https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |bkundal@redhat.com, | |dimitris@redhat.com, | |dosoudil@redhat.com, | |psotirop@redhat.com Whiteboard|impact=moderate,public=2015 |impact=moderate,public=2015 |1208,reported=20151208,sour |1208,reported=20151208,sour |ce=oss-security,cvss2=6.0/A |ce=oss-security,cvss2=6.0/A |V:N/AC:M/Au:S/C:P/I:P/A:P,c |V:N/AC:M/Au:S/C:P/I:P/A:P,c |we=CWE-502,fedora-all/activ |we=CWE-502,fedora-all/activ |emq=affected,amq-6/activemq |emq=affected,amq-6/activemq |=affected,fsw-6.0.x/activem |=affected,fsw-6.0.x/activem |q=affected,fuse-6/activemq= |q=affected,fuse-6/activemq= |affected,openshift-enterpri |affected,openshift-enterpri |se-2/activemq=wontfix,opens |se-2/activemq=wontfix,opens |hift-1/activemq=defer,eap-6 |hift-1/activemq=defer,eap-6 |/hornetq=wontfix |/hornetq=wontfix,eap-7/arte | |mis=wontfix
--- Comment #20 from Jason Shepherd jshepherd@redhat.com --- Mitigation:
If you do deploy a JMS publisher, and subscriber, and don't trust the messages sent to you by your clients, you could mitigate this issue using the features of the Java Virtual Machine added in JEP 290:
http://openjdk.java.net/jeps/290