RHSA-2014:0474: Important: struts security update
Apache Struts is a framework for building web applications with Java.It was found that the Struts 1 ActionForm object allowed access to the'class' parameter, which is directly mapped to the getClass() method. Aremote attacker could use this flaw to manipulate the ClassLoader used byan application server running Struts 1. This could lead to remote codeexecution under certain conditions. (CVE-2014-0114)All struts users are advised to upgrade to these updated packages, whichcontain a backported patch to correct this issue. All running applicationsusing struts must be restarted for this update to take effect.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2014:0474?
The severity of RHSA-2014:0474 is classified as important.
How do I fix RHSA-2014:0474?
To fix RHSA-2014:0474, update the struts package to version 1.2.9-4jpp.8.el5_10 or later.
What vulnerabilities does RHSA-2014:0474 address?
RHSA-2014:0474 addresses vulnerabilities related to improper access control in the Struts 1 ActionForm object.
Which versions of Struts are affected by RHSA-2014:0474?
Struts versions prior to 1.2.9-4jpp.8.el5_10 are affected by RHSA-2014:0474.
Is there a workaround for RHSA-2014:0474?
There are no specific workarounds for RHSA-2014:0474; the best action is to apply the recommended update.