RHSA-2016:2036HighCVSS 7.3

Red Hat Security Advisory: Red Hat JBoss A-MQ 6.3 security update

Published
October 6, 2016
Last Modified
November 5, 2026

🔗 CVE IDs covered (5)

CVE-2015-7940 →CVE-2016-3088 →CVE-2016-4437 →CVE-2015-3192 →CVE-2015-5254 →

📋 Description

CVE-2015-3192 — Framework: denial-of-service attack with XML input CVE-2015-5254 — ObjectMessage: unsafe deserialization CVE-2015-7940 — bouncycastle: Invalid curve attack allowing to extract private keys CVE-2016-3088 — activemq: Fileserver web application vulnerability allowing RCE CVE-2016-4437 — shiro: Security constraint bypass

🎯 Affected products1

  • Red Hat JBoss A-MQ 6.3

✅ Remediation

The References section of this erratum contains a download link (you must log in to download the update). Workaround: If you do deploy a JMS publisher, and subscriber, and don't trust the messages sent to you by your clients, you could mitigate this issue by installing a Java agent which restricts the classes which can be deserialized. This is an article with the recommended approach: https://access.redhat.com/solutions/2190911 You could also mitigate this issue using the features of the Java Virtual Machine added in JEP 290: http://openjdk.java.net/jeps/290 Workaround: Users are advised to use other FTP and HTTP based file servers for transferring blob messages. Fileserver web application SHOULD NOT be used in older version of the broker and it should be disabled (it has been disabled by default since 5.12.0). This can be done by removing (commenting out) the following lines from conf\jetty.xml file <bean class="org.eclipse.jetty.webapp.WebAppContext"> <property name="contextPath" value="/fileserver" /> <property name="resourceBase" value="${activemq.home}/webapps/fileserver" /> <property name="logUrlOnStart" value="true" /> <property name="parentLoaderPriority" value="true" /> </bean>

🔗 References (8)