Stay Secure with the Latest Linux Advisories

security advisorysecurity issueupdate

RedHat: RHSA-2019-0886-01 Important: AMQ Clients 2.3.1 TLS Issue

Updated Red Hat AMQ Clients 2.3.1 packages are now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: AMQ Clients 2.3.1 release and security update Advisory ID: RHSA-2019:0886-01 Product: Red Hat AMQ Clients Advisory URL: https://access.redhat.com/errata/RHSA-2019:0886 Issue date: 2019-04-25 CVE Names: CVE-2019-0223 ==================================================================== 1. Summary: Updated Red Hat AMQ Clients 2.3.1 packages are now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: 6Client-AMQ-Clients-2 - i386, noarch, x86_64 6ComputeNode-AMQ-Clients-2 - noarch, x86_64 6Server-AMQ-Clients-2 - i386, noarch, x86_64 6Workstation-AMQ-Clients-2 - i386, noarch, x86_64 7Client-AMQ-Clients-2 - noarch, x86_64 7ComputeNode-AMQ-Clients-2 - noarch, x86_64 7Server-AMQ-Clients-2 - noarch, x86_64 7Workstation-AMQ-Clients-2 - noarch, x86_64 3. Description: Red Hat AMQ Clients enable connecting, sending, and receiving messages over the AMQP 1.0 wire transport protocol to or from AMQ Broker 6 and 7. This update provides various bug fixes and enhancements in addition to the client package versions previously released on Red Hat Enterprise Linux 6 and 7. Security Fix(es): * qpid-proton: TLS Man in the Middle Vulnerability (CVE-2019-0223) For more details about the security issue(s), including the impact, a CVSS score, and other relatedinformation, refer to the CVE page(s) listed in the References section. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1702439 - CVE-2019-0223 qpid-proton: TLS Man in the Middle Vulnerability 6. JIRA issues fixed (https://redhat.atlassian.net/jira/projects): ENTMQCL-1294 - CVE-2019-0223: qpid-proton: TLS Man in the Middle Vulnerability [amq-cl-2] 7. PackageList: 6Client-AMQ-Clients-2: Source: qpid-proton-0.27.0-3.el6.src.rpm i386: python-qpid-proton-0.27.0-3.el6.i686.rpm qpid-proton-c-0.27.0-3.el6.i686.rpm qpid-proton-c-devel-0.27.0-3.el6.i686.rpm qpid-proton-cpp-0.27.0-3.el6.i686.rpm qpid-proton-cpp-devel-0.27.0-3.el6.i686.rpm qpid-proton-debuginfo-0.27.0-3.el6.i686.rpm noarch: python-qpid-proton-docs-0.27.0-3.el6.noarch.rpm qpid-proton-c-docs-0.27.0-3.el6.noarch.rpm qpid-proton-cpp-docs-0.27.0-3.el6.noarch.rpm qpid-proton-tests-0.27.0-3.el6.noarch.rpm x86_64: python-qpid-proton-0.27.0-3.el6.x86_64.rpm qpid-proton-c-0.27.0-3.el6.x86_64.rpm qpid-proton-c-devel-0.27.0-3.el6.x86_64.rpm qpid-proton-cpp-0.27.0-3.el6.x86_64.rpm qpid-proton-cpp-devel-0.27.0-3.el6.x86_64.rpm qpid-proton-debuginfo-0.27.0-3.el6.x86_64.rpm 6ComputeNode-AMQ-Clients-2: Source: qpid-proton-0.27.0-3.el6.src.rpm