(RHSA-2014:1284) Moderate: Red Hat JBoss Data Virtualization 6.0.0 security update

Red Hat JBoss Data Virtualization is a lean data integration solution that
provides easy, real-time, and unified data access across disparate sources
to multiple applications and users. JBoss Data Virtualization makes data
spread across physically distinct systems—such as multiple databases, XML
files, and even Hadoop systems—appear as a set of tables in a local
database.

This roll up patch serves as a cumulative upgrade for Red Hat JBoss Data
Virtualization 6.0.0. It includes various bug fixes, which are listed in
the README file included with the patch files.

The following security issue is also fixed with this release:

It was found that Teiid SQL/XML permitted XML eXternal Entity (XXE)
attacks. If a REST endpoint was deployed, a remote attacker could submit a
request containing an external XML entity that, when resolved, allowed that
attacker to read files on the application server in the context of the user
running that server. (CVE-2014-0170)

This issue was discovered by David Jorm of Red Hat Product Security.

All users of Red Hat JBoss Data Virtualization 6.0.0 as provided from the
Red Hat Customer Portal are advised to apply this roll up patch.