Bug 781062 (SOA-3548)

Summary: CLONE - jruby.jar as shipped with the scripting_chain quickstart exposes CVE-2010-1330
Product: [JBoss] JBoss Enterprise SOA Platform 5 Reporter: Douglas Palmer <dpalmer>
Component: ExamplesAssignee: Default User <jbpapp-maint>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: 5.1.0 GACC: djorm
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
URL: http://jira.jboss.org/jira/browse/SOA-3548
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-02-03 04:13:46 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On:    
Bug Blocks: 784321, 787847    

Description Douglas Palmer 2011-11-02 10:17:47 UTC 
project_key: SOA

The jruby.jar file shipped with the scripting_chain quickstart appears to be vulnerable to CVE-2010-1330:

jboss-as/samples/quickstarts/scripting_chain/lib/jruby.jar

I have been unable to determine the exact version of jruby.jar that we are shipping, as it doesn't match any of the upstream md5sums and the MANIFEST.MF does not specify the version. Based on what I can see in MANIFEST.MF and the unpacked structure of the jar, it is likely to be version 1.1.x or 1.2.0. To mitigate this flaw, we should upgrade to >= 1.4.1 or >= 1.5.0. Details are here:

http://www.jruby.org/2010/04/26/jruby-1-4-1-xss-vulnerability.html

Since this is a moderate impact flaw that only affects a quickstart, the overall impact is low. We should upgrade the vulnerable component in the next release. If it is possible to squeeze this update into 5.2.0 that would be ideal, but I'm not calling it a blocker.
Comment 1 Douglas Palmer 2011-11-02 10:17:47 UTC 
Link: Added: This issue Cloned from SOA-3539
Comment 2 David Jorm 2012-02-03 04:13:46 UTC 
This issue has been addressed in following products:

JBoss Enterprise SOA Platform 5.2.0

Via RHSA-2011:1456 https://rhn.redhat.com/errata/RHSA-2011-1456.html