Bug 781062 (SOA-3548) - CLONE - jruby.jar as shipped with the scripting_chain quickstart exposes CVE-2010-1330
Summary: CLONE - jruby.jar as shipped with the scripting_chain quickstart exposes CVE-...
Keywords:
Status: CLOSED ERRATA
Alias: SOA-3548
Product: JBoss Enterprise SOA Platform 5
Classification: JBoss
Component: Examples
Version: 5.1.0 GA
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
: ---
Assignee: Default User
QA Contact:
URL: http://jira.jboss.org/jira/browse/SOA...
Whiteboard:
Depends On:
Blocks: 784321 787847
TreeView+ depends on / blocked
 
Reported: 2011-11-02 10:17 UTC by Douglas Palmer
Modified: 2012-02-06 22:10 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-02-03 04:13:46 UTC
Type: Bug

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 781053 0 medium CLOSED jruby.jar as shipped with the scripting_chain quickstart exposes CVE-2010-1330 2021-02-22 00:41:40 UTC
Red Hat Issue Tracker SOA-3548 0 None Closed CLONE - jruby.jar as shipped with the scripting_chain quickstart exposes CVE-2010-1330 2012-04-14 14:07:10 UTC

Internal Links: 781053

Description Douglas Palmer 2011-11-02 10:17:47 UTC 
project_key: SOA

The jruby.jar file shipped with the scripting_chain quickstart appears to be vulnerable to CVE-2010-1330:

jboss-as/samples/quickstarts/scripting_chain/lib/jruby.jar

I have been unable to determine the exact version of jruby.jar that we are shipping, as it doesn't match any of the upstream md5sums and the MANIFEST.MF does not specify the version. Based on what I can see in MANIFEST.MF and the unpacked structure of the jar, it is likely to be version 1.1.x or 1.2.0. To mitigate this flaw, we should upgrade to >= 1.4.1 or >= 1.5.0. Details are here:

http://www.jruby.org/2010/04/26/jruby-1-4-1-xss-vulnerability.html

Since this is a moderate impact flaw that only affects a quickstart, the overall impact is low. We should upgrade the vulnerable component in the next release. If it is possible to squeeze this update into 5.2.0 that would be ideal, but I'm not calling it a blocker.
Comment 1 Douglas Palmer 2011-11-02 10:17:47 UTC 
Link: Added: This issue Cloned from SOA-3539
Comment 2 David Jorm 2012-02-03 04:13:46 UTC 
This issue has been addressed in following products:

JBoss Enterprise SOA Platform 5.2.0

Via RHSA-2011:1456 https://rhn.redhat.com/errata/RHSA-2011-1456.html
Note You need to log in before you can comment on or make changes to this bug.