RHSA-2015:1695HighCVSS 7.6

Red Hat Security Advisory: jakarta-taglibs-standard security update

Published
August 31, 2015
Last Modified
November 5, 2026

🔗 CVE IDs covered (1)

CVE-2015-0254 →

📋 Description

CVE-2015-0254 — jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags

🎯 Affected products39

  • Red Hat Enterprise Linux Client Optional (v. 7)
  • Red Hat Enterprise Linux ComputeNode Optional (v. 7)
  • Red Hat Enterprise Linux Desktop Optional (v. 6)
  • Red Hat Enterprise Linux HPC Node Optional (v. 6)
  • Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Enterprise Linux Server Optional (v. 6)
  • Red Hat Enterprise Linux Server Optional (v. 7)
  • Red Hat Enterprise Linux Workstation (v. 7)
  • Red Hat Enterprise Linux Workstation Optional (v. 6)
  • Red Hat Enterprise Linux Workstation Optional (v. 7)
  • jakarta-taglibs-standard-0:1.1.1-11.7.el6_7.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)
  • jakarta-taglibs-standard-0:1.1.1-11.7.el6_7.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)
  • jakarta-taglibs-standard-0:1.1.1-11.7.el6_7.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)
  • jakarta-taglibs-standard-0:1.1.1-11.7.el6_7.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)
  • jakarta-taglibs-standard-0:1.1.1-11.7.el6_7.src as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)
  • jakarta-taglibs-standard-0:1.1.1-11.7.el6_7.src as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)
  • jakarta-taglibs-standard-0:1.1.1-11.7.el6_7.src as a component of Red Hat Enterprise Linux Server Optional (v. 6)
  • jakarta-taglibs-standard-0:1.1.1-11.7.el6_7.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)
  • jakarta-taglibs-standard-0:1.1.2-14.ael7b_1.noarch as a component of Red Hat Enterprise Linux Server (v. 7)
  • jakarta-taglibs-standard-0:1.1.2-14.ael7b_1.src as a component of Red Hat Enterprise Linux Server (v. 7)
  • jakarta-taglibs-standard-0:1.1.2-14.el7_1.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)
  • jakarta-taglibs-standard-0:1.1.2-14.el7_1.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)
  • jakarta-taglibs-standard-0:1.1.2-14.el7_1.noarch as a component of Red Hat Enterprise Linux Server (v. 7)
  • jakarta-taglibs-standard-0:1.1.2-14.el7_1.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)
  • jakarta-taglibs-standard-0:1.1.2-14.el7_1.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • jakarta-taglibs-standard-0:1.1.2-14.el7_1.src as a component of Red Hat Enterprise Linux Client Optional (v. 7)
  • jakarta-taglibs-standard-0:1.1.2-14.el7_1.src as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)
  • jakarta-taglibs-standard-0:1.1.2-14.el7_1.src as a component of Red Hat Enterprise Linux Server (v. 7)
  • jakarta-taglibs-standard-0:1.1.2-14.el7_1.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)
  • jakarta-taglibs-standard-0:1.1.2-14.el7_1.src as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • +9 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Users should upgrade to Apache Standard Taglibs 1.2.3 or later. This version uses JAXP’s FEATURE_SECURE_PROCESSING to restrict XML processing. Depending on the Java runtime version in use, additional configuration may be required: Java8: External entity access is automatically disabled if a SecurityManager is active. Java7: JAXP properties may need to be used to disable external access. See http://docs.oracle.com/javase/tutorial/jaxp/properties/properties.html Java6 and earlier: A new system property org.apache.taglibs.standard.xml.accessExternalEntity may be used to specify the protocols that can be used to access external entities. This defaults to "all" if no SecurityManager is present and to "" (thereby disabling access) if a SecurityManager is detected.

🔗 References (5)