9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.774 High
EPSS
Percentile
97.7%
Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint,
flexible, open source enterprise service bus and integration platform.
Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant
messaging system that is tailored for use in mission critical applications.
This patch is an update to Red Hat JBoss Fuse 6.1.0 and Red Hat JBoss A-MQ
6.1.0. It includes a bug fix, which is documented in the readme.txt file
included with the patch files. The following security issues are addressed
in this release:
It was found that if a configured LDAP server supported the unauthenticated
authentication mechanism (as described by RFC 4513), the LDAPLoginModule
implementation, provided by ActiveMQ Java Authentication and Authorization
Service (JAAS), would consider an authentication attempt to be successful
for a valid user that provided an empty password. A remote attacker could
use this flaw to bypass the authentication mechanism of an application
using LDAPLoginModule, and assume a role of any valid user within
that application. (CVE-2014-3612)
It was discovered that Apache ActiveMQ performed XML External Entity (XXE)
expansion when evaluating XPath expressions. A remote, attacker-controlled
consumer able to specify an XPath-based selector to dequeue XML messages
from an Apache ActiveMQ broker could use this flaw to read files accessible
to the user running the broker, and potentially perform other more advanced
XXE attacks. (CVE-2014-3600)
Red Hat would like to thank Georgi Geshev of MWR Labs for reporting these
issues.
Refer to the readme.txt file included with the patch files for
installation instructions.
All users of Red Hat JBoss Fuse 6.1.0 and Red Hat JBoss A-MQ 6.1.0 as
provided from the Red Hat Customer Portal are advised to apply this
security update.
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.774 High
EPSS
Percentile
97.7%