Teiid before 8.4.3 and before 8.7 and Red Hat JBoss Data Virtualization 6.0.0 before patch 3 allows remote attackers to read arbitrary files via a crafted request to a REST endpoint, related to an XML External Entity (XXE) issue.

XML external entity (XXE) vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 patch 4, allows remote attackers to read arbitrary files via a crafted request to a REST endpoint.

Red Hat JBoss Data Virtualization is a lean data integration solution that provides easy, real-time, and unified data access across disparate sources to multiple applications and users. JBoss Data Virtualization makes data spread across physically distinct systems - such as multiple databases, XML files, and even Hadoop systems - appear as a set of tables in a local database.This Service Pack release of Red Hat JBoss Data Virtualization 6.4.8.SP1 (Service Pack 1) serves as a replacement for Red Hat JBoss Data Virtualization 6.4.8, and mitigates the impact of the log4j CVE's referenced in this document by removing the affected classes from the patch.Note: customers should update their EAP 6.4 installation with the corresponding security fixes that have been released for that (see RHSA-2022:0437 and https://access.redhat.com/site/solutions/625683) Security Fix(es): log4j: deserialization of untrusted data in SocketServer (CVE-2019-17571) log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305) log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307) log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender (CVE-2021-4104) log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302) log4j: improper validation of certificate with host mismatch in SMTP appender (CVE-2020-9488) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat JBoss Data Virtualization is a lean data integration solution that provides easy, real-time, and unified data access across disparate sources to multiple applications and users. JBoss Data Virtualization makes data spread across physically distinct systems - such as multiple databases, XML files, and even Hadoop systems - appear as a set of tables in a local database.<br>This release of Red Hat JBoss Data Virtualization 6.4.3 serves as a replacement for Red Hat JBoss Data Virtualization 6.4.2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.<br>Security Fix(es):<br><li> Dashbuilder: Lack of clickjacking protection on the login page (CVE-2017-2658)</li> This issue was discovered by Martin Weiler (Red Hat).

Red Hat JBoss Data Virtualization is a lean data integration solution that provides easy, real-time, and unified data access across disparate sources to multiple applications and users. JBoss Data Virtualization makes data spread across physically distinct systems - such as multiple databases, XML files, and even Hadoop systems - appear as a set of tables in a local database.<br>This release of Red Hat JBoss Data Virtualization 6.4 serves as a replacement for Red Hat JBoss Data Virtualization 6.3.8, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.<br>Security Fix(es):<br><li> JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder. Remote attackers can entice authenticated users that have privileges to access dashbuilder (usually admins) to click on links to /dashbuilder/Controller containing malicious scripts. Successful exploitation would allow execution of script code within the context of the affected user. (CVE-2016-6343)</li> <li> It has been reported that CSRF tokens are not properly handled in JBoss BPM suite dashbuilder. Old tokens generated during an active session can be used to bypass CSRF protection. In addition, the tokens are sent in query string so they can be exposed through the browser's history, referrers, web logs, and other sources. Attackers may be able to obtain old tokens from various sources in the network and perform CSRF attacks successfully. (CVE-2016-7034)</li> These issues were discovered by Jeremy Choi (Red Hat Product Security Team).

Red Hat JBoss Data Virtualization is a lean data integration solution that provides easy, real-time, and unified data access across disparate sources to multiple applications and users. JBoss Data Virtualization makes data spread across physically distinct systems - such as multiple databases, XML files, and even Hadoop systems - appear as a set of tables in a local database.Security Fix(es): It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141) This issue was discovered by Dennis Reed (Red Hat).

Apache POI is a library providing Java API for working with OOXML documentfiles.It was found that Apache POI would resolve entities in OOXML documents.A remote attacker able to supply OOXML documents that are parsed by ApachePOI could use this flaw to read files accessible to the user running theapplication server, and potentially perform more advanced XML ExternalEntity (XXE) attacks. (CVE-2014-3529)It was found that Apache POI would expand an unlimited number of entitiesin OOXML documents. A remote attacker able to supply OOXML documents thatare parsed by Apache POI could use this flaw to trigger a denial of serviceattack via excessive CPU and memory consumption. (CVE-2014-3574)All users of Red Hat JBoss Data Virtualization 6.0.0 as provided from theRed Hat Customer Portal are advised to apply this security update.

XStream is a simple library to serialize and de-serialize objects to andfrom XML.It was found that XStream could deserialize arbitrary user-supplied XMLcontent, representing objects of any type. A remote attacker able to passXML to XStream could use this flaw to perform a variety of attacks,including remote code execution in the context of the server running theXStream application. (CVE-2013-7285)The main distribution of Red Hat JBoss Data Virtualization 6.0.0 does notcontain the vulnerable XStream library and is not vulnerable toCVE-2013-7285. Only users of Red Hat JBoss Data Virtualization 6.0.0 whoinstalled an optional S-RAMP distribution as provided from the Red HatCustomer Portal are advised to apply this update.