Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 573
Alerts This Week
Warning Icon 1 573

Red Hat AMQ Broker 7.10.0 RHSA-2022:5101-01 Important Security Update

red hat
Calendar Grey June 16, 2022
Dist Redhat Esm H88
Notice regarding vulnerabilities in Red Hat AMQ Broker 7.10.0 emphasizes critical updates and security patches to address identified issues.
Red Hat AMQ Broker 7.10.0 is now available from the Red Hat Customer Portal

Solution

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).

Summary

AMQ Broker is a high-performance messaging implementation based on ActiveMQ Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms.
This release of Red Hat AMQ Broker 7.10.0 serves as a replacement for Red Hat AMQ Broker 7.9.4, and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section.
Security Fix(es):
* nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties (CVE-2019-10744)
* amq: AMQ Broker Operator ClusterWide Edit Permissions Due Token Exposure (CVE-2022-1833)
* jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)
* AMQ Broker: Malformed message can result in partial DoS (OOM) (CVE-2021-4040)
* netty: control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)
* artemis-commons: Apache ActiveMQ Artemis DoS (CVE-2022-23913)
* springframework: Spring Framework: Data Binding Rules Vulnerability (CVE-2022-22968)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory security update red hat bug fix DoS important messaging

References

https://access.redhat.com/security/cve/CVE-2019-10744 https://access.redhat.com/security/cve/CVE-2020-36518 https://access.redhat.com/security/cve/CVE-2021-4040 https://access.redhat.com/security/cve/CVE-2021-43797 https://access.redhat.com/security/cve/CVE-2022-1833 https://access.redhat.com/security/cve/CVE-2022-22968 https://access.redhat.com/security/cve/CVE-2022-23913 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.amq.broker&version=7.10.0 https://access.redhat.com/documentation/en-us/red_hat_amq_broker/

Package List


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2022:5101-01
Product: Red Hat JBoss AMQ
Advisory URL: https://access.redhat.com/errata/RHSA-2022:5101
Issue date: 2022-06-16

Topic

Red Hat AMQ Broker 7.10.0 is now available from the Red Hat CustomerPortal.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory security update red hat bug fix DoS important messaging

Relevant Releases Architectures

Bugs Fixed

1739497 - CVE-2019-10744 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties

2028254 - CVE-2021-4040 AMQ Broker: Malformed message can result in partial DoS (OOM)

2031958 - CVE-2021-43797 netty: control chars in header names may lead to HTTP request smuggling

2063601 - CVE-2022-23913 artemis-commons: Apache ActiveMQ Artemis DoS

2064698 - CVE-2020-36518 jackson-databind: denial of service via a large depth of nested objects

2075441 - CVE-2022-22968 Spring Framework: Data Binding Rules Vulnerability

2089406 - CVE-2022-1833 amq: AMQ Broker Operator ClusterWide Edit Permissions Due Token Exposure

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.