RedHat: RHSA-2019-3200:01 Moderate: Red Hat AMQ Streams 1.3.0 release and

    Date24 Oct 2019
    CategoryRed Hat
    396
    Posted ByLinuxSecurity Advisories
    Red Hat AMQ Streams 1.3.0 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA256
    
    =====================================================================
                       Red Hat Security Advisory
    
    Synopsis:          Moderate: Red Hat AMQ Streams 1.3.0 release and security update
    Advisory ID:       RHSA-2019:3200-01
    Product:           Red Hat JBoss AMQ
    Advisory URL:      https://access.redhat.com/errata/RHSA-2019:3200
    Issue date:        2019-10-24
    Keywords:          amq,messaging,integration
    CVE Names:         CVE-2019-14439 CVE-2019-14540 CVE-2019-16335 
                       CVE-2019-17267 
    =====================================================================
    
    1. Summary:
    
    Red Hat AMQ Streams 1.3.0 is now available from the Red Hat Customer
    Portal.
    
    Red Hat Product Security has rated this update as having a security impact
    of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
    gives a detailed severity rating, is available for each vulnerability from
    the CVE link(s) in the References section.
    
    2. Description:
    
    Red Hat AMQ Streams, based on the Apache Kafka project, offers a
    distributed backbone that allows microservices and other applications to
    share data with extremely high throughput and extremely low latency. 
    
    This release of Red Hat AMQ Streams 1.3.0 serves as a replacement for Red
    Hat AMQ Streams 1.2.0, and includes security and bug fixes, and
    enhancements. For further information, refer to the release notes linked to
    in the References section.
    
    Security Fix(es):
    
    * jackson-databind: polymorphic typing issue related to
    com.zaxxer.hikari.HikariConfig (CVE-2019-14540)
    
    * jackson-databind: polymorphic typing issue related to
    com.zaxxer.hikari.HikariDataSource (CVE-2019-16335)
    
    * jackson-databind: Polymorphic typing issue related to logback/JNDI
    (CVE-2019-14439)
    
    * jackson-databind: Serialization gadgets in classes of the ehcache package
    (CVE-2019-17267)
    
    For more details about the security issue(s), including the impact, a CVSS
    score, and other related information, refer to the CVE page(s) listed in
    the References section.
    
    3. Solution:
    
    Before applying the update, back up your existing installation, including
    all applications, configuration files, databases and database settings, and
    so on.
    
    The References section of this erratum contains a download link (you must
    log in to download the update).
    
    4. Bugs fixed (https://bugzilla.redhat.com/):
    
    1752962 - CVE-2019-14439 jackson-databind: Polymorphic typing issue related to logback/JNDI
    1755831 - CVE-2019-16335 jackson-databind: polymorphic typing issue related to com.zaxxer.hikari.HikariDataSource
    1755849 - CVE-2019-14540 jackson-databind: polymorphic typing issue related to com.zaxxer.hikari.HikariConfig
    1758167 - CVE-2019-17267 jackson-databind: Serialization gadgets in classes of the ehcache package
    
    5. References:
    
    https://access.redhat.com/security/cve/CVE-2019-14439
    https://access.redhat.com/security/cve/CVE-2019-14540
    https://access.redhat.com/security/cve/CVE-2019-16335
    https://access.redhat.com/security/cve/CVE-2019-17267
    https://access.redhat.com/security/updates/classification/#moderate
    https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq.streams&downloadType=distributions&version=1.3.0
    https://access.redhat.com/products/red-hat-amq#streams
    
    6. Contact:
    
    The Red Hat security contact is . More contact
    details at https://access.redhat.com/security/team/contact/
    
    Copyright 2019 Red Hat, Inc.
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1
    
    iQIVAwUBXbFsi9zjgjWX9erEAQjT6Q/+JDAvWImEvDZuahMo6spY5gcZgEn/A2KH
    7JuCSBx+s0gW9NEIVp0emqW0dguTMmvQCqOhskE91kis6C9oJORlRPz7HqYaOGve
    7pf0fwwQREb0VRYqXtXIYgQv+ugU+/m5bSaniSvO0S3iPLqdiANV/r7qoDqPPtOH
    dkVthpaYgtx7F4myG8DvVoAUzCfpxKsKdol/riYnp/rhmnEVrJAH5EuVbGtECj7p
    f4Qv+MSd2ebO0oDe9Lqjjv3bc7RTwdRsCZywfwHLQSC7S2vJyiXFGCtdS9fYBdgb
    obNjp8G+2hZ+prO0Xg+RfKeT6/3aUK5hmV/Az5Ip4AeP0a60WvBz+yhU5wd1WRX9
    dxEb72pTG2r1ctHvYBTT3Qn2qB3fm0IRI9HfG7sRWtTXEGO2l9FN/zSDshockiJa
    jM26U3ePwqpcl6QAAe9HJBAzTcxw2Gf7ubyvmsizyueFddAmqOP+PnVqxMRntXrH
    A1sPw/Y06KATBUxkGpEY4KriJSiJU1Z2QmiAMlOa4Z+D5fAJh73BWZnLoYyPoLac
    jYg91xqmw2692d+ZAEmnBZRiWYY7IfqeesM+KzIuGYpsk2c8imXRv6/+KpqAW45l
    SgloiZiayL0WlYmF2+WUvhtH/lmzpfOnI96OJFruKHusAEVLgxj9kic5G02JteP+
    hgNap4AeRy4=
    =W3XT
    -----END PGP SIGNATURE-----
    
    --
    RHSA-announce mailing list
    This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.redhat.com/mailman/listinfo/rhsa-announce
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"65","type":"x","order":"1","pct":57.52,"resources":[]},{"id":"88","title":"Should be more technical","votes":"15","type":"x","order":"2","pct":13.27,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"33","type":"x","order":"3","pct":29.2,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.