{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A micro version update (from 7.3 to 7.3.1) is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of Red Hat Fuse 7.3.1 serves as a replacement for Red Hat Fuse 7.3, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* bsh2: remote code execution via deserialization (CVE-2016-2510)\n\n* log4j: Socket receiver deserialization vulnerability (CVE-2017-5645)\n\n* uima: XML external entity expansion (XXE) can allow attackers to execute arbitrary code (CVE-2017-15691)\n\n* mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018) (CVE-2018-3258)\n\n* thrift: Improper Access Control grants access to files outside the webservers docroot path (CVE-2018-11798)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2019:1545",
        "url": "https://access.redhat.com/errata/RHSA-2019:1545"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.fuse\u0026version=7.3.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.fuse\u0026version=7.3.1"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_fuse/7.3",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_fuse/7.3"
      },
      {
        "category": "external",
        "summary": "1310647",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1310647"
      },
      {
        "category": "external",
        "summary": "1443635",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443635"
      },
      {
        "category": "external",
        "summary": "1572463",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1572463"
      },
      {
        "category": "external",
        "summary": "1640615",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1640615"
      },
      {
        "category": "external",
        "summary": "1667188",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1667188"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1545.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Fuse 7.3.1 security update",
    "tracking": {
      "current_release_date": "2026-06-28T08:57:37+00:00",
      "generator": {
        "date": "2026-06-28T08:57:37+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.2.6"
        }
      },
      "id": "RHSA-2019:1545",
      "initial_release_date": "2019-06-18T19:52:20+00:00",
      "revision_history": [
        {
          "date": "2019-06-18T19:52:20+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-06-18T19:52:20+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-28T08:57:37+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Fuse 7.3.1",
                "product": {
                  "name": "Red Hat Fuse 7.3.1",
                  "product_id": "Red Hat Fuse 7.3.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Fuse"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2016-2510",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2016-02-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1310647"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A deserialization flaw allowing remote code execution was found in the BeanShell library. If BeanShell was on the classpath, it could permit code execution if another part of the application deserialized objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the BeanShell library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bsh2: remote code execution via deserialization",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Fuse 7.3.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-2510"
        },
        {
          "category": "external",
          "summary": "RHBZ#1310647",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1310647"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-2510",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-2510"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-2510",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2510"
        },
        {
          "category": "external",
          "summary": "https://github.com/beanshell/beanshell/releases/tag/2.0b6",
          "url": "https://github.com/beanshell/beanshell/releases/tag/2.0b6"
        }
      ],
      "release_date": "2016-02-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-06-18T19:52:20+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are available from the Fuse 7.3.0 product documentation page:\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/",
          "product_ids": [
            "Red Hat Fuse 7.3.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1545"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat Fuse 7.3.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bsh2: remote code execution via deserialization"
    },
    {
      "cve": "CVE-2017-5645",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2017-04-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1443635"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j: Socket receiver deserialization vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The flaw in Log4j-1.x is now identified by CVE-2019-17571. CVE-2017-5645 has been assigned by MITRE to a similar flaw identified in Log4j-2.x",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Fuse 7.3.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2017-5645"
        },
        {
          "category": "external",
          "summary": "RHBZ#1443635",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1443635"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2017-5645",
          "url": "https://www.cve.org/CVERecord?id=CVE-2017-5645"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-5645",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5645"
        }
      ],
      "release_date": "2017-04-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-06-18T19:52:20+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are available from the Fuse 7.3.0 product documentation page:\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/",
          "product_ids": [
            "Red Hat Fuse 7.3.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1545"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat Fuse 7.3.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "log4j: Socket receiver deserialization vulnerability"
    },
    {
      "cve": "CVE-2017-15691",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2018-04-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1572463"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE) capability of various XML parsers. UIMA as part of its configuration and operation may read XML from various sources, which could be tainted in ways to cause inadvertent disclosure of local files or other internal content.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "uima: XML external entity expansion (XXE) can allow attackers to execute arbitrary code",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the versions of lucene (which contains an embedded copy of uima) as shipped with Red Hat Satellite 6.0 and 6.1. Red Hat Satellite 6.2 and later do not include lucene and are not vulnerable to this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Fuse 7.3.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2017-15691"
        },
        {
          "category": "external",
          "summary": "RHBZ#1572463",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1572463"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2017-15691",
          "url": "https://www.cve.org/CVERecord?id=CVE-2017-15691"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-15691",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15691"
        },
        {
          "category": "external",
          "summary": "https://uima.apache.org/security_report#CVE-2017-15691",
          "url": "https://uima.apache.org/security_report#CVE-2017-15691"
        }
      ],
      "release_date": "2018-04-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-06-18T19:52:20+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are available from the Fuse 7.3.0 product documentation page:\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/",
          "product_ids": [
            "Red Hat Fuse 7.3.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1545"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat Fuse 7.3.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "uima: XML external entity expansion (XXE) can allow attackers to execute arbitrary code"
    },
    {
      "cve": "CVE-2018-3258",
      "discovery_date": "2018-10-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1640615"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Re Hat Satellite does not support using mysql as a back end database, thus the mysql connector is not used in any Satellite installation.\n\nThe package mariadb Java client is now available in Red Hat Software Collections.  It can be installed this way:\n~~~\n  yum-config-manager --enable rhel-server-rhscl-7-rpms\n  yum install rh-mariadb103-mariadb-java-client\n~~~\nThis JDBC driver works fine with both, MariaDB and MySQL servers.  We recommend use of mariadb-java-client over mysql-java-connector where possible.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Fuse 7.3.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-3258"
        },
        {
          "category": "external",
          "summary": "RHBZ#1640615",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1640615"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-3258",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-3258"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-3258",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3258"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#CVE-2018-3258",
          "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#CVE-2018-3258"
        }
      ],
      "release_date": "2018-10-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-06-18T19:52:20+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are available from the Fuse 7.3.0 product documentation page:\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/",
          "product_ids": [
            "Red Hat Fuse 7.3.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1545"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat Fuse 7.3.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018)"
    },
    {
      "cve": "CVE-2018-11798",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2019-01-07T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1667188"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Node.js static web server in Apache Thrift, where it allowed a remote user to access files outside of the set web servers\u0027 docroot path. An attacker could use this flaw to possibly access unauthorized files and sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "thrift: Improper Access Control grants access to files outside the  webservers docroot path",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenStack and OpenDaylight:\nThe Java implementation of thrift is used in OpenDaylight by parts of the vpnservice functionality. This flaw refers to the JavaScript (node.js) server for Thrift, which is not used or shipped with OpenDaylight or any other part of Red Hat OpenStack Platform.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Fuse 7.3.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-11798"
        },
        {
          "category": "external",
          "summary": "RHBZ#1667188",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1667188"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-11798",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-11798"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-11798",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11798"
