Loading story…
Red Hat released Moderate-severity updates for JBoss Enterprise Application Platform (EAP) 6.2 on Red Hat Enterprise Linux 5 and 6, advancing deployments from version 6.2.3 to 6.2.4. The fixes address five vulnerabilities affecting Apache CXF and the JBoss JAX-RS implementation, including a SAML-token validation bypass, XML external entity (XXE) information disclosure, denial-of-service conditions, and potential plaintext credential exposure in a specific Apache CXF client-policy configuration.
The XXE flaw, tracked as CVE-2014-3481, affects RESTEasy applications using JBoss EAP default context parameters that did not explicitly disable external-entity expansion. Unauthenticated attackers could submit crafted XML to applications accepting XML input to read local files, cause server-side HTTP requests that bypass network restrictions, or exhaust CPU and memory. Red Hat advised affected administrators to install the updated EAP packages, restart JBoss, preserve customized configurations, and review and merge any generated .rpmnew configuration changes.
See affected versions and whether adversaries are exploiting it.
19 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Moderate-severity advisory RHSA-2015:0236, providing Rollup Patch 2 for JBoss Fuse 6.1.0 and JBoss A-MQ 6.1.0. The update remediated CVE-2014-3623, a WSS4J/CXF SAML spoofing flaw, and CVE-2014-3625, a Spring Framework directory-traversal vulnerability.
Red Hat remediated the Apache WSS4J/CXF TransportBinding SAML SubjectConfirmation spoofing flaw, CVE-2014-3623, in JBoss EAP 6.3 through RHSA-2014:2019 and RHSA-2014:2020. RHSA-2014:2019 updated apache-cxf and wss4j components for RHEL 5, 6, and 7.
Fedora released wss4j-1.6.17-1.fc20 to the Fedora 20 stable repository to address CVE-2014-3623, the Apache WSS4J/CXF TransportBinding SAML SubjectConfirmation spoofing flaw.
Fedora released wss4j-1.6.17-1.fc21 to the Fedora 21 stable repository to address CVE-2014-3623, an Apache WSS4J/CXF TransportBinding spoofing flaw involving SAML SubjectConfirmation enforcement.
Red Hat released RHSA-2014:0895 to remediate CVE-2014-3481 in Red Hat JBoss Data Grid 6.3.
Red Hat remediated CVE-2014-0035 through RHSA-2014:0798 for JBoss EAP on RHEL 5. The flaw could cause Apache CXF clients using a Symmetric EncryptBeforeSigning password policy to transmit UsernameTokens in plaintext, allowing a man-in-the-middle attacker to obtain credentials.
Red Hat addressed CVE-2014-0110, in which malformed large SOAP messages could cause Apache CXF to write attacker-controlled residual data to /tmp and exhaust disk space. Fixes were provided for JBoss EAP through RHSA-2014:0797, RHSA-2014:0798, and RHSA-2014:0799, with later advisories covering JBoss Fuse/A-MQ, BPM Suite, BRMS, and Portal.
Red Hat addressed CVE-2014-0109, an Apache CXF flaw in which text/html POST requests to SOAP endpoints could cause excessive memory consumption and an out-of-memory denial of service. Fixes were included in JBoss EAP advisories RHSA-2014:0797 through RHSA-2014:0799 and later advisories for JBoss Fuse/A-MQ, BPM Suite, BRMS, and Portal.
Red Hat addressed CVE-2014-0034, in which cached Apache CXF SecurityTokenService validation could accept invalid SAML tokens, through RHSA-2014:0797, RHSA-2014:0798, and RHSA-2014:0799 for JBoss EAP 6.2 deployments.
Red Hat issued Moderate-severity advisory RHSA-2014:0799, updating JBoss EAP from 6.2.3 to 6.2.4 on RHEL 6. It remediated CVE-2014-3481 and four Apache CXF-related vulnerabilities; administrators were instructed to restart JBoss after installation.
Red Hat issued Moderate-severity advisory RHSA-2014:0798, updating JBoss EAP 6.2.3 to 6.2.4 on RHEL 5. The update addressed CVE-2014-3481 alongside Apache CXF SAML-validation, denial-of-service, and credential-exposure flaws.
Red Hat released RHSA-2014:0797 to fix CVE-2014-3481 in Red Hat JBoss Enterprise Application Platform 6.2.
Red Hat addressed the Apache CXF UsernameToken plaintext-exposure flaw, CVE-2014-0035, in JBoss Fuse/A-MQ 6.1.0 (RHSA-2014:1351), BPM Suite 6.1.0 (RHSA-2015:0851), BRMS 6.1.0 (RHSA-2015:0850), and JBoss Portal 6.2.0 (RHSA-2015:1009). The flaw could expose client usernames and passwords to a man-in-the-middle attacker under an EncryptBeforeSigning SymmetricBinding configuration.
