RHSA-2014:0372High

Red Hat Security Advisory: Red Hat JBoss BRMS 6.0.1 update

Published
April 3, 2014
Last Modified
November 7, 2026

🔗 CVE IDs covered (7)

CVE-2011-5245 →CVE-2012-0818 →CVE-2013-1624 →CVE-2013-6468 →CVE-2013-7285 →CVE-2014-0002 →CVE-2014-0003 →

📋 Description

CVE-2011-5245 — RESTEasy: XML eXternal Entity (XXE) flaw CVE-2012-0818 — RESTEasy: XML eXternal Entity (XXE) flaw CVE-2013-1624 — bouncycastle: TLS CBC padding timing attack CVE-2013-6468 — Drools: Remote Java Code Execution in MVEL CVE-2013-7285 — XStream: remote code execution due to insecure XML deserialization CVE-2014-0002 — Camel: XML eXternal Entity (XXE) flaw in XSLT component CVE-2014-0003 — Camel: remote code execution via XSL

🎯 Affected products1

  • Red Hat JBoss BRMS 6.0

✅ Remediation

The References section of this erratum contains download links (you must log in to download the updates). Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the server by starting the JBoss Application Server process. The fix for CVE-2013-6468 enables the Java Security Manager (JSM) to sandbox the evaluation of MVEL expressions. This introduces performance degradation in high load environments. The following ways of running Red Hat JBoss BRMS are considered secure while mitigating performance degradation: 1. In high load environments where performance is critical, it is recommended to only deploy applications that have been developed on other systems and properly reviewed. It is also recommended not to create any users with the Analyst role on such systems. If these safeguards are followed, it is safe to leave JSM disabled on these systems so it does not introduce any performance degradation. 2. In testing and development environments without high loads, or in environments where rule authoring is exposed to external networks, it is recommended to have JSM enabled in order to achieve security benefits of properly sandboxed evaluation of MVEL expressions. Allowing users with the Analyst role to log in to the Business Central console when JSM is disabled is not secure and not recommended.

🔗 References (11)