RHSA-2014:1370: Moderate: Apache POI security update
Apache POI is a library providing Java API for working with OOXML documentfiles.It was found that Apache POI would resolve entities in OOXML documents.A remote attacker able to supply OOXML documents that are parsed by ApachePOI could use this flaw to read files accessible to the user running theapplication server, and potentially perform more advanced XML ExternalEntity (XXE) attacks. (CVE-2014-3529)It was found that Apache POI would expand an unlimited number of entitiesin OOXML documents. A remote attacker able to supply OOXML documents thatare parsed by Apache POI could use this flaw to trigger a denial of serviceattack via excessive CPU and memory consumption. (CVE-2014-3574)All users of Red Hat JBoss Fuse Service Works 6.0.0 as provided from theRed Hat Customer Portal are advised to apply this security update.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2014:1370?
The severity of RHSA-2014:1370 is classified as moderate.
How do I fix RHSA-2014:1370?
To fix RHSA-2014:1370, you need to update the Apache POI or Red Hat JBoss Fuse Service Works to the latest patched version.
What vulnerability does RHSA-2014:1370 address?
RHSA-2014:1370 addresses a vulnerability in Apache POI that allows remote attackers to read arbitrary files via manipulated OOXML documents.
Can RHSA-2014:1370 affect my Apache POI installation?
Yes, RHSA-2014:1370 can affect your Apache POI installation if it processes untrusted OOXML files.
Is RHSA-2014:1370 specific to certain versions of Apache POI?
RHSA-2014:1370 applies to all versions of Apache POI that handle OOXML documents without the appropriate security measures.