RHSA-2014:0245

Vulnerability from csaf_redhat - Published: 2014-03-03 18:25 - Updated: 2026-01-28 22:54
Summary
Red Hat Security Advisory: activemq security update
Severity
Important
Notes
Topic: An updated activemq package that fixes multiple security issues is now available for Red Hat OpenShift Enterprise 2.0. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
Details: Apache ActiveMQ provides a SOA infrastructure to connect processes across heterogeneous systems. A flaw was found in Apache Camel's parsing of the FILE_NAME header. A remote attacker able to submit messages to a Camel route, which would write the provided message to a file, could provide expression language (EL) expressions in the FILE_NAME header, which would be evaluated on the server. This could lead to arbitrary remote code execution in the context of the Camel server process. (CVE-2013-4330) It was found that the Apache Camel XSLT component allowed XSL stylesheets to call external Java methods. A remote attacker able to submit messages to a Camel route could use this flaw to perform arbitrary remote code execution in the context of the Camel server process. (CVE-2014-0003) It was discovered that the Spring OXM wrapper did not expose any property for disabling entity resolution when using the JAXB unmarshaller. A remote attacker could use this flaw to conduct XML External Entity (XXE) attacks on web sites, and read files in the context of the user running the application server. The patch for this flaw disables external entity processing by default, and provides a configuration directive to re-enable it. (CVE-2013-4152) The HawtJNI Library class wrote native libraries to a predictable file name in /tmp/ when the native libraries were bundled in a JAR file, and no custom library path was specified. A local attacker could overwrite these native libraries with malicious versions during the window between when HawtJNI writes them and when they are executed. (CVE-2013-2035) The CVE-2013-2035 issue was discovered by Florian Weimer of the Red Hat Product Security Team, and the CVE-2014-0003 issue was discovered by David Jorm of the Red Hat Security Response Team. All users of Red Hat OpenShift Enterprise 2.0 are advised to upgrade to this updated package, which corrects these issues.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2013-2035

The HawtJNI Library class wrote native libraries to a predictable file name in /tmp when the native libraries were bundled in a JAR file, and no custom library path was specified. A local attacker could overwrite these native libraries with malicious versions during the window between when HawtJNI writes them and when they are executed.

3.3 ()
AV:L/AC:M/Au:N/C:P/I:P/A:N
CWE-377 - Insecure Temporary File
Vendor Fix Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 https://access.redhat.com/errata/RHSA-2014:0245
CVE-2013-4152

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.

5.0 ()
AV:N/AC:L/Au:N/C:P/I:N/A:N
Vendor Fix Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 https://access.redhat.com/errata/RHSA-2014:0245
CVE-2013-4330

Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including "$simple{}" in a CamelFileName message header to a (1) FILE or (2) FTP producer.

6.8 ()
AV:N/AC:M/Au:N/C:P/I:P/A:P
Vendor Fix Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 https://access.redhat.com/errata/RHSA-2014:0245
CVE-2014-0003

The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.

