Red Hat JBoss EAP Updates Fix XXE, RBAC Bypass, and Information Disclosure
Patch & Detection Intelligence · 72 sources · Updated 2mo ago · First seen Feb 11, 2015
Red Hat released moderate-severity updates for JBoss Enterprise Application Platform (EAP) 6.3.3/6.3.z on Red Hat Enterprise Linux 5, 6, and 7, addressing five flaws in RESTEasy XML handling, RBAC, JacORB, security-domain selection, and Weld conversation-state processing. The most externally reachable issue, CVE-2014-7839, allowed XML external entity expansion through a RESTEasy endpoint, potentially exposing files readable by the application-server account.
The updates also remediate CVE-2014-7849, through which an authenticated RBAC Maintainer could alter a limited set of protected attributes, and CVE-2014-7853, which exposed sensitive security-domain data to authenticated users with incorrectly sufficient attribute permissions. Organizations should apply the relevant RHSA-2015:0215, RHSA-2015:0216, or RHSA-2015:0218 packages—including the RHEL 5 component updates—and restart JBoss server processes to activate the fixes.
