Important: Red Hat Fuse 7.13.0 release and security update

Red Hat Fuse provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat A-MQ is a standards compliant messaging system that is tailored for use in mission critical applications.<br>This patch is an update to Red Hat Fuse 6.3 and Red Hat A-MQ 6.3. It includes bug fixes, which are documented in the patch notes accompanying the package on the download page. See the download link given in the references section below.<br>Security Fix(es):<br><li> activemq-openwire: OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack (CVE-2023-46604)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Critical: Red Hat Fuse 7.12 release and security update

The releases of Red Hat Fuse 7.8.2, 7.9.1 and 7.10.1 serve as a patch to Red Hat Fuse on Karaf and Red Hat Fuse on Spring Boot and includes security fixes, which are documented in the Release Notes document linked to in the References.Security Fix(es): log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value (CVE-2021-44228) log4j-core: remote code execution via JDBC Appender (CVE-2021-44832) log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228) (CVE-2021-45046) log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern (CVE-2021-45105) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.

A flaw was found in undertow where HTTP2SourceChannel fails to write final frame under some circumstances may result in DoS. The highest impact of this vulnerability is availability.

A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability.

This release of Red Hat Fuse 7.7.0 serves as a replacement for Red Hat Fuse 7.6, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.Security Fix(es): netty (CVE-2016-4970 CVE-2020-7238 CVE-2019-20444 CVE-2019-20445) dom4j (CVE-2018-1000632) elasticsearch (CVE-2018-3831) pdfbox (CVE-2018-11797) vertx (CVE-2018-12541) spring-data-jpa (CVE-2019-3797) mina-core (CVE-2019-0231) jackson-databind (CVE-2019-12086 CVE-2019-16335 CVE-2019-14540 CVE-2019-17267 CVE-2019-14892 CVE-2019-14893 CVE-2019-16942 CVE-2019-16943 CVE-2019-17531 CVE-2019-20330 CVE-2020-10673 CVE-2020-10672 CVE-2020-8840 CVE-2020-9546 CVE-2020-9547 CVE-2020-9548 CVE-2020-10968 CVE-2020-10969 CVE-2020-11111 CVE-2020-11112 CVE-2020-11113 CVE-2020-11620 CVE-2020-11619 CVE-2020-14195 CVE-2020-14060 CVE-2020-14061 CVE-2020-14062) jackson-mapper-asl (CVE-2019-10172) hawtio (CVE-2019-9827) undertow (CVE-2019-9511 CVE-2020-1757 CVE-2019-14888 CVE-2020-1745) santuario (CVE-2019-12400) apache-commons-beanutils (CVE-2019-10086) cxf (CVE-2019-17573) apache-commons-configuration (CVE-2020-1953) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information.

A flaw was found in Docker image running under root user, where it is possible to overwrite the init helper binary of the container runtime or the command executor in Apache Mesos. A malicious user could use this flaw to gain root-level code execution on the host.

Red Hat Fuse Integration Services provides a set of tools and containerized xPaaS images that enable development, deployment, and management of integration microservices within OpenShift.Security fix(es): jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries (CVE-2018-7489) spring-framework: Address partial fix for CVE-2018-1270 (CVE-2018-1275) spring-framework: Directory traversal vulnerability with static resources on Windows filesystems (CVE-2018-1271) spring-framework: Possible RCE via spring messaging (CVE-2018-1270) spring-security-oauth: remote code execution in the authorization process (CVE-2018-1260) tomcat: A bug in the UTF-8 decoder can lead to DoS (CVE-2018-1336) tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources (CVE-2018-1304) tomcat: Late application of security constraints can lead to resource exposure for unauthorised users (CVE-2018-1305) tomcat: Remote Code Execution bypass for CVE-2017-12615 (CVE-2017-12617) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Fuse provides a small-footprint, flexible, open source enterprise service bus and integration platform.This patch is an update to Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ 6.3. It includes bug fixes, which are documented in the patch notes accompanying the package on the download page. See the download link given in the References section below.Security fix(es): A-MQ Console: HTTPOnly and Secure attributes not set on cookies (CVE-2015-5183) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.Red Hat would like to thank Naftali Rosenbaum (Comsec Consulting) for reporting CVE-2015-5183.

Red Hat Fuse Integration Services provides a set of tools and containerized xPaaS images that enable development, deployment, and management of integration microservices within OpenShift.Security fix(es): undertow: Client can use bogus uri in Digest authentication (CVE-2017-12196) spring-boot: Malicious PATCH requests submitted to servers can use specially crafted JSON data to run arbitrary Java code (CVE-2017-8046) spring-framework: Improper URL path validation allows for bypassing of security checks on static resources (CVE-2018-1199) ignite: Possible Execution of Arbitrary Code Within Deserialization Endpoints (CVE-2018-1295) spark: Absolute and relative pathnames allow for unintended static file disclosure (CVE-2018-9159) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.The CVE-2017-12196 issue was discovered by Jan Stourac (Red Hat).

Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. <br>Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications.<br>This patch is an update to Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ 6.3. It includes bug fixes and enhancements, which are documented in the readme.txt file included with the patch files.<br>Security Fix(es):<br><li> undertow: HTTP Request smuggling vulnerability (incomplete fix of CVE-2017-2666) (CVE-2017-7559)</li> <li> undertow: improper whitespace parsing leading to potential HTTP request smuggling (CVE-2017-12165)</li> <li> karaf: LDAP injection in LDAPLoginModule (CVE-2016-8750)</li> <li> plexus-utils: Mishandled strings in Commandline class allow for command injection (CVE-2017-1000487)</li> <li> poi: Parsing of multiple file types can cause a denial of service via infinite loop or out of memory exception (CVE-2017-12626)</li> The CVE-2017-7559 and CVE-2017-12165 issues were discovered by Stuart Douglas (Red Hat).

Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. <br>Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications.<br>This patch is an update to Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ 6.3. It includes bug fixes and enhancements, which are documented in the readme.txt file included with the patch files.<br>Security Fix(es):<br><li> It was found that spring-ldap contains a security vulnerability that allows an attacker to authenticate with arbitrary password. When spring-ldap connected to some LDAP servers, and when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. (CVE-2017-8028)</li> <li> It was found that a flaw in hawtio could cause remote code execution via file upload. An attacker could use this vulnerability to upload crafted file which could be executed on target machine where hawtio is deployed. (CVE-2017-2617)</li> <li> It was found that Apache Camel contains a security vulnerability via camel-hessian component. An attacker can utilize this flaw to deserialize malicious object on the target machine which could lead to Remote Code Execution (RCE). (CVE-2017-12633)</li> <li> It was found that Apache Camel contains a security vulnerability via camel-castor component. An attacker can utilize this flaw to deserialize malicious object on the target machine which could lead to Remote Code Execution (RCE). (CVE-2017-12634)</li> <li> It was found that a flaw exists in Switchyard component via Apache Batick. If an attacker sends a maliciously crafted SVG formed file on the target machine, that uses batik, files lying on the file system could be revealed to the attacker, depending on the user context in which the exploitable application is running. This flaw can also be leveraged to attack the availability of the target machine via DoS. (CVE-2017-5662)</li> The CVE-2017-2617 issue was discovered by Hooman Broujerdi (Red Hat).

Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications.<br>This patch is an update to Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ 6.3. It includes bug fixes and enhancements, which are documented in the readme.txt file included with the patch files.<br>Security Fix(es):<br><li> It was found that ResourceServlet in Spring Framework does not sanitize the paths that have been provided properly. An attacker can utilize this flaw to conduct directory traversal attacks. (CVE-2016-9878)</li> <li> A vulnerability was discovered in Apache Thrift client libraries that allows remote, authenticated attackers to cause an infinite recursion via vectors involving the skip function, resulting in a denial of service (DoS) condition. (CVE-2015-3254)</li> <li> A vulnerability was discovered in JSch that allows a malicious sftp server to force a client-side relative path traversal in jsch's implementation for recursive sftp-get. An attacker could leverage this to write files outside the client's download basedir with effective permissions of the jsch sftp client process. (CVE-2016-5725)</li>

Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications.This patch is an update to Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ 6.3. It includes several bug fixes, which are documented in the readme.txt file included with the patch files.Security Fix(es): It was found that Apache PDFBox parses different XML data within PDF files such as XMP and the initialization of the XML parsers did not protect against XML External Entity (XXE) vulnerabilities. (CVE-2016-2175) Refer to the readme.txt file included with the patch files for installation instructions.

It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it. An attacker could use this flaw to launch a denial of service attack.

It was found that JBoss Fuse would allow any user defined in the users.properties file to access the HawtIO console without having a valid admin role. This could allow a remote attacker to bypass intended authentication HawtIO console access restrictions.

Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint,flexible, open source enterprise service bus and integration platform.It was found that the Struts 1 ActionForm object allowed access to the'class' parameter, which is directly mapped to the getClass() method.A remote attacker could use this flaw to manipulate the ClassLoader used byan application server running Struts 1. This could lead to remote codeexecution under certain conditions. (CVE-2014-0114)Refer to the readme.txt file included with the patch files forinstallation instructions.All users of Red Hat JBoss Fuse 6.1.0 as provided from the Red Hat CustomerPortal are advised to apply this security update.

Graeme Colman of Red Hat reported a sensitive data exposure flaw in Apache Zookeeper. An admin user's password appeared in plaintext in binary log files. A local user could read this information and use it to gain administrative access to the application.

Update 2018-08-06:

JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. This issue is a vulnerability in JBoss Fuse's usage of Apache Zookeeper, not in Zookeeper itself as was previously stated.