{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_vex", "csaf_version": "2.0", "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "title": "XXE via XPath expression evaluation", "tracking": { "current_release_date": "2026-07-24T22:15:40+00:00", "generator": { "date": "2026-07-24T22:15:40+00:00", "engine": { "name": "CSAF Generator", "version": "3.1.0" } }, "id": "CVE-2014-3600", "initial_release_date": "2015-02-05T00:00:00+00:00", "revision_history": [ { "date": "2026-07-24T22:15:40+00:00", "number": "1", "summary": "Last generated version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "category": "vendor", "name": "Red Hat", "branches": [ { "category": "product_name", "name": "OpenShift Container Platform", "product": { "name": "OpenShift Container Platform", "product_id": "openshift-enterprise-1", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:1" } } }, { "category": "product_name", "name": "OpenShift Container Platform 2.2.0", "product": { "name": "OpenShift Container Platform 2.2.0", "product_id": "openshift-enterprise-2.2", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:2" } } }, { "category": "product_version", "name": "activemq", "product": { "name": "activemq", "product_id": "activemq", "product_identification_helper": { "purl": "pkg:rpm/redhat/activemq" } } }, { "category": "product_version", "name": "activemq-client", "product": { "name": "activemq-client", "product_id": "activemq-client", "product_identification_helper": { "purl": "pkg:rpm/redhat/activemq-client" } } }, { "category": "product_version", "name": "activemq", "product": { "name": "activemq", "product_id": "activemq.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/activemq?arch=src" } } } ] } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "activemq as a component of OpenShift Container Platform", "product_id": "openshift-enterprise-1:activemq" }, "product_reference": "activemq", "relates_to_product_reference": "openshift-enterprise-1" }, { "category": "default_component_of", "full_product_name": { "name": "activemq-client as a component of OpenShift Container Platform", "product_id": "openshift-enterprise-1:activemq-client" }, "product_reference": "activemq-client", "relates_to_product_reference": "openshift-enterprise-1" }, { "category": "default_component_of", "full_product_name": { "name": "activemq.src as a component of OpenShift Container Platform", "product_id": "openshift-enterprise-1:activemq.src" }, "product_reference": "activemq.src", "relates_to_product_reference": "openshift-enterprise-1" }, { "category": "default_component_of", "full_product_name": { "name": "activemq.src as a component of OpenShift Container Platform 2.2.0", "product_id": "openshift-enterprise-2.2:activemq.src" }, "product_reference": "activemq.src", "relates_to_product_reference": "openshift-enterprise-2.2" } ] }, "vulnerabilities": [ { "cve": "CVE-2014-3600", "cwe": { "id": "CWE-611", "name": "Improper Restriction of XML External Entity Reference" }, "discovery_date": "2014-08-15T00:00:00+00:00", "notes": [ { "category": "other", "text": "Fuse ESB 4 and Fuse Message Broker 5.2, 5.3, 5.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nFuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/\n\nRed Hat JBoss SOA Platform 4 is now in Phase 3, Extended Life Support, of its respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nRed Hat OpenShift Enterprise 1 and 2 are now in Production 1 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat OpenShift Enterprise Life Cycle: https://access.redhat.com/site/support/policy/updates/openshift/", "title": "Statement" }, { "category": "description", "text": "It was discovered that Apache ActiveMQ performed XML External Entity (XXE) expansion when evaluating XPath expressions. A remote, attacker-controlled consumer able to specify an XPath-based selector to dequeue XML messages from an Apache ActiveMQ broker could use this flaw to read files accessible to the user running the broker, and potentially perform other more advanced XXE attacks.", "title": "Vulnerability description" } ], "product_status": { "known_affected": [ "openshift-enterprise-1:activemq", "openshift-enterprise-1:activemq-client", "openshift-enterprise-1:activemq.src", "openshift-enterprise-2.2:activemq.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2014-3600" }, { "category": "external", "summary": "nvd.nist.gov", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3600" }, { "category": "external", "summary": "www.cve.org", "url": "https://www.cve.org/CVERecord?id=CVE-2014-3600" } ], "remediations": [ { "category": "no_fix_planned", "details": "Will not fix", "product_ids": [ "openshift-enterprise-1:activemq", "openshift-enterprise-1:activemq-client", "openshift-enterprise-1:activemq.src", "openshift-enterprise-2.2:activemq.src" ] } ], "scores": [ { "cvss_v2": { "version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "baseScore": 5.0 }, "products": [ "openshift-enterprise-1:activemq", "openshift-enterprise-1:activemq-client", "openshift-enterprise-1:activemq.src", "openshift-enterprise-2.2:activemq.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate", "product_ids": [ "openshift-enterprise-1:activemq", "openshift-enterprise-1:activemq-client", "openshift-enterprise-1:activemq.src", "openshift-enterprise-2.2:activemq.src" ] } ], "title": "XXE via XPath expression evaluation" } ] }