Red Hat Product Errata RHSA-2015:1947 - Security Advisory
Issued:
2015-10-28
Updated:
2015-10-28

RHSA-2015:1947 - Security Advisory

Synopsis

Important: Red Hat JBoss Operations Network 3.3.4 update

Type/Severity

Security Advisory: Important

Topic

Red Hat JBoss Operations Network 3.3 update 4, which fixes one security
issue and several bugs, is now available from the Red Hat Customer Portal.

Red Hat Product Security has rated this update as having Important security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.

Description

Red Hat JBoss Operations Network is a Middleware management solution that
provides a single point of control to deploy, manage, and monitor JBoss
Enterprise Middleware, applications, and services.

This JBoss Operations Network 3.3.4 release serves as a replacement for
JBoss Operations Network 3.3.3, and includes several bug fixes. Refer to
the Customer Portal page linked in the References section for information
on the most significant of these changes.

The following security issue is also fixed with this release:

It was found that Apache Cassandra bound an unauthenticated JMX/RMI interface to all network interfaces. A remote attacker able to access the RMI, an API for the transport and remote execution of serialized Java, could use this flaw to execute arbitrary code as the user running Cassandra. (CVE-2015-0225)

All users of JBoss Operations Network 3.3.3 as provided from the Red Hat
Customer Portal are advised to upgrade to JBoss Operations Network 3.3.4.

Solution

The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing JBoss Operations Network installation (including its databases,
applications, configuration files, the JBoss Operations Network server's
file system directory, and so on).

Refer to the JBoss Operations Network 3.3.4 Release Notes for
installation information.

Affected Products

  • Red Hat JBoss Middleware Text-Only Advisories for MIDDLEWARE 1 x86_64

Fixes

  • BZ - 1035481 - Port 9999 is already in use or unavailable when starting/installing/upgrading
  • BZ - 1208181 - CVE-2015-0225 Cassandra: remote code execution via unauthenticated JMX/RMI interface
  • BZ - 1212407 - RejectedExecutionException during installation of JON server which has been previously patched
  • BZ - 1230411 - Storage node results in 1000s of configuration changes filling up the database
  • BZ - 1232847 - Increase timeout for repair operation
  • BZ - 1234651 - Remove unsupported alert-scripts/README.txt and alert-scripts/example.rb files from product distribution
  • BZ - 1234912 - Do not authenticate against new storage node when replication_factor of system_auth keyspace is wrong
  • BZ - 1243545 - Assigned resource group list cleared when using group assignment search function
  • BZ - 1244941 - Group inventory pages (compatible, mixed, all) fail to display groups due to UI timeouts
  • BZ - 1247311 - The patch will fail on windows when it is trying to copy files with too long paths due to windows path length limitation
  • BZ - 1251503 - Creation and group association of bundle fails with IllegalArgumentException: Token did not result in valid file when deploy.xml uses rhq handover
  • BZ - 1252136 - Initial drift definition snapshot is not taken and breaks drift
  • BZ - 1252142 - Creation and group association of bundle fails with timeout followed by IllegalArgumentException: Token did not result in valid file
  • BZ - 1252458 - Rebase container upon EAP 6.4 update-03
  • BZ - 1255821 - Expose deleteBundleDestination for BundleManagerRemote in JBoss ON CLI
  • BZ - 1256329 - JON upgrade from 3.3.2 to JON 3.3.3 does not remove files introduced with JON 3.3.0 upgrade 02
  • BZ - 1258870 - It is not possible to delete events using JBoss ON CLI
  • BZ - 1259555 - Changing the Storage Node JMX port does not update the JMX connection URL
  • BZ - 1265309 - Operations running longer than 24hours should not be considered as not started

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.