Issued:
2015-12-07
Updated:
2015-12-07

RHSA-2015:2557 - Important: Red Hat JBoss A-MQ 6.2.1 update

Synopsis

Important: Red Hat JBoss A-MQ 6.2.1 update

Type/Severity

Security Advisory Important

Topic

Red Hat JBoss A-MQ 6.2.1, which fixes three security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Description

Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards-compliant messaging system that is tailored for use in mission critical applications.

Red Hat JBoss A-MQ 6.2.1 is a micro product release that updates Red Hat JBoss A-MQ 6.2.0, and includes several bug fixes and enhancements. Refer to the Release Notes document, available from the link in the References section, for a list of changes.

The following security fixes are addressed in this release:

It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library. (CVE-2015-7501)

Further information about this issue may be found at: https://access.redhat.com/solutions/2045023

A flaw was discovered that when an application uses Groovy (has it on the classpath) and uses the standard Java serialization mechanism, an attacker can bake a special serialized object that executes code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability. (CVE-2015-3253)

It was found that the JBoss A-MQ console would accept a string containing JavaScript as the name of a new message queue. Execution of the UI would subsequently execute the script. An attacker could use this flaw to access sensitive information or perform other attacks. (CVE-2015-5181)

Red Hat would like to thank Naftali Rosenbaum of Comsec Consulting for reporting CVE-2015-5181.

All users of Red Hat JBoss A-MQ 6.2.0 as provided from the Red Hat Customer Portal are advised to apply this update.

Solution

The References section of this erratum contains a download link (you must log in to download the update).

Affected Products

ProductVersionArch
Red Hat JBoss MiddlewareText-Only Advisoriesx86_64

Fixes

CVEs

References

Additional information