RHSA-2014:0498: Important: Fuse ESB Enterprise 7.1.0 security update
Fuse ESB Enterprise is an integration platform based on Apache ServiceMix.It was found that the Struts 1 ActionForm object allowed access to the'class' parameter, which is directly mapped to the getClass() method.A remote attacker could use this flaw to manipulate the ClassLoader used byan application server running Struts 1. This could lead to remote codeexecution under certain conditions. (CVE-2014-0114)Refer to the readme.txt file included with the patch files forinstallation instructions.All users of Fuse ESB Enterprise 7.1.0 as provided from the Red HatCustomer Portal are advised to apply this security update.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2014:0498?
The severity of RHSA-2014:0498 is classified as important.
How do I fix RHSA-2014:0498?
To fix RHSA-2014:0498, you should update to the latest version of Fuse ESB Enterprise that includes the security patch.
What vulnerability does RHSA-2014:0498 address?
RHSA-2014:0498 addresses a vulnerability in the Struts 1 ActionForm object that allows unauthorized access to the 'class' parameter.
Can RHSA-2014:0498 lead to remote code execution?
Yes, a remote attacker could exploit RHSA-2014:0498 to manipulate the class loading mechanism, potentially leading to remote code execution.
Is RHSA-2014:0498 applicable to all versions of Fuse ESB Enterprise?
RHSA-2014:0498 specifically affects versions prior to the patched release that addresses the vulnerability.