RHSA-2014:1400: Moderate: Apache POI security update
Apache POI is a library providing Java API for working with OOXML documentfiles.It was found that Apache POI would resolve entities in OOXML documents.A remote attacker able to supply OOXML documents that are parsed by ApachePOI could use this flaw to read files accessible to the user running theapplication server, and potentially perform more advanced XML ExternalEntity (XXE) attacks. (CVE-2014-3529)It was found that Apache POI would expand an unlimited number of entitiesin OOXML documents. A remote attacker able to supply OOXML documents thatare parsed by Apache POI could use this flaw to trigger a denial of serviceattack via excessive CPU and memory consumption. (CVE-2014-3574)All users of Red Hat JBoss BRMS 6.0.3 as provided from the Red HatCustomer Portal are advised to apply this security update.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2014:1400?
The severity of RHSA-2014:1400 is classified as moderate.
How do I fix RHSA-2014:1400?
To fix RHSA-2014:1400, apply the patches provided in the security advisory related to this vulnerability.
What are the potential impacts of exploiting RHSA-2014:1400?
Exploiting RHSA-2014:1400 could allow a remote attacker to read files accessible to the Apache POI library.
Which versions are affected by RHSA-2014:1400?
Affected versions are those of Apache POI that process OOXML documents and do not have the necessary security updates.
Is there a workaround for RHSA-2014:1400?
A valid workaround involves validating the OOXML documents before processing them with Apache POI to prevent remote entity resolution.