Apache WSS4J issue WSS-511 proposed a default-enabled SAML validator property requiring assertions to include at least one recognized Subject Confirmation method: Bearer, Sender Vouches, or Holder of Key. Assertions lacking all such methods would be rejected.
Red Hat released RHSA-2015:0765 to remediate CVE-2014-3481 in Red Hat JBoss Data Virtualization 6.0.
Red Hat released RHSA-2015:0675 to fix CVE-2014-3481 in Red Hat JBoss Data Virtualization 6.1.
Red Hat addressed CVE-2014-3481 in JBoss Operations Network 3.3.0 through advisory RHSA-2014:1904.
Red Hat closed Bugzilla issue 1090473 with an ERRATA resolution after identifying RHSA-2014:0798 as containing the updated files. The issue, which required upgrading WSS4J to 1.6.15.redhat-1, was removed from CR2 and fixed in JBoss EAP 6.2.4 CR1.
Red Hat closed Bugzilla issue 1076134 with an ERRATA resolution, stating that RHSA-2014:0343 supplied updated files intended to resolve the issue. The upgrade was verified during EAP-6.2.2.CP-CR3 testing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
24 references tracked. Mallory keeps watching after this page renders.
rhn.redhat.com
Open sourcerhn.redhat.com
Open sourceaccess.redhat.com
Open sourcerhn.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourcerhn.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released moderate-severity updates for **JBoss Enterprise Application Platform (EAP) 6.3.3/6.3.z** on Red Hat Enterprise Linux 5, 6, and 7, addressing five flaws in RESTEasy XML handling, RBAC, JacORB, security-domain selection, and Weld conversation-state processing. The most externally reachable issue, `CVE-2014-7839`, allowed XML external entity expansion through a RESTEasy endpoint, potentially exposing files readable by the application-server account. The updates also remediate `CVE-2014-7849`, through which an authenticated RBAC Maintainer could alter a limited set of protected attributes, and `CVE-2014-7853`, which exposed sensitive security-domain data to authenticated users with incorrectly sufficient attribute permissions. Organizations should apply the relevant RHSA-2015:0215, RHSA-2015:0216, or RHSA-2015:0218 packages—including the RHEL 5 component updates—and restart JBoss server processes to activate the fixes.
Aug 29, 2026
Red Hat released **JBoss Enterprise Application Platform (EAP) 6.2.1** to replace EAP 6.2.0 and remediate three Moderate-impact vulnerabilities. `CVE-2013-6440` affects OpenSAML/XMLTooling-J and allows externally supplied XML entities to be resolved, potentially enabling unauthenticated remote attackers to read files accessible to the application-server account and conduct further XXE attacks. `CVE-2013-4517` affects Apache Santuario XML Security for Java, where DTD processing during XML transforms can exhaust memory and cause an `OutOfMemoryError`. `CVE-2014-0018` permits deployed code running under a Java Security Manager to access the Modular Service Container service registry without required permission checks and alter JBoss internal server state. The fixes were delivered through RHSA-2014:0170 for RHEL 5, RHSA-2014:0171 for RHEL 6, and RHSA-2014:0172 for Customer Portal distributions. Organizations operating EAP 6.2.0 should upgrade to EAP 6.2.1, back up installations and deployed applications, review and merge locally modified configuration files preserved as `.rpmnew` where applicable, and restart the JBoss server process after installation.
Aug 31, 2026
Red Hat released **JBoss Enterprise Application Platform (EAP) 6.4.14** to replace 6.4.13 and remediate three security flaws across EAP 6 packages for supported RHEL 5, 6, and 7 deployments, including `jboss-ec2-eap`. **CVE-2016-8657** allowed local members of the `jboss` group to modify the group-writable `/etc/sysconfig/jbossas` file; on RHEL 6 and earlier systems using legacy `/etc/init.d` service scripts, that file was sourced with root privileges during JBoss service operations, enabling local privilege escalation. The release also fixes **CVE-2017-6056**, an Apache Tomcat HTTPS request-processing flaw that could trigger an infinite loop and denial of service, and **CVE-2016-6346**, where RESTEasy's `GZIPInterceptor` could be unnecessarily enabled and permit denial of service. Red Hat advised customers to back up EAP installations and deployed applications before updating. The vendor clarified that the initial ZIP-distribution advisory did not resolve CVE-2016-8657, because the affected writable configuration file was present in RPM-based installations.
Aug 28, 2026