RHSA-2014:0500: Important: struts security update
Red Hat Satellite is a systems management tool for Linux-basedinfrastructures. It allows for provisioning, monitoring, and remotemanagement of multiple Linux deployments with a single, centralized tool.Apache Struts is a framework for building web applications with Java.It was found that the Struts 1 ActionForm object allowed access to the'class' parameter, which is directly mapped to the getClass() method. Aremote attacker could use this flaw to manipulate the ClassLoader used byan application server running Struts 1. This could lead to remote codeexecution under certain conditions. (CVE-2014-0114)All Satellite users are advised to upgrade to these updated packages, whichcontain a backported patch to correct this issue. For this update to takeeffect, the tomcat6 service must be restarted ("service tomcat6 restart").
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2014:0500?
The severity of RHSA-2014:0500 is classified as important.
How do I fix RHSA-2014:0500?
To fix RHSA-2014:0500, update the affected struts packages to version 1.3.10-6.ep5.el6 or later.
Which packages are affected by RHSA-2014:0500?
RHSA-2014:0500 affects struts, struts-core, struts-extras, struts-taglib, and struts-tiles packages.
Is there a workaround for RHSA-2014:0500?
There are no official workarounds provided for RHSA-2014:0500 other than applying the available patch.
What systems are impacted by RHSA-2014:0500?
RHSA-2014:0500 impacts Red Hat Enterprise Linux 6 systems that have the affected struts packages installed.