Web Server 1.0.2 on Red Hat Enterprise Linux 5 and 6 are advised to upgrade to this updated package. The JBoss server process must be restarted for the update to take effect.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

Affected Products

Updated Packages

• jakarta-commons-fileupload-1.1.1-7.7.ep5.el5.src.rpm
• jakarta-commons-fileupload-1.1.1-7.7.ep5.el5.noarch.rpm
• jakarta-commons-fileupload-1.1.1-7.7.ep5.el6.src.rpm
• jakarta-commons-fileupload-1.1.1-7.7.ep5.el6.noarch.rpm

Fixes

• This content is not included.BZ - 974814

CVEs

• CVE-2013-2186

References

• https://access.redhat.com/security/updates/classification/#important

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.