-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Fuse 6.2.1 update Advisory ID: RHSA-2015:2556-01 Product: Red Hat JBoss Fuse Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-2556.html Issue date: 2015-12-07 CVE Names: CVE-2015-3253 CVE-2015-5181 CVE-2015-7501 ===================================================================== 1. Summary: Red Hat JBoss Fuse 6.2.1, which fixes three security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Description: Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat JBoss Fuse 6.2.1 is a micro product release that updates Red Hat JBoss Fuse 6.2.0, and includes several bug fixes and enhancements. Refer to the Release Notes document, available from the link in the References section, for a list of changes. The following security fixes are addressed in this release: It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library. (CVE-2015-7501) Further information about this issue may be found at: https://access.redhat.com/solutions/2045023 A flaw was discovered that when an application uses Groovy (has it on the classpath) and uses the standard Java serialization mechanism, an attacker can bake a special serialized object that executes code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability. (CVE-2015-3253) It was found that the JBoss A-MQ console would accept a string containing JavaScript as the name of a new message queue. Execution of the UI would subsequently execute the script. An attacker could use this flaw to access sensitive information or perform other attacks. (CVE-2015-5181) Red Hat would like to thank Naftali Rosenbaum of Comsec Consulting for reporting CVE-2015-5181. All users of Red Hat JBoss Fuse 6.2.0 are advised to apply this update. 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). 4. Bugs fixed (https://bugzilla.redhat.com/): 1243934 - CVE-2015-3253 groovy: remote execution of untrusted code in class MethodClosure 1248804 - CVE-2015-5181 A-MQ Console: script injection into queue name 1279330 - CVE-2015-7501 apache-commons-collections: InvokerTransformer code execution during deserialisation 5. JIRA issues fixed (https://issues.jboss.org/): ENTESB-4398 - Arbitrary remote code execution with InvokerTransformer 6. References: https://access.redhat.com/security/cve/CVE-2015-3253 https://access.redhat.com/security/cve/CVE-2015-5181 https://access.redhat.com/security/cve/CVE-2015-7501 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse&downloadType=distributions&version=6.2.1 https://access.redhat.com/solutions/2045023 https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_Fuse/ 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWZfDMXlSAg2UNWIIRAmfiAKCfO/H71Dlcij5D7R1xC0H5CvBlKACfRtIX 9dnbEFEqfTUl8U3zcV369Qw= =m+SP -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce