RHSA-2015:2502 - Security Advisory
Security Advisory: Critical
An updated package for the apache commons-collections library, fixing one
security issue, is now available for Red Hat JBoss Data Grid 6.4.1 and
6.5.1 from the Red Hat Customer Portal.
Red Hat Product Security has rated this update as having Critical security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
Red Hat JBoss Data Grid is a distributed in-memory data grid, based on
It was found that the Apache commons-collections library permitted code
execution when deserializing objects involving a specially constructed
chain of classes. A remote attacker could use this flaw to execute
arbitrary code with the permissions of the application using the
commons-collections library. (CVE-2015-7501)
Further information about this security flaw may be found at:
All users of Red Hat JBoss Data Grid 6.4.1 and 6.5.1 as provided from
the Red Hat Customer Portal are advised to install this security patch.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing JBoss Data Grid installation.
- Red Hat JBoss Data Grid Text-Only Advisories x86_64
- BZ - 1279330 - CVE-2015-7501 apache-commons-collections: InvokerTransformer code execution during deserialisation