Stay Secure with the Latest Linux Advisories

security advisoryupdatered hat

Red Hat AMQ Streams 2.4.0 RHSA-2023-3223-01 Important DoS Threat

Red Hat AMQ Streams 2.4.0 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat AMQ Streams 2.4.0 release and security update Advisory ID: RHSA-2023:3223-01 Product: Red Hat AMQ Streams Advisory URL: https://access.redhat.com/errata/RHSA-2023:3223 Issue date: 2023-05-18 CVE Names: CVE-2020-36518 CVE-2021-0341 CVE-2021-37136 CVE-2021-37137 CVE-2021-46877 CVE-2022-24823 CVE-2022-36944 CVE-2022-40149 CVE-2022-40150 CVE-2022-42003 CVE-2022-42004 CVE-2023-0833 CVE-2023-1370 ==================================================================== 1. Summary: Red Hat AMQ Streams 2.4.0 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat AMQ Streams, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency. This release of Red Hat AMQ Streams 2.4.0 serves as a replacement for Red Hat AMQ Streams 2.3.0, and includes security and bug fixes, and enhancements. Security Fix(es): * scala: deserialization gadget chain (CVE-2022-36944) * json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) (CVE-2023-1370) * jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518) * okhttp:information disclosure via improperly used cryptographic function (CVE-2021-0341) * netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data (CVE-2021-37136) * netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way (CVE-2021-37137) * jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode (CVE-2021-46877) * netty: world readable temporary file containing sensitive data (CVE-2022-24823) * jettison: parser crash by stackoverflow (CVE-2022-40149) * jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003) * jackson-databind: use of deeply nested arrays (CVE-2022-42004) * Red Hat A-MQ Streams: component version with information disclosure flaw (CVE-2023-0833) * jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). 4. Bugs fixed (https://bugzilla.redhat.com/): 2004133 - CVE-2021-37136 netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data 2004135 - CVE-2021-37137 netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way 2064698 - CVE-2020-36518 jackson-databind: denial of service via a large depth of nested objects 2087186 - CVE-2022-24823 netty: world readable temporary file containing sensitive data 2129809 - CVE-2022-36944 scala: deserialization gadget chain 2135244 - CVE-2022-42003 jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS 2135247 -CVE-2022-42004 jackson-databind: use of deeply nested arrays 2135770 - CVE-2022-40150 jettison: memory exhaustion via user-supplied XML or JSON data 2135771 - CVE-2022-40149 jettison: parser crash by stackoverflow 2154086 - CVE-2021-0341 okhttp: information disclosure via improperly used cryptographic function 2169845 - CVE-2023-0833 Red Hat A-MQ Streams: component version with information disclosure flaw 2185707 - CVE-2021-46877 jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode 2188542 - CVE-2023-1370 json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) 5. JIRA issues fixed (https://redhat.atlassian.net/jira/projects): ENTMQST-4107 - [KAFKA] MM2 connector task stopped and didn?t result in failed state ENTMQST-4541 - [PROD] Create RHSA erratum for Streams 2.4.0 6. References: https://access.redhat.com/security/cve/CVE-2020-36518 https://access.redhat.com/security/cve/CVE-2021-0341 https://access.redhat.com/security/cve/CVE-2021-37136 https://access.redhat.com/security/cve/CVE-2021-37137 https://access.redhat.com/security/cve/CVE-2021-46877 https://access.redhat.com/security/cve/CVE-2022-24823 https://access.redhat.com/security/cve/CVE-2022-36944 https://access.redhat.com/security/cve/CVE-2022-40149 https://access.redhat.com/security/cve/CVE-2022-40150 https://access.redhat.com/security/cve/CVE-2022-42003 https://access.redhat.com/security/cve/CVE-2022-42004 https://access.redhat.com/security/cve/CVE-2023-0833 https://access.redhat.com/security/cve/CVE-2023-1370 https://access.redhat.com/security/updates/classification#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.amq.streams&version=2.4.0 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBZGYRq9zjgjWX9erEAQjqlg/7BI+a1ZARPpg2cKgqsG9s+3qTV3xhHgrf PQjv6956eva9jcpz9B8E48y/LkaS3oO2oqBm//JTNzeEHyUsjLnNyMGkPrcn/f+h 5pUQp8fMN4Z2u1Fm0EqyZzzEstrfUYfC9IHeCg520h/9nj9gg6kmFATMQlu39HFR bFGQTN/q6SCH9SjzhrJdhGEt4ZFlHRKQKnzquONvfs63mSRutpIZLJddDcB3Cwbv sMQeW6VD6RgkaW9qt/DV1I2l34A0eeYaGJdGHdmTQFRGqx4AFFYIpT9IUxps0Lpf JDg2fu0wwhCl+uf8OCQALEb0EEvvKGd01Og9nPoh5TT7P8SUr6jpn27OyEj1gcv/ M8Mh7IyiyrS/AX7sdWn+THzw3DDswkW4o+cecUnFa6OsYNZA5xh1Bh5Iv5H+tb+G gAGtbRCutn4phyUZBZCg5eLp+PbRI5APKzGG+UaSreiAhUlw5OLp1pop3LEKFJXZ QJV30UprUxjOrOSkgr0PScgObVGg/ZH1qXIG7i2ckr0iHi2MkpywALvPvJ550CUh 6fiVtNuzrslkz+g2KMvSZRPpLSBGkuHI5ryIIByfV80GsQXamSNvRBqkU2Ak/LJm 9IKoFk7Qvc4Ndt/gFUfFYomYV+Oq6Byhz+BlGd1dGVj7WQnR+wlzluSxfKX1LhOI G4L7Lgc41F0=lqyN -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Critical Red Hat AMQ Streams 2.4.0 has resolved various security vulnerabilities such as data exposure and denial of service threats.. RedHat Security Advisory, AMQ Streams Update, Important Security Fixes. . Severity: Important. LinuxSecurity.com Team

May 18, 2023 •Important Red Hat