RHSA-2013:1185: Important: Red Hat JBoss Fuse 6.0.0 patch 2

Red Hat JBoss Fuse 6.0.0, based on Apache ServiceMix, provides anintegration platform.Red Hat JBoss Fuse 6.0.0 patch 2 is an update to Red Hat JBoss Fuse 6.0.0and includes bug fixes. Refer to the readme file included with the patchfiles for information about these fixes.The following security issues are also resolved with this update:A flaw was found in the logging performed during deserialization of theBrokerFactory class in Apache OpenJPA. A remote attacker able to supply aserialized instance of the BrokerFactory class, which will be deserializedon a server, could use this flaw to write an executable file to theserver's file system. (CVE-2013-1768)A flaw in JRuby's JSON gem allowed remote attacks by creating differenttypes of malicious objects. For example, it could initiate a denial ofservice attack through resource consumption by using a JSON document tocreate arbitrary Ruby symbols, which were never garbage collected. It couldalso be exploited to create internal objects which could allow a SQLinjection attack. (CVE-2013-0269)It was discovered that JRuby's REXML library did not properly restrict XMLentity expansion. An attacker could use this flaw to cause a denial ofservice by tricking a Ruby application using REXML to read text nodes fromspecially-crafted XML content, which will result in REXML consuming largeamounts of system memory. (CVE-2013-1821)Note: Red Hat JBoss Fuse 6.0.0 ships JRuby as part of the camel-rubycomponent, which allows users to define Camel routes in Ruby. The defaultuse of JRuby in Red Hat JBoss Fuse 6.0.0 does not appear to expose eitherCVE-2013-0269 or CVE-2013-1821. If the version of JRuby shipped with RedHat JBoss Fuse 6.0.0 was used to build a custom application, then theseflaws could be exposed.Multiple denial of service flaws were found in the way the Apache CXF StAXparser implementation processed certain XML files. If a web serviceutilized the StAX parser, a remote attacker could provide aspecially-crafted XML file that, when processed, would lead to excessiveCPU and memory consumption. (CVE-2013-2160)Red Hat would like to thank Ruby on Rails upstream for reportingCVE-2013-0269, and Andreas Falkenberg of SEC Consult Deutschland GmbH, andChristian Mainka, Juraj Somorovsky and Joerg Schwenk of Ruhr-UniversityBochum for reporting CVE-2013-2160. Upstream acknowledges Thomas Hollsteggeof Zweitag and Ben Murphy as the original reporters of CVE-2013-0269.All users of Red Hat JBoss Fuse 6.0 as provided from the Red Hat CustomerPortal are advised to apply this patch.