RHSA-2014:1170: Important: Red Hat JBoss Fuse/A-MQ 6.1.0 security update
Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint,flexible, open source enterprise service bus and integration platform. RedHat JBoss A-MQ, based on Apache ActiveMQ, is a standards-compliantmessaging system that is tailored for use in mission critical applications.Red Hat JBoss Fuse and A-MQ include the insight plug-in, which providesinsight into a Fuse Fabric using Elasticsearch to query data for logs,metrics or historic Camel messages. This plug-in is not enabled by default,and is provided as a technology preview. If it is enabled by installing thefeature, for example:JBossFuse:karaf@root> features:install insight-elasticsearchThen an Elasticsearch server will be started. It was discovered that thedefault configuration of Elasticsearch enabled dynamic scripting, allowinga remote attacker to execute arbitrary MVEL expressions and Java code viathe source parameter passed to search. (CVE-2014-3120)All users of Red Hat JBoss Fuse and A-MQ 6.1.0 as provided from the Red HatCustomer Portal who have enabled Elasticsearch are advised to follow theinstructions provided in the Solution section of this advisory.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2014:1170?
The severity of RHSA-2014:1170 is classified as important.
How do I fix RHSA-2014:1170?
To fix RHSA-2014:1170, apply the recommended updates provided by Red Hat.
Which products are affected by RHSA-2014:1170?
RHSA-2014:1170 affects Red Hat JBoss Fuse and Red Hat JBoss A-MQ.
Is there a workaround for RHSA-2014:1170?
There is no specific workaround recommended for RHSA-2014:1170; applying the update is advised.
When was RHSA-2014:1170 released?
RHSA-2014:1170 was released in 2014.