        }
      ],
      "release_date": "2018-10-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-06-18T19:52:20+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are available from the Fuse 7.3.0 product documentation page:\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/",
          "product_ids": [
            "Red Hat Fuse 7.3.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1545"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat Fuse 7.3.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "thrift: Improper Access Control grants access to files outside the  webservers docroot path"
    },
    {
      "cve": "CVE-2019-17571",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1785616"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in Log4j, where a vulnerable SocketServer class may lead to the deserialization of untrusted data. This flaw allows an attacker to remotely execute arbitrary code when combined with a deserialization gadget.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j: deserialization of untrusted data in SocketServer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is the same issue as CVE-2017-5645. MITRE has CVE-2017-5645 to a similar flaw found in log4j-2.x. The flaw found in log4j-1.2 has been assigned CVE-2019-17571. CVE-2019-17571 has been addressed in Red Hat Enterprise Linux via RHSA-2017:2423.\nAlso the rh-java-common-log4j package shipped with Red Hat Software Collections was addressed via RHSA-2017:1417\n\nIn Satellite 5.8, although the version of log4j as shipped in the nutch package is affected, nutch does not load any of the SocketServer classes from log4j. Satellite 5 is considered not vulnerable to this flaw since the affected code can not be reached.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Fuse 7.3.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-17571"
        },
        {
          "category": "external",
          "summary": "RHBZ#1785616",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1785616"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-17571",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-17571"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-17571",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17571"
        }
      ],
      "release_date": "2019-12-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-06-18T19:52:20+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are available from the Fuse 7.3.0 product documentation page:\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/",
          "product_ids": [
            "Red Hat Fuse 7.3.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1545"
        },
        {
          "category": "workaround",
          "details": "Please note that the Log4j upstream strongly recommends against using the SerializedLayout with the SocketAppenders. Customers may mitigate this issue by removing the SocketServer class outright; or if they must continue to use SocketAppenders, they can modify their SocketAppender configuration from SerializedLayout to use JsonLayout instead. An example of this in log4j-server.properties might look like this:\n\nlog4j.appender.file.layout=org.apache.log4j.JsonLayout",
          "product_ids": [
            "Red Hat Fuse 7.3.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Fuse 7.3.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "log4j: deserialization of untrusted data in SocketServer"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for bsh2",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\nThis update for bsh2 fixes the following issue:\n\n- CVE-2016-2510: An application that includes BeanShell on the\n  classpath may be vulnerable if another part of the application uses Java\n  serialization or XStream to deserialize data from an untrusted source.\n\nPlease see https://github.com/beanshell/beanshell/releases/tag/2.0b6 for more information.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "sdksp4-bsh2-12441",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2016_0699-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2016:0699-1",
        "url": "https://www.suse.com/support/update/announcement/2016/suse-su-20160699-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2016:0699-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2016-March/001916.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 967593",
        "url": "https://bugzilla.suse.com/967593"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-2510 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-2510/"
      }
    ],
    "title": "Security update for bsh2",
    "tracking": {
      "current_release_date": "2016-03-09T08:03:57Z",
      "generator": {
        "date": "2016-03-09T08:03:57Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2016:0699-1",
      "initial_release_date": "2016-03-09T08:03:57Z",
      "revision_history": [
        {
          "date": "2016-03-09T08:03:57Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "bsh2-2.0-318.1.noarch",
                "product": {
                  "name": "bsh2-2.0-318.1.noarch",
                  "product_id": "bsh2-2.0-318.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "bsh2-classgen-2.0-318.1.noarch",
                "product": {
                  "name": "bsh2-classgen-2.0-318.1.noarch",
                  "product_id": "bsh2-classgen-2.0-318.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "bsh2-javadoc-2.0-318.1.noarch",
                "product": {
                  "name": "bsh2-javadoc-2.0-318.1.noarch",
                  "product_id": "bsh2-javadoc-2.0-318.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Software Development Kit 11 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Software Development Kit 11 SP4",
                  "product_id": "SUSE Linux Enterprise Software Development Kit 11 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:suse:sle-sdk:11:sp4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bsh2-2.0-318.1.noarch as component of SUSE Linux Enterprise Software Development Kit 11 SP4",
          "product_id": "SUSE Linux Enterprise Software Development Kit 11 SP4:bsh2-2.0-318.1.noarch"
        },
        "product_reference": "bsh2-2.0-318.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 11 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bsh2-classgen-2.0-318.1.noarch as component of SUSE Linux Enterprise Software Development Kit 11 SP4",
          "product_id": "SUSE Linux Enterprise Software Development Kit 11 SP4:bsh2-classgen-2.0-318.1.noarch"
        },
        "product_reference": "bsh2-classgen-2.0-318.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 11 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bsh2-javadoc-2.0-318.1.noarch as component of SUSE Linux Enterprise Software Development Kit 11 SP4",
          "product_id": "SUSE Linux Enterprise Software Development Kit 11 SP4:bsh2-javadoc-2.0-318.1.noarch"
        },
        "product_reference": "bsh2-javadoc-2.0-318.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 11 SP4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2016-2510",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-2510"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 11 SP4:bsh2-2.0-318.1.noarch",
          "SUSE Linux Enterprise Software Development Kit 11 SP4:bsh2-classgen-2.0-318.1.noarch",
          "SUSE Linux Enterprise Software Development Kit 11 SP4:bsh2-javadoc-2.0-318.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-2510",
          "url": "https://www.suse.com/security/cve/CVE-2016-2510"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 967593 for CVE-2016-2510",
          "url": "https://bugzilla.suse.com/967593"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 11 SP4:bsh2-2.0-318.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 11 SP4:bsh2-classgen-2.0-318.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 11 SP4:bsh2-javadoc-2.0-318.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 11 SP4:bsh2-2.0-318.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 11 SP4:bsh2-classgen-2.0-318.1.noarch",
            "SUSE Linux Enterprise Software Development Kit 11 SP4:bsh2-javadoc-2.0-318.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-03-09T08:03:57Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2016-2510"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for bsh2",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\nThis update for bsh2 fixes the following issues: \n\n- CVE-2016-2510: An application that includes BeanShell on the\n  classpath may be vulnerable if another part of the application uses Java\n  serialization or XStream to deserialize data from an untrusted source.\n\nPlease see https://github.com/beanshell/beanshell/releases/tag/2.0b6 for more information.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-SDK-12-2016-399,SUSE-SLE-SDK-12-SP1-2016-399",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2016_0700-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2016:0700-1",
        "url": "https://www.suse.com/support/update/announcement/2016/suse-su-20160700-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2016:0700-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2016-March/001917.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 967593",
        "url": "https://bugzilla.suse.com/967593"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-2510 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-2510/"
      }
    ],
    "title": "Security update for bsh2",
    "tracking": {
      "current_release_date": "2016-03-09T08:03:33Z",
      "generator": {
        "date": "2016-03-09T08:03:33Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2016:0700-1",
      "initial_release_date": "2016-03-09T08:03:33Z",
      "revision_history": [
        {
          "date": "2016-03-09T08:03:33Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "bsh2-2.0.0.b5-3.2.noarch",
                "product": {
                  "name": "bsh2-2.0.0.b5-3.2.noarch",
                  "product_id": "bsh2-2.0.0.b5-3.2.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "bsh2-classgen-2.0.0.b5-3.2.noarch",
                "product": {
                  "name": "bsh2-classgen-2.0.0.b5-3.2.noarch",
                  "product_id": "bsh2-classgen-2.0.0.b5-3.2.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "bsh2-javadoc-2.0.0.b5-3.2.noarch",
                "product": {
                  "name": "bsh2-javadoc-2.0.0.b5-3.2.noarch",
                  "product_id": "bsh2-javadoc-2.0.0.b5-3.2.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Software Development Kit 12",
                "product": {
                  "name": "SUSE Linux Enterprise Software Development Kit 12",
                  "product_id": "SUSE Linux Enterprise Software Development Kit 12",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-sdk:12"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Software Development Kit 12 SP1",
                "product": {
                  "name": "SUSE Linux Enterprise Software Development Kit 12 SP1",
                  "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-sdk:12:sp1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bsh2-2.0.0.b5-3.2.noarch as component of SUSE Linux Enterprise Software Development Kit 12",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12:bsh2-2.0.0.b5-3.2.noarch"
        },
        "product_reference": "bsh2-2.0.0.b5-3.2.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bsh2-classgen-2.0.0.b5-3.2.noarch as component of SUSE Linux Enterprise Software Development Kit 12",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12:bsh2-classgen-2.0.0.b5-3.2.noarch"
        },
        "product_reference": "bsh2-classgen-2.0.0.b5-3.2.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bsh2-javadoc-2.0.0.b5-3.2.noarch as component of SUSE Linux Enterprise Software Development Kit 12",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12:bsh2-javadoc-2.0.0.b5-3.2.noarch"
        },
        "product_reference": "bsh2-javadoc-2.0.0.b5-3.2.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bsh2-2.0.0.b5-3.2.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP1",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP1:bsh2-2.0.0.b5-3.2.noarch"
        },
        "product_reference": "bsh2-2.0.0.b5-3.2.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bsh2-classgen-2.0.0.b5-3.2.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP1",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP1:bsh2-classgen-2.0.0.b5-3.2.noarch"
        },
        "product_reference": "bsh2-classgen-2.0.0.b5-3.2.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bsh2-javadoc-2.0.0.b5-3.2.noarch as component of SUSE Linux Enterprise Software Development Kit 12 SP1",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP1:bsh2-javadoc-2.0.0.b5-3.2.noarch"
        },
        "product_reference": "bsh2-javadoc-2.0.0.b5-3.2.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2016-2510",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-2510"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Software Development Kit 12 SP1:bsh2-2.0.0.b5-3.2.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:bsh2-classgen-2.0.0.b5-3.2.noarch",
          "SUSE Linux Enterprise Software Development Kit 12 SP1:bsh2-javadoc-2.0.0.b5-3.2.noarch",
          "SUSE Linux Enterprise Software Development Kit 12:bsh2-2.0.0.b5-3.2.noarch",
          "SUSE Linux Enterprise Software Development Kit 12:bsh2-classgen-2.0.0.b5-3.2.noarch",
          "SUSE Linux Enterprise Software Development Kit 12:bsh2-javadoc-2.0.0.b5-3.2.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-2510",
          "url": "https://www.suse.com/security/cve/CVE-2016-2510"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 967593 for CVE-2016-2510",
          "url": "https://bugzilla.suse.com/967593"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Software Development Kit 12 SP1:bsh2-2.0.0.b5-3.2.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:bsh2-classgen-2.0.0.b5-3.2.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:bsh2-javadoc-2.0.0.b5-3.2.noarch",
            "SUSE Linux Enterprise Software Development Kit 12:bsh2-2.0.0.b5-3.2.noarch",
            "SUSE Linux Enterprise Software Development Kit 12:bsh2-classgen-2.0.0.b5-3.2.noarch",
            "SUSE Linux Enterprise Software Development Kit 12:bsh2-javadoc-2.0.0.b5-3.2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Software Development Kit 12 SP1:bsh2-2.0.0.b5-3.2.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:bsh2-classgen-2.0.0.b5-3.2.noarch",
            "SUSE Linux Enterprise Software Development Kit 12 SP1:bsh2-javadoc-2.0.0.b5-3.2.noarch",
            "SUSE Linux Enterprise Software Development Kit 12:bsh2-2.0.0.b5-3.2.noarch",
            "SUSE Linux Enterprise Software Development Kit 12:bsh2-classgen-2.0.0.b5-3.2.noarch",
            "SUSE Linux Enterprise Software Development Kit 12:bsh2-javadoc-2.0.0.b5-3.2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-03-09T08:03:33Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2016-2510"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "JBoss Fuse ist ein Open Source Enterprise Service Bus (ESB).\r\nJBoss A-MQ ist eine Messaging-Plattform.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Fuse und Red Hat JBoss A-MQ ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren, Code mit den Privilegien des angegriffenen Dienstes zur Ausf\u00fchrung bringen, vertrauliche Daten einzusehen, Informationen zu manipulieren oder Sicherheitsmechanismen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-3616 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2016/wid-sec-w-2024-3616.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-3616 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3616"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2016:2036-1 vom 2016-10-06",
        "url": "https://rhn.redhat.com/errata/RHSA-2016-2036.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2016:2035-1 vom 2016-10-06",
        "url": "https://rhn.redhat.com/errata/RHSA-2016-2035.html"
      },
      {
        "category": "external",
        "summary": "Juniper Security Advisory JSA11023 vom 2020-07-08",
        "url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11023"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-7139-1 vom 2024-12-05",
        "url": "https://ubuntu.com/security/notices/USN-7139-1"
      }
    ],
    "source_lang": "en-US",
    "title": "Red Hat JBoss Fuse: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-12-05T23:00:00.000+00:00",
      "generator": {
        "date": "2024-12-06T09:15:40.792+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.10"
        }
      },
      "id": "WID-SEC-W-2024-3616",
      "initial_release_date": "2016-10-06T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2016-10-06T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initial Release"
        },
        {
          "date": "2016-10-06T22:00:00.000+00:00",
          "number": "2",
          "summary": "Version nicht vorhanden"
        },
        {
          "date": "2016-10-06T22:00:00.000+00:00",
          "number": "3",
