RHSA-2014:0511: Important: Red Hat JBoss Operations Network 3.2.1 security update

Red Hat JBoss Operations Network is a middleware management solution thatprovides a single point of control to deploy, manage, and monitor JBossEnterprise Middleware, applications, and services.Apache Struts is a framework for building web applications with Java.It was found that the Struts 1 ActionForm object allowed access to the'class' parameter, which is directly mapped to the getClass() method. Aremote attacker could use this flaw to manipulate the ClassLoader used byan application server running Struts 1. This could lead to remote codeexecution under certain conditions. (CVE-2014-0114)It was found that when JBoss Web processed a series of HTTP requests inwhich at least one request contained either multiple content-lengthheaders, or one content-length header with a chunked transfer-encodingheader, JBoss Web would incorrectly handle the request. A remote attackercould use this flaw to poison a web cache, perform cross-site scripting(XSS) attacks, or obtain sensitive information from other requests.(CVE-2013-4286)All users of JBoss Operations Network 3.2.1 as provided from the Red HatCustomer Portal are advised to apply this update.