RHSA-2014:1399: Moderate: Apache POI security update
Apache POI is a library providing Java API for working with OOXML documentfiles.It was found that Apache POI would resolve entities in OOXML documents.A remote attacker able to supply OOXML documents that are parsed by ApachePOI could use this flaw to read files accessible to the user running theapplication server, and potentially perform more advanced XML ExternalEntity (XXE) attacks. (CVE-2014-3529)It was found that Apache POI would expand an unlimited number of entitiesin OOXML documents. A remote attacker able to supply OOXML documents thatare parsed by Apache POI could use this flaw to trigger a denial of serviceattack via excessive CPU and memory consumption. (CVE-2014-3574)All users of Red Hat JBoss BPM Suite 6.0.3 as provided from the Red HatCustomer Portal are advised to apply this security update.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2014:1399?
The severity of RHSA-2014:1399 is classified as moderate.
How do I fix RHSA-2014:1399?
To fix RHSA-2014:1399, update the Apache POI and Red Hat JBoss BPM Suite to their latest patched versions.
What causes the vulnerability in RHSA-2014:1399?
The vulnerability in RHSA-2014:1399 is caused by Apache POI resolving entities in OOXML documents, allowing remote file reading by attackers.
Which software is affected by RHSA-2014:1399?
Affected software includes Apache POI and Red Hat JBoss BPM Suite.
Can RHSA-2014:1399 lead to data breaches?
Yes, RHSA-2014:1399 can lead to data breaches as it allows unauthorized access to files through vulnerable OOXML document processing.