RHSA-2014:1398: Moderate: Apache POI security update
Apache POI is a library providing Java API for working with OOXML documentfiles.It was found that Apache POI would resolve entities in OOXML documents.A remote attacker able to supply OOXML documents that are parsed by ApachePOI could use this flaw to read files accessible to the user running theapplication server, and potentially perform more advanced XML ExternalEntity (XXE) attacks. (CVE-2014-3529)It was found that Apache POI would expand an unlimited number of entitiesin OOXML documents. A remote attacker able to supply OOXML documents thatare parsed by Apache POI could use this flaw to trigger a denial of serviceattack via excessive CPU and memory consumption. (CVE-2014-3574)All users of Red Hat JBoss Data Virtualization 6.0.0 as provided from theRed Hat Customer Portal are advised to apply this security update.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2014:1398?
The severity of RHSA-2014:1398 is classified as moderate.
What vulnerability is addressed by RHSA-2014:1398?
RHSA-2014:1398 addresses an issue in Apache POI where it could resolve entities in OOXML documents, potentially allowing a remote attacker to read files.
How do I fix RHSA-2014:1398?
To fix RHSA-2014:1398, you should update your Apache POI or Red Hat JBoss Data Virtualization to the latest available versions.
Which software is affected by RHSA-2014:1398?
RHSA-2014:1398 affects Apache POI and Red Hat JBoss Data Virtualization.
What type of attack can exploit RHSA-2014:1398?
A remote attacker can exploit RHSA-2014:1398 by supplying malicious OOXML documents that are parsed by Apache POI.