Bug 1559316 (CVE-2018-1000130)

Summary:	CVE-2018-1000130 jolokia: JMX proxy mode vulnerable to remote code execution
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aileenc, apevec, chazlett, chrisw, drieden, ggaughan, janstey, jjoyce, jochrist, jolee, jpadman, jschatte, jschluet, jstastny, jwon, kbasil, lhh, lpeer, markmc, mburns, mkolesni, rbryant, sclewis, slinaber, tdecacqu, vhalbert
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	jolokia-core 1.5.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:18:23 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1561310
Bug Blocks:	1559319

Description Andrej Nemec 2018-03-22 09:43:25 UTC

A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java code on the server. Note that this only affects the WAR agent, which has the proxy mode enabled by default. The JVM agent is not affected as it does not support the JMX proxy mode

External References:

https://jolokia.org/#Security_fixes_with_1.5.0

References:

https://snyk.io/vuln/SNYK-JAVA-ORGJOLOKIA-32137

Comment 2 Summer Long 2018-03-26 05:52:01 UTC

Upstream commits to support white-listing JMX service urls and fix war-agent defaults:
* https://github.com/rhuss/jolokia/commit/1b360b8889f0ed51165a8d1ac55dd8e0aa2dfd4a
* https://github.com/rhuss/jolokia/commit/fd7b93da30c61a45bac10d8b311f1b79a74910f5

Comment 8 errata-xmlrpc 2018-09-11 07:54:15 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Fuse

Via RHSA-2018:2669 https://access.redhat.com/errata/RHSA-2018:2669

Comment 11 Summer Long 2021-01-14 06:11:11 UTC

Statement:

For Red Hat OpenStack Platform, although the affected code is present in shipped packages, proxy mode is not enabled by default and the affected code is not used in any supported configuration of Red Hat OpenStack Platform.  For this reason, the RHOSP impact as been reduced to Low and this issue is not currently planned to be addressed in future updates.