Bug 1559316 (CVE-2018-1000130) - CVE-2018-1000130 jolokia: JMX proxy mode vulnerable to remote code execution
Summary: CVE-2018-1000130 jolokia: JMX proxy mode vulnerable to remote code execution
Status: NEW
Alias: CVE-2018-1000130
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=important,public=20180208,repo...
Keywords: Security
Depends On: 1561310
Blocks: 1559319
TreeView+ depends on / blocked
 
Reported: 2018-03-22 09:43 UTC by Andrej Nemec
Modified: 2019-04-17 14:29 UTC (History)
21 users (show)

(edit)
Clone Of:
(edit)
Last Closed:


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:2669 None None None 2018-09-11 07:54 UTC

Description Andrej Nemec 2018-03-22 09:43:25 UTC
A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java code on the server. Note that this only affects the WAR agent, which has the proxy mode enabled by default. The JVM agent is not affected as it does not support the JMX proxy mode

External References:

https://jolokia.org/#Security_fixes_with_1.5.0

References:

https://snyk.io/vuln/SNYK-JAVA-ORGJOLOKIA-32137

Comment 2 Summer Long 2018-03-26 05:52:01 UTC
Upstream commits to support white-listing JMX service urls and fix war-agent defaults:
* https://github.com/rhuss/jolokia/commit/1b360b8889f0ed51165a8d1ac55dd8e0aa2dfd4a
* https://github.com/rhuss/jolokia/commit/fd7b93da30c61a45bac10d8b311f1b79a74910f5

Comment 7 Andrej Nemec 2018-05-14 15:25:04 UTC
Statement:

Red Hat Product Security has rated this issue as having security impact of Low for:
* Red Hat OpenStack Platform 9.0 (Mitaka)
* Red Hat OpenStack Platform 10.0 (Newton) 
* Red Hat OpenStack Platform 11.0 (Ocata)
* Red Hat OpenStack Platform 12.0 (Pike)

Although the affected code is present in shipped packages, proxy mode is not enabled by default.  The affected code is not used in any supported configuration of Red Hat OpenStack Platform.  This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Comment 8 errata-xmlrpc 2018-09-11 07:54:15 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Fuse

Via RHSA-2018:2669 https://access.redhat.com/errata/RHSA-2018:2669


Note You need to log in before you can comment on or make changes to this bug.