6.0 ()
AV:N/AC:M/Au:S/C:P/I:P/A:P
Vendor Fix Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 https://access.redhat.com/errata/RHSA-2014:0245
References
https://access.redhat.com/errata/RHSA-2014:0245 self
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=958618 external
https://bugzilla.redhat.com/show_bug.cgi?id=1000186 external
https://bugzilla.redhat.com/show_bug.cgi?id=1011726 external
https://bugzilla.redhat.com/show_bug.cgi?id=1049692 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2013-2035 self
https://bugzilla.redhat.com/show_bug.cgi?id=958618 external
https://www.cve.org/CVERecord?id=CVE-2013-2035 external
https://nvd.nist.gov/vuln/detail/CVE-2013-2035 external
https://access.redhat.com/security/cve/CVE-2013-4152 self
https://bugzilla.redhat.com/show_bug.cgi?id=1000186 external
https://www.cve.org/CVERecord?id=CVE-2013-4152 external
https://nvd.nist.gov/vuln/detail/CVE-2013-4152 external
http://www.gopivotal.com/security/cve-2013-4152 external
https://github.com/SpringSource/spring-framework/… external
https://jira.springsource.org/browse/SPR-10806 external
https://access.redhat.com/security/cve/CVE-2013-4330 self
https://bugzilla.redhat.com/show_bug.cgi?id=1011726 external
https://www.cve.org/CVERecord?id=CVE-2013-4330 external
https://nvd.nist.gov/vuln/detail/CVE-2013-4330 external
https://access.redhat.com/security/cve/CVE-2014-0003 self
https://bugzilla.redhat.com/show_bug.cgi?id=1049692 external
https://www.cve.org/CVERecord?id=CVE-2014-0003 external
https://nvd.nist.gov/vuln/detail/CVE-2014-0003 external
http://camel.apache.org/security-advisories.data/… external
Acknowledgments
Red Hat Product Security Team Florian Weimer
Red Hat Security Response Team David Jorm
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated activemq package that fixes multiple security issues is now\navailable for Red Hat OpenShift Enterprise 2.0.\n\nThe Red Hat Security Response Team has rated this update as having\nImportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Apache ActiveMQ provides a SOA infrastructure to connect processes across\nheterogeneous systems.\n\nA flaw was found in Apache Camel\u0027s parsing of the FILE_NAME header.\nA remote attacker able to submit messages to a Camel route, which would\nwrite the provided message to a file, could provide expression language\n(EL) expressions in the FILE_NAME header, which would be evaluated on the\nserver. This could lead to arbitrary remote code execution in the context\nof the Camel server process. (CVE-2013-4330)\n\nIt was found that the Apache Camel XSLT component allowed XSL stylesheets\nto call external Java methods. A remote attacker able to submit messages to\na Camel route could use this flaw to perform arbitrary remote code\nexecution in the context of the Camel server process. (CVE-2014-0003)\n\nIt was discovered that the Spring OXM wrapper did not expose any property\nfor disabling entity resolution when using the JAXB unmarshaller. A remote\nattacker could use this flaw to conduct XML External Entity (XXE) attacks\non web sites, and read files in the context of the user running the\napplication server. The patch for this flaw disables external entity\nprocessing by default, and provides a configuration directive to re-enable\nit. (CVE-2013-4152)\n\nThe HawtJNI Library class wrote native libraries to a predictable file name\nin /tmp/ when the native libraries were bundled in a JAR file, and no\ncustom library path was specified. A local attacker could overwrite these\nnative libraries with malicious versions during the window between when\nHawtJNI writes them and when they are executed. (CVE-2013-2035)\n\nThe CVE-2013-2035 issue was discovered by Florian Weimer of the Red Hat\nProduct Security Team, and the CVE-2014-0003 issue was discovered by David\nJorm of the Red Hat Security Response Team.\n\nAll users of Red Hat OpenShift Enterprise 2.0 are advised to upgrade to\nthis updated package, which corrects these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:0245",
        "url": "https://access.redhat.com/errata/RHSA-2014:0245"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "958618",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=958618"
      },
      {
        "category": "external",
        "summary": "1000186",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1000186"
      },
      {
        "category": "external",
        "summary": "1011726",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1011726"
      },
      {
        "category": "external",
        "summary": "1049692",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0245.json"
      }
    ],
    "title": "Red Hat Security Advisory: activemq security update",
    "tracking": {
      "current_release_date": "2026-01-28T22:54:28+00:00",
      "generator": {
        "date": "2026-01-28T22:54:28+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.16"
        }
      },
      "id": "RHSA-2014:0245",
      "initial_release_date": "2014-03-03T18:25:38+00:00",
      "revision_history": [
        {
          "date": "2014-03-03T18:25:38+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-03-03T18:25:38+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-01-28T22:54:28+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHOSE Infrastructure 2.0",
                "product": {
                  "name": "RHOSE Infrastructure 2.0",
                  "product_id": "6Server-RHOSE-INFRA-2.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:2.0::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "RHOSE Node 2.0",
                "product": {
                  "name": "RHOSE Node 2.0",
                  "product_id": "6Server-RHOSE-NODE-2.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:2.0::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "activemq-0:5.9.0-4.redhat.610328.el6op.src",
                "product": {
                  "name": "activemq-0:5.9.0-4.redhat.610328.el6op.src",
                  "product_id": "activemq-0:5.9.0-4.redhat.610328.el6op.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/activemq@5.9.0-4.redhat.610328.el6op?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64",
                "product": {
                  "name": "activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64",
                  "product_id": "activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/activemq-client@5.9.0-4.redhat.610328.el6op?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
                "product": {
                  "name": "activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
                  "product_id": "activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/activemq@5.9.0-4.redhat.610328.el6op?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "activemq-0:5.9.0-4.redhat.610328.el6op.src as a component of RHOSE Infrastructure 2.0",
          "product_id": "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src"
        },
        "product_reference": "activemq-0:5.9.0-4.redhat.610328.el6op.src",
        "relates_to_product_reference": "6Server-RHOSE-INFRA-2.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "activemq-0:5.9.0-4.redhat.610328.el6op.x86_64 as a component of RHOSE Infrastructure 2.0",
          "product_id": "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64"
        },
        "product_reference": "activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-INFRA-2.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64 as a component of RHOSE Infrastructure 2.0",
          "product_id": "6Server-RHOSE-INFRA-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64"
        },
        "product_reference": "activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-INFRA-2.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "activemq-0:5.9.0-4.redhat.610328.el6op.src as a component of RHOSE Node 2.0",
          "product_id": "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src"
        },
        "product_reference": "activemq-0:5.9.0-4.redhat.610328.el6op.src",
        "relates_to_product_reference": "6Server-RHOSE-NODE-2.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "activemq-0:5.9.0-4.redhat.610328.el6op.x86_64 as a component of RHOSE Node 2.0",
          "product_id": "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64"
        },
        "product_reference": "activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-NODE-2.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64 as a component of RHOSE Node 2.0",
          "product_id": "6Server-RHOSE-NODE-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64"
        },
        "product_reference": "activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-NODE-2.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Florian Weimer"
          ],
          "organization": "Red Hat Product Security Team",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2013-2035",
      "cwe": {
        "id": "CWE-377",
        "name": "Insecure Temporary File"
