RHSA-2016:0118CriticalCVSS 9.6

Red Hat Security Advisory: Red Hat JBoss Operations Network 3.3.5 update

Published
February 3, 2016
Last Modified
November 7, 2026

🔗 CVE IDs covered (2)

CVE-2015-3253 →CVE-2015-7501 →

📋 Description

CVE-2015-3253 — groovy: remote execution of untrusted code in class MethodClosure CVE-2015-7501 — apache-commons-collections: InvokerTransformer code execution during deserialisation

🎯 Affected products1

  • Red Hat JBoss Operations Network 3.3

✅ Remediation

The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing JBoss Operations Network installation (including its databases, applications, configuration files, the JBoss Operations Network server's file system directory, and so on). Refer to the JBoss Operations Network 3.3.5 Release Notes for installation information. Workaround: Apply the following patch on the MethodClosure class (src/main/org/codehaus/groovy/runtime/MethodClosure.java): public class MethodClosure extends Closure { + private Object readResolve() { + throw new UnsupportedOperationException(); + } Alternatively, you should make sure to use a custom security policy file (using the standard Java security manager) or make sure that you do not rely on serialization to communicate remotely.

🔗 References (19)