- Issued:
- 2015-02-18
- Updated:
- 2015-02-18
RHSA-2015:0236 - Moderate: Red Hat JBoss Fuse/A-MQ 6.1.0 security and bug fix update
Synopsis
Moderate: Red Hat JBoss Fuse/A-MQ 6.1.0 security and bug fix update
Type/Severity
Security Advisory Moderate
Topic
Red Hat JBoss Fuse and A-MQ 6.1.0 Rollup Patch 2 (R2), which includes several bug fixes, enhancements, and resolves two security issues, is now available from the Red Hat Customer Portal.
Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
Description
Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications.
This patch is an update to Red Hat JBoss Fuse 6.1.0 and Red Hat JBoss A-MQ 6.1.0. It includes bug fixes, which are documented in the readme.txt file included with the patch files. The following security issues are addressed in this release:
It was found that Apache WSS4J (Web Services Security for Java), as used by Apache CXF with the TransportBinding, did not, by default, properly enforce all security requirements associated with SAML SubjectConfirmation methods. A remote attacker could use this flaw to perform various types of spoofing attacks on web service endpoints secured by WSS4J that rely on SAML for authentication. (CVE-2014-3623)
A directory traversal flaw was found in the way the Spring Framework sanitized certain URLs. A remote attacker could use this flaw to obtain any file on the file system that was also accessible to the process in which the Spring web application was running. (CVE-2014-3625)
Refer to the readme.txt file included with the patch files for installation instructions.
All users of Red Hat JBoss Fuse 6.1.0 and Red Hat JBoss A-MQ 6.1.0 as provided from the Red Hat Customer Portal are advised to apply this security update.
Solution
The References section of this erratum contains a download link (you must log in to download the update).
Affected Products
| Product | Version | Arch |
|---|---|---|
| Red Hat Fuse | 1 | x86_64 |
Fixes
CVEs
References
- https://access.redhat.com/security/updates/classification/#moderate
- This content is not included.This content is not included.https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse&downloadType=securityPatches&version=6.1.0
Additional information
- The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
- Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.