Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.1.0 security update
This advisory contains instructions on how to resolve one security issue in the Elasticsearch component in Red Hat JBoss Fuse and A-MQ 6.1.0. Red Hat Product Security has rated this security issue as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2014-3120US | high8.1OT critical | KEV | ||
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source pa… | ||||
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2014:1170self
- https://access.redhat.com/security/updates/classification/#importantexternal
- https://access.redhat.com/solutions/1189133external
- https://access.redhat.com/solutions/1191453external
- https://access.redhat.com/support/offerings/techpreviewexternal
- 1124252external
- Canonical URLself
remediations (2)
- FixedRed Hat JBoss A-MQ 6.1
To mitigate this issue, follow the instructions at https://access.redhat.com/solutions/1191453 For more information, refer to https://access.redhat.com/solutions/1189133
https://access.redhat.com/errata/RHSA-2014:1170 - FixedRed Hat JBoss Fuse 6.1
To mitigate this issue, follow the instructions at https://access.redhat.com/solutions/1191453 For more information, refer to https://access.redhat.com/solutions/1189133
https://access.redhat.com/errata/RHSA-2014:1170
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan