Loading story…
Red Hat released Important cumulative roll-up patches for JBoss BPM Suite 6.0.3, JBoss BRMS 6.0.3, and JBoss Fuse Service Works 6.0.0. The updates—RHSA-2015:0234, RHSA-2015:0235, and RHSA-2015:0720—remediate 18 to 20 vulnerabilities in bundled components including Apache HttpComponents, JBossWeb/Tomcat, Spring Framework, RESTEasy, PicketBox/PicketLink, Netty, UberFire, KIE Workbench, and JBoss AS.
The vulnerabilities include SSL hostname-verification bypasses, XML external entity (XXE) processing, directory traversal, authorization bypass, information disclosure, denial of service, request smuggling, cross-site scripting, Java Security Manager bypass, and remote code execution. Red Hat instructed affected customers to back up their installations, stop the JBoss Application Server, apply the appropriate roll-up patch, and restart the service.
See real exploitation activity before you spend the cycle.
29 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important advisory RHSA-2015:1009, making JBoss Portal 6.2.0 available to replace version 6.1.1. The update remediated numerous flaws, including remote-code-execution, XXE, authentication/authorization-bypass, information-disclosure, request-smuggling, XSS, and denial-of-service vulnerabilities.
Red Hat addressed the jBPM BPMN2-file-processing XXE flaw CVE-2014-8125 in JBoss BPM Suite 6.1.0 through RHSA-2015:0851 and JBoss BRMS 6.1.0 through RHSA-2015:0850. A crafted BPMN2 file could allow a remote attacker to read files accessible to the application-server user and conduct further XXE attacks; legacy ELS products were not planned to receive updates.
Red Hat issued RHSA-2015:0850 and RHSA-2015:0851 to fix CVE-2013-2133 in JBoss BRMS 6.0 and JBoss BPMS 6.0. The low-severity flaw allowed a remotely authenticated user authorized for an EJB class to invoke JAX-WS handlers despite lacking applicable method-level authorization.
Red Hat issued Important advisory RHSA-2015:0720, providing Roll Up Patch 4 for JBoss Fuse Service Works 6.0.0. The cumulative update fixed 18 security vulnerabilities, including SSL hostname-verification bypasses, Spring directory traversal, XXE, denial-of-service, request-smuggling, and authorization issues.
Red Hat issued RHSA-2015:0236 to remediate the moderate Spring Framework directory-traversal vulnerability CVE-2014-3625 in JBoss A-MQ 6.1 and JBoss Fuse 6.1. The flaw could let a remote unauthenticated attacker read files accessible to a vulnerable Spring web application's process.
Red Hat fixed the moderate jbpm-designer BPMN2 import XML external entity flaw CVE-2014-3682 in JBoss BPMS 6.0 and JBoss BRMS 6.0 through RHSA-2015:0234 and RHSA-2015:0235. Crafted XML could let an unauthenticated remote attacker read application-accessible files and potentially conduct SSRF or denial-of-service attacks; some older OpenShift Enterprise components were marked will-not-fix and BRMS 5 was fix-deferred.
Red Hat issued Important advisory RHSA-2015:0235, providing Roll Up Patch 2 for JBoss BRMS 6.0.3. The update addressed 20 vulnerabilities across bundled components, including SSL hostname-verification bypasses, XXE, denial-of-service, XSS, request-smuggling, and authorization flaws.
Red Hat issued Important advisory RHSA-2015:0234, delivering Roll Up Patch 2 for JBoss BPM Suite 6.0.3. The cumulative update remediated 20 vulnerabilities, including XXE, request smuggling, directory traversal, authorization, information-disclosure, and remote-code-execution flaws.
Red Hat issued Moderate advisory RHSA-2015:0216 for JBoss EAP 6.3.3 on RHEL 5, fixing RESTEasy XXE CVE-2014-7839, RBAC and JacORB authorization issues CVE-2014-7849 and CVE-2014-7853, security-domain mapping flaw CVE-2014-7827, and Weld conversation-state disclosure CVE-2014-8122. CVE-2014-7839 could allow remote attackers to read files accessible to the application-server account through crafted XML requests.
Red Hat disclosed that insufficient default authorization constraints on KIE Workbench servlets let a remote authenticated low-privilege user upload or download arbitrary files and access otherwise restricted privileged actions. Red Hat rated CVE-2014-8115 Moderate and fixed it in JBoss BRMS 6.0.3 and JBoss BPM Suite 6.0.3; JBoss BRMS 5 was not planned to receive a fix because it was in Extended Life Support.
A kie-wb-distributions 6.0.x commit restricted file-oriented servlets to git:// and default:// paths while excluding file:// paths, reducing local filesystem-access exposure. It also added role-based security constraints for upload, download, decision-table, and scorecard servlet endpoints across supported KIE Workbench and Drools Workbench deployment descriptors.
CVE-2014-8125 was publicly disclosed as an XML external entity flaw in jBPM runtime processing of BPMN2 files. A remote unauthenticated attacker could submit crafted BPMN2/XML to read application-accessible files, trigger server-side requests, or cause denial of service.
Red Hat issued RHSA-2014:1288 and RHSA-2014:1286 to fix CVE-2014-3558 in JBoss Enterprise Application Platform 6.3 and its RHEL 5 components. The low-severity Hibernate Validator ReflectionHelper flaw could let a malicious co-deployed application obtain elevated permissions under the Java Security Manager.
David Jorm reported CVE-2013-7398 to Red Hat: async-http-client failed to verify that an SSL/TLS server hostname matched the certificate CN or subjectAltName. The flaw could allow a man-in-the-middle attacker using a certificate valid for another domain to spoof an SSL server.
Red Hat fixed CVE-2014-0034 in JBoss Enterprise Application Platform 6.2 through RHSA-2014:0797 and RHSA-2014:0798. The moderate Apache CXF SecurityTokenService flaw could accept invalid SAML tokens, allowing a remote unauthenticated attacker to gain access to an application relying on the affected service for token validation.
Red Hat released RHSA-2014:0797 and RHSA-2014:0798 to fix CVE-2014-0035 in JBoss Enterprise Application Platform 6.2, including RHEL 5 components. The Apache CXF flaw could send UsernameTokens in plaintext under the Symmetric EncryptBeforeSigning policy, exposing client credentials to an on-path attacker.
Red Hat fixed the moderate Apache CXF denial-of-service flaw CVE-2014-0110 in JBoss EAP 6.2 through RHSA-2014:0797 and RHSA-2014:0798. A remote attacker could submit a large invalid SOAP message that was written to /tmp, exhausting disk space and denying service.
CVE-2014-0109 was publicly disclosed as a moderate Apache CXF denial-of-service vulnerability in which specially crafted POST requests could cause excessive error-message memory use and out-of-memory failures. Red Hat subsequently fixed affected JBoss EAP, A-MQ, BPMS, and BRMS products through product-specific advisories.
Red Hat issued RHSA-2014:0343 and RHSA-2014:0345 to fix the PicketBox/JBossSX missing-authorization flaw CVE-2014-0005 in JBoss Enterprise Application Platform 6.2, including affected RHEL 5 components.
Red Hat logged CVE-2014-0005, a medium-severity PicketBox/JBossSX flaw allowing a deployed application to read or modify underlying application-server configuration and state without authorization checks. The issue could let an attacker who can deploy an application bypass protections on other applications, access privileged information, and in some cases execute arbitrary code.
Red Hat remediated CVE-2013-2133 in JBoss EAP 6.2.0 and JBEAP 6 for RHEL 5 and 6 through RHSA-2013:1784, RHSA-2013:1785, and RHSA-2013:1786. The flaw allowed a user authorized for an EJB class to invoke JAX-WS handlers despite lacking method-level authorization.
The 2022 OT:ICEFALL study reported 56 insecure-by-design vulnerabilities across products from 10 operational-technology vendors, including systems that relied on insecure checksums rather than signed firmware images. The findings included CVE-2022-30260, CVE-2022-30267, and CVE-2022-30272 and could permit firmware tampering, denial of service, or modification of executed code.
Red Hat stated that JBoss Portal, then in Maintenance Support, would receive only qualified Important and Critical security fixes. It rated the Spring directory-traversal flaw CVE-2014-3625 as Moderate for JBoss Portal and did not plan a future Portal remediation.
Red Hat addressed CVE-2014-8122, in which incomplete cleanup of Weld thread-local conversation state could, under a race condition, expose sensitive data from a prior conversation. Fixes were issued through multiple 2015 advisories for JBoss EAP, Data Virtualization, Data Grid, BPM Suite, BRMS, and Operations Network.
Red Hat remediated Apache CXF disk-exhaustion vulnerability CVE-2014-0110 in JBoss Fuse/A-MQ 6.1.0, JBoss BPM Suite 6.1.0, JBoss BRMS 6.1.0, and JBoss Portal 6.2.0 through product-specific advisories. The flaw allowed remote attackers to send malformed SOAP messages that wrote attacker-controlled data to /tmp and exhausted disk space.
Red Hat documented CVE-2014-8114, in which UberFire's default FileUploadServlet and FileDownloadServlet did not restrict filesystem paths. Exposed servlets could let remote attackers read process-accessible files or upload malicious content for arbitrary code execution; fixes were included in JBoss BRMS and BPM Suite 6.0.3 via RHSA-2015:0235 and RHSA-2015:0234.
Red Hat issued Important advisory RHSA-2014:1891, providing Roll Up Patch 1 for Red Hat JBoss BRMS 6.0.3. The cumulative update fixed CVE-2012-6153 and CVE-2014-3577, SSL hostname-verification flaws that could enable a man-in-the-middle attacker to spoof an SSL server using a crafted X.509 certificate.
Red Hat remediated the Apache CXF SecurityTokenService SAML-token validation bypass, CVE-2014-0034, in JBoss Fuse/A-MQ 6.1.0, JBoss BPM Suite 6.1.0, JBoss BRMS 6.1.0, and JBoss Portal 6.2.0 through product-specific advisories. Fedora 22 also received Apache CXF 2.7.11 containing the upstream fix.
Red Hat addressed the TLS/DTLS CBC-mode timing-information flaw CVE-2013-1624 in JBoss BPM Suite 6.0.1, BRMS 6.0.1, Fuse 6.1.0, AM-Q 6.1.0, and Web Framework Kit 2.6.0 via RHSA-2014:0371, RHSA-2014:0372, RHSA-2014:0400, RHSA-2014:0401, and RHSA-2014:0896. The flaw could allow a nearby man-in-the-middle attacker to recover plaintext from encrypted CBC-mode TLS/DTLS traffic.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
43 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcerhn.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcecwe.mitre.org
Open sourcecwe.mitre.org
Open sourcecwe.mitre.org
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat issued Important-security updates across JBoss BPM Suite, JBoss BRMS, JBoss Fuse Service Works, and JBoss Data Grid, addressing flaws that could lead to remote or authenticated arbitrary Java code execution. Affected components included Xalan-Java XSLT secure-processing bypasses, insecure XStream XML deserialization, Apache Camel XSLT handling, and MVEL/JBoss Rules expression evaluation; several releases also corrected XML external entity (XXE) weaknesses in OpenSAML, Camel, and RESTEasy. The updates additionally fixed Java Security Manager policy failures that could grant deployed applications `java.security.AllPermission`, JBoss MSC service-registry access-control issues, HawtJNI temporary-file risks, plaintext authentication-parameter logging, Smack XMPP spoofing, WebSocket memory-exhaustion denial of service, and TLS CBC padding-oracle exposure. Red Hat instructed customers to back up installations, stop the JBoss Application Server, apply the applicable upgraded release or roll-up patch, and restart services; organizations using rule-authoring or externally exposed environments were advised to retain Java Security Manager sandboxing for MVEL evaluation.
Aug 31, 2026
Red Hat released **JBoss BRMS 6.1.0** and **JBoss BPM Suite 6.1.0** to replace version 6.0.3 and remediate 16 security vulnerabilities in the platforms and bundled components. The Important advisories cover SSL/TLS certificate and hostname-validation bypasses, SAML authentication and token-handling flaws, XML external entity (XXE) processing, denial-of-service conditions, information disclosure, and file-permission issues. The fixes include XML-security hardening relevant to **CVE-2013-4517**, a Moderate Apache Santuario XML Security for Java flaw in which DTD processing during XML Transform operations could exhaust memory and cause an `OutOfMemoryError`, including under secure validation. Red Hat advised Customer Portal users to back up installations, stop the JBoss Application Server, upgrade from 6.0.3 to 6.1.0, and restart the server after installation.
Aug 29, 2026
Red Hat issued Moderate-security updates for JBoss Enterprise Application Platform (EAP) 6.2.2, JBoss Web Server 2.0.1, and RHEL `tomcat6` packages to address **CVE-2013-4286**, an HTTP request-processing flaw involving conflicting `Content-Length` and chunked-transfer headers. Successful exploitation could cause web-cache poisoning, cross-site scripting, or disclosure of data from other requests. The related Tomcat updates also remediate **CVE-2013-4322**, a resource-exhaustion denial of service in chunked-request processing, and **CVE-2014-0050**, an infinite-loop denial of service in embedded Apache Commons FileUpload; Tomcat 6 updates additionally address **CVE-2014-0033**, a URL-rewriting issue that could facilitate session hijacking. Red Hat instructed affected EAP, JBoss Web Server, and Tomcat administrators to install the supplied backported packages and restart the relevant server processes, preserving and merging local configuration changes where necessary. Separate JBoss middleware releases also delivered broader security fixes: JBoss Fuse 6.1.0 addressed issues including XML signature spoofing, XXE, authentication downgrade, denial of service, and credential exposure, while JBoss BRMS 6.0.3 corrected Important-severity flaws including potential remote code execution through Xalan-Java secure-processing bypasses, OpenSAML XXE, excessive Java Security Manager permissions, and plaintext request-parameter logging.
Aug 31, 2026