Red Hat Security Advisory: Red Hat JBoss A-MQ 6.3 security update
Red Hat JBoss A-MQ 6.3, which fixes multiple security issues and includes several bug fixes and enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
describes (5)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2015-3192US | medium5.5 | — | ||
Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to caus… | ||||
| CVE-2016-4437US | critical9.8OT critical | KEV | ||
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access rest… | ||||
| CVE-2016-3088US | critical9.8OT critical | KEV | ||
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request. | ||||
| CVE-2015-5254US | critical9.8 | Exploit | ||
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serializ… | ||||
| CVE-2015-7940US | medium5.0 | — | ||
The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series o… | ||||
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/documentation/en/red-hat-jboss-fuse/?version=6.3external
- https://access.redhat.com/errata/RHSA-2016:2036self
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq&downloadType=distributions&version=6.3.0external
- https://access.redhat.com/security/updates/classification/#importantexternal
- 1239002external
- 1276272external
- 1343346external
- Canonical URLself
remediations (7)
- FixedRed Hat JBoss A-MQ 6.3
The References section of this erratum contains a download link (you must log in to download the update).
https://access.redhat.com/errata/RHSA-2016:2036 - FixedRed Hat JBoss A-MQ 6.3
The References section of this erratum contains a download link (you must log in to download the update).
https://access.redhat.com/errata/RHSA-2016:2036 - FixedRed Hat JBoss A-MQ 6.3
The References section of this erratum contains a download link (you must log in to download the update).
https://access.redhat.com/errata/RHSA-2016:2036 - FixedRed Hat JBoss A-MQ 6.3
The References section of this erratum contains a download link (you must log in to download the update).
https://access.redhat.com/errata/RHSA-2016:2036 - FixedRed Hat JBoss A-MQ 6.3
The References section of this erratum contains a download link (you must log in to download the update).
https://access.redhat.com/errata/RHSA-2016:2036 - WorkaroundRed Hat JBoss A-MQ 6.3
If you do deploy a JMS publisher, and subscriber, and don't trust the messages sent to you by your clients, you could mitigate this issue by installing a Java agent which restricts the classes which can be deserialized. This is an article with the recommended approach: https://access.redhat.com/solutions/2190911 You could also mitigate this issue using the features of the Java Virtual Machine added in JEP 290: http://openjdk.java.net/jeps/290
- WorkaroundRed Hat JBoss A-MQ 6.3
Users are advised to use other FTP and HTTP based file servers for transferring blob messages. Fileserver web application SHOULD NOT be used in older version of the broker and it should be disabled (it has been disabled by default since 5.12.0). This can be done by removing (commenting out) the following lines from conf\jetty.xml file <bean class="org.eclipse.jetty.webapp.WebAppContext"> <property name="contextPath" value="/fileserver" /> <property name="resourceBase" value="${activemq.home}/webapps/fileserver" /> <property name="logUrlOnStart" value="true" /> <property name="parentLoaderPriority" value="true" /> </bean>
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan