- Red Hat JBoss A-MQ 6.x
- Red Hat JBoss BPM Suite (BPMS) 6.x
- Red Hat JBoss BRMS 6.x
- Red Hat JBoss BRMS 5.x
- Red Hat JBoss Data Grid (JDG) 6.x
- Red Hat JBoss Data Virtualization (JDV) 6.x
- Red Hat JBoss Data Virtualization (JDV) 5.x
- Red Hat JBoss Enterprise Application Platform 6.x
- Red Hat JBoss Enterprise Application Platform 5.x
- Red Hat JBoss Enterprise Application Platform 4.3.x
- Red Hat JBoss Fuse 6.x
- Red Hat JBoss Fuse Service Works (FSW) 6.x
- Red Hat JBoss Operations Network (JBoss ON) 3.x
- Red Hat JBoss Portal 6.x
- Red Hat JBoss SOA Platform (SOA-P) 5.x
- Red Hat JBoss Web Server (JWS) 3.x
An issue was reported for the Java Object Serialization affecting the
Could an unauthenticated attacker, able to access the
JMXInvokerServlet, execute arbitrary code in the context of the user running the JBoss server?
- We have received an alert from our security team on zero-day vulnerability. Does Red Hat aware about this vulnerability & workaround on this fix? If yes, please provide details.
Is there a remote code execution vulnerability in the commons-collections library?
Do CVE-2015-7501 or CVE-2015-4852 affect the JBoss Middleware Suite?
- All the products listed in the environment section are vulnerable.
- The vulnerability has been addressed. Please see the following links for complete information on the requisite patch(es)
If you cannot patch, the quickest way to resolve this specific deserialization vulnerability is to remove the vulnerable class files (
InstantiateTransformer) in all commons-collections jar files. Any manual changes should be tested to avoid unforeseen complications.
If you package commons-collection library in your application you may still be vulnerable, even after the forthcoming patches are applied. You'll need to make changes to the commons-collections library yourself if you package one.
This issue, as it affects the JBoss Middleware Suite, should be referred to as CVE-2015-7501. Other vendors have referred to it as CVE-2015-4852.
This is a multi-part flaw, with several conditions necessary to allow an exploit. For remote-code execution (RCE) from an attacker to work, the configuration must:
- Accept untrusted serialized data
- Allow blind deserialization of that data
- Classes with the vulnerability must be available in the classpath
For more information about the JMXInvokerServlet specifically please see this article
Customers are encouraged to take a "defense-in-depth" approach to securing their systems. Red Hat Product Security is determining the best path forward generally for its products with regard to this vulnerability and the larger class of deserialization vulnerabilities.
More information about the issues of Java deserialization can be found in the Red Hat Security Blog. We'll also have more blogs on this topic in the near future.
- Red Hat JBoss BPM Suite
- Red Hat JBoss Data Virtualization
- Red Hat JBoss Enterprise Application Platform
- Red Hat JBoss Fuse Service Works
- Red Hat JBoss Operations Network
- Red Hat JBoss Portal
- Red Hat JBoss SOA Platform
- Red Hat JBoss Data Services
- Red Hat Data Grid
- Red Hat Decision Manager
- Red Hat JBoss Web Server
- Red Hat JBoss AMQ
- Red Hat Fuse
- Red Hat OpenShift Container Platform
- Red Hat OpenShift Online
This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.