noarch: python-qpid-proton-docs-0.27.0-3.el6.noarch.rpm qpid-proton-c-docs-0.27.0-3.el6.noarch.rpm qpid-proton-cpp-docs-0.27.0-3.el6.noarch.rpm qpid-proton-tests-0.27.0-3.el6.noarch.rpm x86_64: python-qpid-proton-0.27.0-3.el6.x86_64.rpm qpid-proton-c-0.27.0-3.el6.x86_64.rpm qpid-proton-c-devel-0.27.0-3.el6.x86_64.rpm qpid-proton-cpp-0.27.0-3.el6.x86_64.rpm qpid-proton-cpp-devel-0.27.0-3.el6.x86_64.rpm qpid-proton-debuginfo-0.27.0-3.el6.x86_64.rpm 6Server-AMQ-Clients-2: Source: qpid-proton-0.27.0-3.el6.src.rpm i386: python-qpid-proton-0.27.0-3.el6.i686.rpm qpid-proton-c-0.27.0-3.el6.i686.rpm qpid-proton-c-devel-0.27.0-3.el6.i686.rpm qpid-proton-cpp-0.27.0-3.el6.i686.rpm qpid-proton-cpp-devel-0.27.0-3.el6.i686.rpm qpid-proton-debuginfo-0.27.0-3.el6.i686.rpm noarch: python-qpid-proton-docs-0.27.0-3.el6.noarch.rpm qpid-proton-c-docs-0.27.0-3.el6.noarch.rpm qpid-proton-cpp-docs-0.27.0-3.el6.noarch.rpm qpid-proton-tests-0.27.0-3.el6.noarch.rpm x86_64: python-qpid-proton-0.27.0-3.el6.x86_64.rpm qpid-proton-c-0.27.0-3.el6.x86_64.rpm qpid-proton-c-devel-0.27.0-3.el6.x86_64.rpm qpid-proton-cpp-0.27.0-3.el6.x86_64.rpm qpid-proton-cpp-devel-0.27.0-3.el6.x86_64.rpm qpid-proton-debuginfo-0.27.0-3.el6.x86_64.rpm 6Workstation-AMQ-Clients-2: Source: qpid-proton-0.27.0-3.el6.src.rpm i386: python-qpid-proton-0.27.0-3.el6.i686.rpm qpid-proton-c-0.27.0-3.el6.i686.rpm qpid-proton-c-devel-0.27.0-3.el6.i686.rpm qpid-proton-cpp-0.27.0-3.el6.i686.rpm qpid-proton-cpp-devel-0.27.0-3.el6.i686.rpm qpid-proton-debuginfo-0.27.0-3.el6.i686.rpm noarch: python-qpid-proton-docs-0.27.0-3.el6.noarch.rpm qpid-proton-c-docs-0.27.0-3.el6.noarch.rpm qpid-proton-cpp-docs-0.27.0-3.el6.noarch.rpm qpid-proton-tests-0.27.0-3.el6.noarch.rpm x86_64: python-qpid-proton-0.27.0-3.el6.x86_64.rpm qpid-proton-c-0.27.0-3.el6.x86_64.rpm qpid-proton-c-devel-0.27.0-3.el6.x86_64.rpm qpid-proton-cpp-0.27.0-3.el6.x86_64.rpm qpid-proton-cpp-devel-0.27.0-3.el6.x86_64.rpm qpid-proton-debuginfo-0.27.0-3.el6.x86_64.rpm 7Client-AMQ-Clients-2: Source: qpid-proton-0.27.0-3.el7.src.rpm noarch: python-qpid-proton-docs-0.27.0-3.el7.noarch.rpm qpid-proton-c-docs-0.27.0-3.el7.noarch.rpm qpid-proton-cpp-docs-0.27.0-3.el7.noarch.rpm qpid-proton-tests-0.27.0-3.el7.noarch.rpm x86_64: python-qpid-proton-0.27.0-3.el7.x86_64.rpm qpid-proton-c-0.27.0-3.el7.x86_64.rpm qpid-proton-c-devel-0.27.0-3.el7.x86_64.rpm qpid-proton-cpp-0.27.0-3.el7.x86_64.rpm qpid-proton-cpp-devel-0.27.0-3.el7.x86_64.rpm qpid-proton-debuginfo-0.27.0-3.el7.x86_64.rpm 7ComputeNode-AMQ-Clients-2: Source: qpid-proton-0.27.0-3.el7.src.rpm noarch: python-qpid-proton-docs-0.27.0-3.el7.noarch.rpm qpid-proton-c-docs-0.27.0-3.el7.noarch.rpm qpid-proton-cpp-docs-0.27.0-3.el7.noarch.rpm