Red Hat Bugzilla – Bug 1148260
CVE-2014-3682 jbpm-designer: XXE in BPMN2 import
Last modified: 2015-02-17 18:33:31 EST
An XXE flaw was found in the jbpm-designer BPMN2 import function. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
Acknowledgements: This issue was discovered by David Jorm of Red Hat Product Security.
Upstream fixes: master: https://github.com/droolsjbpm/jbpm-designer/commit/382e43a6a203c547b91eca41dc213da98fdbf3a6 6.2.x: https://github.com/droolsjbpm/jbpm-designer/commit/69d8f6b7a099594bd0536f88d528753875857088 master: https://github.com/droolsjbpm/droolsjbpm-integration/commit/c04255ecbfcc2a50b3ed9407f4fd4570309ac214 6.2.X: https://github.com/droolsjbpm/droolsjbpm-integration/commit/ef500fd8b6d6b84313daa37276dc403f359c2fff 6.0.x https://github.com/droolsjbpm/jbpm-designer/commit/5641588c730cc75dc3b76c34b76271fbd407fb84 https://github.com/droolsjbpm/jbpm-designer/commit/be3968d51299f6de0011324be60223ede49ecb1c https://github.com/droolsjbpm/droolsjbpm-integration/commit/2d2074a00d16ad0bb177dbd473c423898b83eb7b https://github.com/droolsjbpm/droolsjbpm-integration/commit/8a3862ba41d730dcc8a76ae0d86d63c75fd30295
This issue has been addressed in the following products: Red Hat JBoss BRMS 6.0.3 Via RHSA-2015:0235 https://rhn.redhat.com/errata/RHSA-2015-0235.html
This issue has been addressed in the following products: Red Hat JBoss BPM Suite 6.0.3 Via RHSA-2015:0234 https://rhn.redhat.com/errata/RHSA-2015-0234.html