RHSA-2016:2035HighCVSS 9.8

Red Hat Security Advisory: Red Hat JBoss Fuse 6.3 security update

Published
October 6, 2016
Last Modified
November 5, 2026

🔗 CVE IDs covered (8)

CVE-2015-7940 →CVE-2016-2141 →CVE-2016-2510 →CVE-2016-4437 →CVE-2015-3192 →CVE-2015-5254 →CVE-2015-5344 →CVE-2015-5348 →

📋 Description

CVE-2015-3192 — Framework: denial-of-service attack with XML input CVE-2015-5254 — ObjectMessage: unsafe deserialization CVE-2015-5344 — camel-xstream: Java object de-serialization vulnerability leads to RCE CVE-2015-5348 — Camel: Java object deserialisation in Jetty/Servlet CVE-2015-7940 — bouncycastle: Invalid curve attack allowing to extract private keys CVE-2016-2141 — JGroups: Authorization bypass CVE-2016-2510 — bsh2: remote code execution via deserialization CVE-2016-4437 — shiro: Security constraint bypass

🎯 Affected products1

  • Red Hat JBoss Fuse 6.3

✅ Remediation

The References section of this erratum contains a download link (you must log in to download the update). Workaround: If you do deploy a JMS publisher, and subscriber, and don't trust the messages sent to you by your clients, you could mitigate this issue by installing a Java agent which restricts the classes which can be deserialized. This is an article with the recommended approach: https://access.redhat.com/solutions/2190911 You could also mitigate this issue using the features of the Java Virtual Machine added in JEP 290: http://openjdk.java.net/jeps/290 Workaround: Please refer to https://access.redhat.com/articles/2360521 for more information.

🔗 References (12)