RHSA-2014:1351High

Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.1.0 security update

Published
October 1, 2014
Last Modified
November 7, 2026

🔗 CVE IDs covered (8)

CVE-2014-0034 →CVE-2014-0035 →CVE-2014-0074 →CVE-2014-0107 →CVE-2014-0109 →CVE-2014-0110 →CVE-2014-0193 →CVE-2014-0225 →

📋 Description

CVE-2014-0034 — CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid CVE-2014-0035 — CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy CVE-2014-0074 — Shiro: successful authentication without specifying user name or password CVE-2014-0107 — Xalan-Java: insufficient constraints in secure processing feature CVE-2014-0109 — CXF: HTML content posted to SOAP endpoint could cause OOM errors CVE-2014-0110 — CXF: Large invalid content could cause temporary space to fill CVE-2014-0193 — netty: DoS via memory exhaustion during data aggregation CVE-2014-0225 — Framework: Information disclosure via SSRF

🎯 Affected products2

  • Red Hat JBoss A-MQ 6.1
  • Red Hat JBoss Fuse 6.1

✅ Remediation

The References section of this erratum contains a download link (you must log in to download the update).

🔗 References (13)