Bug 781061 (SOA-3547) - CLONE - jruby.jar as shipped with the scripting_chain quickstart exposes CVE-2010-1330
Summary: CLONE - jruby.jar as shipped with the scripting_chain quickstart exposes CVE-...
Keywords:
Status: CLOSED WONTFIX
Alias: SOA-3547
Product: JBoss Enterprise SOA Platform 4
Classification: JBoss
Component: Examples
Version: 4.3 CP05
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
: ---
Assignee: Default User
QA Contact:
URL: http://jira.jboss.org/jira/browse/SOA...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-11-02 10:15 UTC by Douglas Palmer
Modified: 2013-02-28 04:13 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-02-28 04:13:53 UTC
Type: Bug

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 781053 0 medium CLOSED jruby.jar as shipped with the scripting_chain quickstart exposes CVE-2010-1330 2021-02-22 00:41:40 UTC
Red Hat Issue Tracker SOA-3547 0 Minor Closed CLONE - jruby.jar as shipped with the scripting_chain quickstart exposes CVE-2010-1330 2013-02-28 04:14:00 UTC

Internal Links: 781053

Description Douglas Palmer 2011-11-02 10:15:59 UTC 
project_key: SOA

The jruby.jar file shipped with the scripting_chain quickstart appears to be vulnerable to CVE-2010-1330:

jboss-as/samples/quickstarts/scripting_chain/lib/jruby.jar

I have been unable to determine the exact version of jruby.jar that we are shipping, as it doesn't match any of the upstream md5sums and the MANIFEST.MF does not specify the version. Based on what I can see in MANIFEST.MF and the unpacked structure of the jar, it is likely to be version 1.1.x or 1.2.0. To mitigate this flaw, we should upgrade to >= 1.4.1 or >= 1.5.0. Details are here:

http://www.jruby.org/2010/04/26/jruby-1-4-1-xss-vulnerability.html

Since this is a moderate impact flaw that only affects a quickstart, the overall impact is low. We should upgrade the vulnerable component in the next release. If it is possible to squeeze this update into 5.2.0 that would be ideal, but I'm not calling it a blocker.
Comment 1 Douglas Palmer 2011-11-02 10:16:00 UTC 
Link: Added: This issue Cloned from SOA-3539
Comment 2 David Jorm 2013-02-28 04:13:53 UTC 
Since this flaw is of moderate impact, and SOA-P 4 is in the critical/important-only support phase, closing this as WONTFIX.
Note You need to log in before you can comment on or make changes to this bug.