Loading story…
Red Hat released Important-security updates for JBoss Fuse 6.2.0 and JBoss Fuse Service Works 6.0.0 to remediate SSL/TLS certificate-validation defects in async-http-client, including CVE-2013-7397 and CVE-2013-7398. Disabled certificate verification in certain client-certificate scenarios and missing hostname validation could allow a man-in-the-middle attacker to spoof HTTPS/SSL servers or server identities.
The JBoss Fuse 6.2.0 update also fixes hostname-verification issues in Smack, an authorization bypass in the HawtIO console, insecure temporary-file handling in JClouds, and cryptographic and XML-signature flaws in Apache WSS4J. Red Hat advised affected JBoss Fuse Service Works 6.0.0 users to back up installations, stop the JBoss Application Server process, and apply cumulative Rollup Patch 5; organizations should similarly prioritize the applicable Fuse updates to reduce risks of interception, authentication bypass, data exposure, denial of service, and signed-request modification.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2015:1551, rated Important, for JBoss Fuse Service Works 6.0.0. The cumulative Rollup Patch 5 fixed async-http-client certificate-validation flaws CVE-2013-7397 and CVE-2013-7398, and Red Hat advised customers to back up installations and apply the patch.
Red Hat released JBoss Fuse 6.2.0, an Important-security-impact update from version 6.1.0. It remediated certificate-validation, hostname-verification, authorization-bypass, temporary-file, and XML-signature flaws including CVE-2013-7397, CVE-2013-7398, CVE-2014-8175, CVE-2015-0226, and CVE-2015-0227.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
rhn.redhat.com
Open sourceaccess.redhat.com
Open sourcerhn.redhat.com
Open sourcerhn.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important cumulative roll-up patches for JBoss BPM Suite 6.0.3, JBoss BRMS 6.0.3, and JBoss Fuse Service Works 6.0.0. The updates—RHSA-2015:0234, RHSA-2015:0235, and RHSA-2015:0720—remediate 18 to 20 vulnerabilities in bundled components including Apache HttpComponents, JBossWeb/Tomcat, Spring Framework, RESTEasy, PicketBox/PicketLink, Netty, UberFire, KIE Workbench, and JBoss AS. The vulnerabilities include SSL hostname-verification bypasses, XML external entity (XXE) processing, directory traversal, authorization bypass, information disclosure, denial of service, request smuggling, cross-site scripting, Java Security Manager bypass, and remote code execution. Red Hat instructed affected customers to back up their installations, stop the JBoss Application Server, apply the appropriate roll-up patch, and restart the service.
Aug 29, 2026
Red Hat issued Important security updates across JBoss Enterprise Application Platform (EAP), Data Grid, A-MQ, SOA Platform, and Fuse to remediate Apache WSS4J and other component vulnerabilities. A key issue, **CVE-2015-0226**, left WS-Security deployments using PKCS#1 v1.5 XML Encryption exposed to a Bleichenbacher adaptive chosen-ciphertext attack: crafted messages could distinguish encrypted-key processing failures from message-data failures and create a decryption oracle. The advisories also addressed XML Signature wrapping, XML external entity expansion, CPU-exhaustion, authentication and authorization weaknesses, and the insecure default permissions of the local `.jboss-cli-history` file. Affected EAP 6.4 systems on RHEL 6 and 7 were instructed to install updated packages, reconcile retained `.rpmnew` configuration files where applicable, and restart JBoss services. Red Hat also directed Data Grid 6.4.0 customers to upgrade to 6.4.1 and A-MQ 6.1.0 users to upgrade to 6.2.0; later SOA Platform and Fuse releases additionally fixed severe JGroups, BeanShell, Groovy, Spring, Camel, Shiro, and Bouncy Castle issues, including remote code execution, cluster-message spoofing, denial of service, information disclosure, and private-key exposure risks.
Aug 29, 2026
Red Hat issued Important updates for JBoss Enterprise Application Platform, Enterprise Web Platform, BPM Suite, and BRMS to remediate SSL/TLS hostname-verification flaws in Apache HttpComponents, Apache CXF, and Jakarta Commons HttpClient. The vulnerabilities, **CVE-2012-6153** and **CVE-2014-3577**, could let a man-in-the-middle attacker use a specially crafted X.509 certificate to impersonate a trusted SSL server. The defects stemmed from incomplete prior hostname-verification remediation and incorrect extraction of hostnames from certificate subject Common Name fields. Affected deployments include JBoss EAP 5.2 and 6.3, Enterprise Web Platform 5.2, and roll-up patch releases for JBoss BPM Suite and BRMS 6.0.3 across supported Red Hat Enterprise Linux versions. Administrators should apply the applicable Red Hat errata or roll-up patches, back up installations and preserve customized configurations where required, then restart the JBoss server process; BPM Suite and BRMS installations should be stopped before patching.
Aug 29, 2026