RHSA-2014:0497: Important: Red Hat JBoss Fuse 6.1.0 security update
Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint,flexible, open source enterprise service bus and integration platform.It was found that the Struts 1 ActionForm object allowed access to the'class' parameter, which is directly mapped to the getClass() method.A remote attacker could use this flaw to manipulate the ClassLoader used byan application server running Struts 1. This could lead to remote codeexecution under certain conditions. (CVE-2014-0114)Refer to the readme.txt file included with the patch files forinstallation instructions.All users of Red Hat JBoss Fuse 6.1.0 as provided from the Red Hat CustomerPortal are advised to apply this security update.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2014:0497?
The severity of RHSA-2014:0497 is classified as important.
How do I fix RHSA-2014:0497?
To fix RHSA-2014:0497, apply the latest security patches provided by Red Hat for JBoss Fuse.
What software is affected by RHSA-2014:0497?
RHSA-2014:0497 affects Red Hat JBoss Fuse based on Apache ServiceMix.
What is the main issue described in RHSA-2014:0497?
The main issue described in RHSA-2014:0497 involves a vulnerability in the Struts 1 ActionForm object which allows unauthorized access to the 'class' parameter.
Is there a workaround for RHSA-2014:0497?
A specific workaround for RHSA-2014:0497 is not detailed; updating to the latest versions is recommended.