RHSA-2014:0254: Important: activemq security update

Apache ActiveMQ provides a SOA infrastructure to connect processes acrossheterogeneous systems.A flaw was found in Apache Camel's parsing of the FILENAME header.A remote attacker able to submit messages to a Camel route, which wouldwrite the provided message to a file, could provide expression language(EL) expressions in the FILENAME header, which would be evaluated on theserver. This could lead to arbitrary remote code execution in the contextof the Camel server process. (CVE-2013-4330)It was found that the Apache Camel XSLT component allowed XSL stylesheetsto call external Java methods. A remote attacker able to submit messages toa Camel route could use this flaw to perform arbitrary remote codeexecution in the context of the Camel server process. (CVE-2014-0003)It was discovered that the Spring OXM wrapper did not expose any propertyfor disabling entity resolution when using the JAXB unmarshaller. A remoteattacker could use this flaw to conduct XML External Entity (XXE) attackson web sites, and read files in the context of the user running theapplication server. The patch for this flaw disables external entityprocessing by default, and provides a configuration directive to re-enableit. (CVE-2013-4152)The HawtJNI Library class wrote native libraries to a predictable file namein /tmp/ when the native libraries were bundled in a JAR file, and nocustom library path was specified. A local attacker could overwrite thesenative libraries with malicious versions during the window between whenHawtJNI writes them and when they are executed. (CVE-2013-2035)The CVE-2013-2035 issue was discovered by Florian Weimer of the Red HatProduct Security Team, and the CVE-2014-0003 issue was discovered by DavidJorm of the Red Hat Security Response Team.All users of Red Hat OpenShift Enterprise 1.2.7 are advised to upgrade tothis updated package, which corrects these issues.