          "summary": "Version nicht vorhanden"
        },
        {
          "date": "2019-06-18T22:00:00.000+00:00",
          "number": "4",
          "summary": "Referenz(en) aufgenommen: RHSA-2019:1545"
        },
        {
          "date": "2020-07-08T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Juniper aufgenommen"
        },
        {
          "date": "2024-12-05T23:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        }
      ],
      "status": "final",
      "version": "6"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c20.1R1",
                "product": {
                  "name": "Juniper Junos Space \u003c20.1R1",
                  "product_id": "T016874"
                }
              },
              {
                "category": "product_version",
                "name": "20.1R1",
                "product": {
                  "name": "Juniper Junos Space 20.1R1",
                  "product_id": "T016874-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:juniper:junos_space:20.1r1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Junos Space"
          }
        ],
        "category": "vendor",
        "name": "Juniper"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "6.3",
                "product": {
                  "name": "Red Hat JBoss A-MQ 6.3",
                  "product_id": "T008598",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_amq:6.3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "JBoss A-MQ"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "6.3",
                "product": {
                  "name": "Red Hat JBoss Fuse 6.3",
                  "product_id": "T008597",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse:6.3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "JBoss Fuse"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-3192",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Red Hat JBoss Fuse und Red Hat JBoss A-MQ. Die Schwachstelle besteht im Spring Framework und beruht auf der Art und WEise, wie \"inline DTD Deklarationen\" verarbeitet werden. Ein Angreifer kann dieses durch \u00dcbermitteln geeignet gestalteter XML Daten zu einem Denial of Service Angirff nutzen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T008598",
          "T000126",
          "T016874",
          "T008597"
        ]
      },
      "release_date": "2016-10-06T22:00:00.000+00:00",
      "title": "CVE-2015-3192"
    },
    {
      "cve": "CVE-2015-5344",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Red Hat JBoss Fuse in der Apache Camel camel-xstream Komponente. Die Schwachstelle beruht auf einem Deseialisierungfehler von Java Objekten. Ein Angreifer kann dieses nutzen und u. a. vertrauliche Daten einsehen oder Code zur Ausf\u00fchrung bringen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T000126",
          "T008597"
        ]
      },
      "release_date": "2016-10-06T22:00:00.000+00:00",
      "title": "CVE-2015-5344"
    },
    {
      "cve": "CVE-2015-5348",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Red Hat JBoss Fuse. Die Schwachstelle besteht in dem Apache Camels Jetty/Servlet und beruht auf einem Deserialisierungsfehler. Ein Angreifer kann dieses durch \u00dcbermitteln geeignet gestalteter Daten nutzen und beliebigen Code zur Ausf\u00fchrung bringen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T000126",
          "T008597"
        ]
      },
      "release_date": "2016-10-06T22:00:00.000+00:00",
      "title": "CVE-2015-5348"
    },
    {
      "cve": "CVE-2015-7940",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Red Hat JBoss Fuse und Red Hat JBoss A-MQ in der Komponente \"bouncycastle\". Die Schwachstelle beruht darauf, dass ein Angreifer private Schl\u00fcssel bei Verwendung von elliptischen Kurven in der Kryptographie auslesen kann."
        }
      ],
      "product_status": {
        "known_affected": [
          "T008598",
          "T000126",
          "T008597"
        ]
      },
      "release_date": "2016-10-06T22:00:00.000+00:00",
      "title": "CVE-2015-7940"
    },
    {
      "cve": "CVE-2016-2141",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Red Hat JBoss Fuse. Die Schwachstelle beruht darauf, dass neue Nodes durch JGroups nicht korrekt authentisiert werden. Ein Angreifer kann dieses nutzen und Sicherheitsmechanismen umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T000126",
          "T008597"
        ]
      },
      "release_date": "2016-10-06T22:00:00.000+00:00",
      "title": "CVE-2016-2141"
    },
    {
      "cve": "CVE-2016-2510",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Red Hat JBoss Fuse im Zusammenhang mit BeanShell. Ein anonymer, entfernter Angreifer kann diese Schwachstelle nutzen, um bei der Deserialisierung einer speziell konstruierten Klassenkette beliebigen Programmcode mit den Rechten des Dienstes auszuf\u00fchren. Zur erfolgreichen Ausnutzung dieser Schwachstelle muss der Angreifer den Benutzer dazu bringen, eine modifizierte URL oder Webseite in seinem Web-Browser zu \u00f6ffnen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T000126",
          "T008597"
        ]
      },
      "release_date": "2016-10-06T22:00:00.000+00:00",
      "title": "CVE-2016-2510"
    },
    {
      "cve": "CVE-2016-4437",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Red Hat JBoss Fuse und Red Hat JBoss A-MQ. Die Schwachstelle besteht in darin, dass Apache Shiro einen Standardschl\u00fcssel f\u00fcr die \"remember me\" Funktion verwendet. Ein Angreifer kann dieses ausnutzen und unautorisiert Zugriff auf die Inhalte erlangen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T008598",
          "T000126",
          "T008597"
        ]
      },
      "release_date": "2016-10-06T22:00:00.000+00:00",
      "title": "CVE-2016-4437"
    }
  ]
}