Bug 1133649 (CVE-2014-3600)
| Summary: | CVE-2014-3600 Apache ActiveMQ: XXE via XPath expression evaluation | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Chess Hazlett <chazlett> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aneelica, ccoleman, dbosanac, dmcphers, jialiu, jokerman, kseifried, lmeyer, mmccomas, mmcgrath, security-response-team, weli |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | activemq 5.11.0 | Doc Type: | Bug Fix |
| Doc Text: |
It was discovered that Apache ActiveMQ performed XML External Entity (XXE) expansion when evaluating XPath expressions. A remote, attacker-controlled consumer able to specify an XPath-based selector to dequeue XML messages from an Apache ActiveMQ broker could use this flaw to read files accessible to the user running the broker, and potentially perform other more advanced XXE attacks.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-02-05 22:51:56 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1165374 | ||
| Bug Blocks: | 1130476, 1183155 | ||
|
Description
Chess Hazlett
2014-08-25 17:34:36 UTC
Upstream Issue: https://issues.apache.org/jira/browse/AMQ-5333 Upstream Commit: https://git-wip-us.apache.org/repos/asf?p=activemq.git;a=commit;h=b9696ac8 Acknowledgements: Red Hat would like to thank Georgi Geshev of MWR Labs for reporting this issue. Statement: Fuse ESB 4 and Fuse Message Broker 5.2, 5.3, 5.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/ Fuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/ Red Hat JBoss SOA Platform 4 is now in Phase 3, Extended Life Support, of its respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ Red Hat OpenShift Enterprise 1 and 2 are now in Production 1 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat OpenShift Enterprise Life Cycle: https://access.redhat.com/site/support/policy/updates/openshift/ This issue has been addressed in the following products: Fuse ESB Enterprise 7.1.0 Fuse MQ Enterprise 7.1.0 Via RHSA-2015:0138 https://rhn.redhat.com/errata/RHSA-2015-0138.html This issue has been addressed in the following products: Red Hat JBoss Fuse 6.1.0 Red Hat JBoss A-MQ 6.1.0 Via RHSA-2015:0137 https://rhn.redhat.com/errata/RHSA-2015-0137.html |