qpid-proton-tests-0.27.0-3.el7.noarch.rpm x86_64: python-qpid-proton-0.27.0-3.el7.x86_64.rpm qpid-proton-c-0.27.0-3.el7.x86_64.rpm qpid-proton-c-devel-0.27.0-3.el7.x86_64.rpm qpid-proton-cpp-0.27.0-3.el7.x86_64.rpm qpid-proton-cpp-devel-0.27.0-3.el7.x86_64.rpm qpid-proton-debuginfo-0.27.0-3.el7.x86_64.rpm 7Server-AMQ-Clients-2: Source: qpid-proton-0.27.0-3.el7.src.rpm noarch: python-qpid-proton-docs-0.27.0-3.el7.noarch.rpm qpid-proton-c-docs-0.27.0-3.el7.noarch.rpm qpid-proton-cpp-docs-0.27.0-3.el7.noarch.rpm qpid-proton-tests-0.27.0-3.el7.noarch.rpm x86_64: python-qpid-proton-0.27.0-3.el7.x86_64.rpm qpid-proton-c-0.27.0-3.el7.x86_64.rpm qpid-proton-c-devel-0.27.0-3.el7.x86_64.rpm qpid-proton-cpp-0.27.0-3.el7.x86_64.rpm qpid-proton-cpp-devel-0.27.0-3.el7.x86_64.rpm qpid-proton-debuginfo-0.27.0-3.el7.x86_64.rpm 7Workstation-AMQ-Clients-2: Source: qpid-proton-0.27.0-3.el7.src.rpm noarch: python-qpid-proton-docs-0.27.0-3.el7.noarch.rpm qpid-proton-c-docs-0.27.0-3.el7.noarch.rpm qpid-proton-cpp-docs-0.27.0-3.el7.noarch.rpm qpid-proton-tests-0.27.0-3.el7.noarch.rpm x86_64: python-qpid-proton-0.27.0-3.el7.x86_64.rpm qpid-proton-c-0.27.0-3.el7.x86_64.rpm qpid-proton-c-devel-0.27.0-3.el7.x86_64.rpm qpid-proton-cpp-0.27.0-3.el7.x86_64.rpm qpid-proton-cpp-devel-0.27.0-3.el7.x86_64.rpm qpid-proton-debuginfo-0.27.0-3.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 8. References: https://access.redhat.com/security/cve/CVE-2019-0223 https://access.redhat.com/security/updates/classification/#important https://docs.redhat.com/en/documentation/red_hat_amq/2021.q4/ 9. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBXMFmANzjgjWX9erEAQhWOA/7Bqozi6cF2fu9KJ2HrZSeHlBb0d/sqy8p +/PAWvTokYp0ZuzyBDEPYczX/t1jxnDf0nkSfoM7YUN0sE+2lDqVEamfdhM/At8f jJTw/yFJcbClBAHgD+BlTVDQns2tVtkCWqai1Q4atVKuGmmqauH78Y7JnNqNXq1F BPSrb9yyfEpyMgasG/6pH+vL+/k43/EInRVcIKaYhX0XFwvC2l2j06ImdCH0xxrg XLq3Vs7uB4Gv0R1hRZslw0Y4wF8nziUHYpPJcA+Ogx+ovDFT8YJQ15p2Fqdwf7On SPPM56kZLa7Xz1DXDETqUmExgnGRqsllHHlIid0hZI2I23qzV6xQ+EolL/yFW9vm ePGr7Ur9OzdvTWugaFZtOXRug0rPe9U1RAMtJR6v9i8jVju1/7dnxaNWsOEBbOs9 yNxBgXFTEcJXSpuK5GbkMDfnhYlrVzs+jetcnaKgyro2rAOlJzMqNVDBWm4gOLao 3LXycEtvoXZq7q0EehMmZWfjjSADrMddHDQXHm7jCd4JoAoOR+S5QNSQZLUB6Dng CnlpIE4YJfwEEtJDbi7m36+tKbLT9tJVgPVJpd4Cr1chVjEJcsrNfctN190bxvAT iBF+dg6U4NXUkclmYjhy8sGWEiJa8c9SfwFtkKrwarPCXVwoyTEQL7fcPCy8+yCY Yqtn+S6Mr0A=u9Uq -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . The latest version of Red Hat AMQ Clients 2.3.1 is now released, featuring crucial security enhancements. You can access the update and download it today.. Red Hat AMQ, Security Update, Important Advisory, TLS Issue. . Severity: Important. LinuxSecurity.com Team

Apr 25, 2019 •Important Red Hat