(RHSA-2013:1428) Important: jakarta-commons-fileupload security update

2013-10-15T04:00:00
ID RHSA-2013:1428
Type redhat
Reporter RedHat
Modified 2018-06-07T02:42:41

Description

The Apache Commons FileUpload component can be used to add a file upload capability to your applications.

A flaw was found in the way the DiskFileItem class handled NULL characters in file names. A remote attacker able to supply a serialized instance of the DiskFileItem class, which will be deserialized on a server, could use this flaw to write arbitrary content to any location on the server that is accessible to the user running the application server process. (CVE-2013-2186)

Warning: Before applying the update, back up your existing Red Hat JBoss Enterprise Web Server installation (including all applications and configuration files).

All users of Red Hat JBoss Web Server 1.0.2 on Red Hat Enterprise Linux 5 and 6 are advised to upgrade to this updated package. The JBoss server process must be restarted for the update to take effect.