      },
      "discovery_date": "2013-04-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "958618"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The HawtJNI Library class wrote native libraries to a predictable file name in /tmp when the native libraries were bundled in a JAR file, and no custom library path was specified. A local attacker could overwrite these native libraries with malicious versions during the window between when HawtJNI writes them and when they are executed.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "HawtJNI: predictable temporary file name leading to local arbitrary code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
          "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
          "6Server-RHOSE-INFRA-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64",
          "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
          "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
          "6Server-RHOSE-NODE-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-2035"
        },
        {
          "category": "external",
          "summary": "RHBZ#958618",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=958618"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-2035",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-2035"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-2035",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2035"
        }
      ],
      "release_date": "2013-05-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-03-03T18:25:38+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
            "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-INFRA-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
            "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-NODE-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0245"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
            "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-INFRA-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
            "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-NODE-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "HawtJNI: predictable temporary file name leading to local arbitrary code execution"
    },
    {
      "cve": "CVE-2013-4152",
      "discovery_date": "2013-08-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1000186"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Framework: XML External Entity (XXE) injection flaw",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
          "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
          "6Server-RHOSE-INFRA-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64",
          "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
          "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
          "6Server-RHOSE-NODE-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4152"
        },
        {
          "category": "external",
          "summary": "RHBZ#1000186",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1000186"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4152",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4152"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4152",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4152"
        },
        {
          "category": "external",
          "summary": "http://www.gopivotal.com/security/cve-2013-4152",
          "url": "http://www.gopivotal.com/security/cve-2013-4152"
        },
        {
          "category": "external",
          "summary": "https://github.com/SpringSource/spring-framework/pull/317",
          "url": "https://github.com/SpringSource/spring-framework/pull/317"
        },
        {
          "category": "external",
          "summary": "https://jira.springsource.org/browse/SPR-10806",
          "url": "https://jira.springsource.org/browse/SPR-10806"
        }
      ],
      "release_date": "2013-08-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-03-03T18:25:38+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
            "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-INFRA-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
            "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-NODE-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0245"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
            "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-INFRA-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
            "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-NODE-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Framework: XML External Entity (XXE) injection flaw"
    },
    {
      "cve": "CVE-2013-4330",
      "discovery_date": "2013-09-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1011726"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including \"$simple{}\" in a CamelFileName message header to a (1) FILE or (2) FTP producer.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Camel: remote code execution via header field manipulation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
          "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
          "6Server-RHOSE-INFRA-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64",
          "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
          "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
          "6Server-RHOSE-NODE-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4330"
        },
        {
          "category": "external",
          "summary": "RHBZ#1011726",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1011726"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4330",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4330"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4330",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4330"
        }
      ],
      "release_date": "2013-09-30T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-03-03T18:25:38+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
            "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-INFRA-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
            "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-NODE-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0245"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
            "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-INFRA-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
            "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-NODE-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Camel: remote code execution via header field manipulation"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "David Jorm"
          ],
          "organization": "Red Hat Security Response Team",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2014-0003",
      "discovery_date": "2014-01-07T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1049692"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Camel: remote code execution via XSL",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
          "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
          "6Server-RHOSE-INFRA-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64",
          "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
          "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
          "6Server-RHOSE-NODE-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0003"
        },
        {
          "category": "external",
          "summary": "RHBZ#1049692",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1049692"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0003",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0003"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0003"
        },
        {
          "category": "external",
          "summary": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc",
          "url": "http://camel.apache.org/security-advisories.data/CVE-2014-0003.txt.asc"
        }
      ],
      "release_date": "2014-02-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-03-03T18:25:38+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
            "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-INFRA-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
            "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-NODE-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0245"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
            "6Server-RHOSE-INFRA-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-INFRA-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.src",
            "6Server-RHOSE-NODE-2.0:activemq-0:5.9.0-4.redhat.610328.el6op.x86_64",
            "6Server-RHOSE-NODE-2.0:activemq-client-0:5.9.0-4.redhat.610328.el6op.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Camel: remote code execution via XSL"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.