RHSA-2016:1376CriticalCVSS 9.8

Red Hat Security Advisory: Red Hat JBoss SOA Platform security update

Published
June 30, 2016
Last Modified
November 5, 2026

🔗 CVE IDs covered (5)

CVE-2016-2510 →CVE-2015-0226 →CVE-2015-0254 →CVE-2015-3253 →CVE-2016-2141 →

📋 Description

CVE-2015-0226 — wss4j: Apache WSS4J is vulnerable to Bleichenbacher's attack (incomplete fix for CVE-2011-2487) CVE-2015-0254 — jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags CVE-2015-3253 — groovy: remote execution of untrusted code in class MethodClosure CVE-2016-2141 — JGroups: Authorization bypass CVE-2016-2510 — bsh2: remote code execution via deserialization

🎯 Affected products1

  • Red Hat JBoss SOA Platform 5.3

✅ Remediation

The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss SOA Platform installation (including its databases, applications, configuration files, and so on). Note that it is recommended to halt the Red Hat JBoss SOA Platform server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the Red Hat JBoss SOA Platform server by starting the JBoss Application Server process. Workaround: Users should upgrade to Apache Standard Taglibs 1.2.3 or later. This version uses JAXP’s FEATURE_SECURE_PROCESSING to restrict XML processing. Depending on the Java runtime version in use, additional configuration may be required: Java8: External entity access is automatically disabled if a SecurityManager is active. Java7: JAXP properties may need to be used to disable external access. See http://docs.oracle.com/javase/tutorial/jaxp/properties/properties.html Java6 and earlier: A new system property org.apache.taglibs.standard.xml.accessExternalEntity may be used to specify the protocols that can be used to access external entities. This defaults to "all" if no SecurityManager is present and to "" (thereby disabling access) if a SecurityManager is detected. Workaround: Apply the following patch on the MethodClosure class (src/main/org/codehaus/groovy/runtime/MethodClosure.java): public class MethodClosure extends Closure { + private Object readResolve() { + throw new UnsupportedOperationException(); + } Alternatively, you should make sure to use a custom security policy file (using the standard Java security manager) or make sure that you do not rely on serialization to communicate remotely. Workaround: Please refer to https://access.redhat.com/articles/2360521 for more information.

🔗 References (10)