RHSA-2015:2517: Red Hat Fuse Service Works fixes Commons Collections deserialization RCE (CVE-2015-7501)

- **Title**: RHSA-2015:2517 – Security Advisory - **Summary**: Critical: Red Hat Fuse Service Works 6.0.0 commons-collections Security Update - **Type/Severity**: Security Advisory: Critical - **Subject**: An update to Apache Commons Collections, which fixes a security issue, is now available for Red Hat Fuse Service Works 6.0.0 from the Red Hat Customer Portal. - **Description**: Apache Commons Collections is a library based on Java JDK classes that provides new interfaces, implementations, and utilities. The fix for this vulnerability can be found in the quoted section. During object deserialization, the Apache Commons-collections library allows execution of code that includes a specially constructed class chain. A remote attacker could exploit this vulnerability to execute arbitrary code with the privileges of the application using the commons-collections library. - **Solution**: The reference section in the summary contains download links (you must log in to download the update). Before applying the update, back up your existing installation, including all applications, configuration files, databases, and database settings. It is recommended to pause the server by stopping the JBoss Application Server process, then restart the server after installing this update. - **Affected Products**: Red Hat JBoss Middleware Text-Only Advisories for MIDDLEWARE 1x86_64 - **Fix**: bz - 1279330 - CVE-2015-7501 apache-commons-collections: Code execution during InvokerTransformer deserialization - **CVEs**: - CVE-2015-7501 - **References**: - (Multiple URL references)

Goal Reached Thanks to every supporter — we hit 100%!

RHSA-2015:2517: Red Hat Fuse Service Works fixes Commons Collections deserialization RCE (CVE-2015-7501)