Red Hat Security Advisory

RHSA-2020:3133

Red Hat AMQ Broker 7.4.4 release and security update

Released 2020-07-23 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat AMQ

Fixes 4 records

TI-2020-01877 CVE-2020-1953 · GHSA-7qx4-pp76-vrqh

Improper input validation in Apache Commons Configuration

MEDIUM 52

Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.06323 Published 2020-03-13 Partial fix · 2.7 CWE-20

TI-2018-11237 CVE-2018-15756 · GHSA-ffvq-7w96-97p7

DoS Attack via Range Requests

MEDIUM 50

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through t…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.08797 Published 2018-10-18 Partial fix · 5.1.1.RELEASE, 5.0.10.RELEASE +1

TI-2020-09314 CVE-2020-11612 · GHSA-mm9x-g8pc-w292

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while…

MEDIUM 45

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.09188 Published 2020-04-07 Partial fix · 4.1.46 CWE-770

TI-2020-08626 CVE-2020-10727 · GHSA-q9g8-9hpp-xc82

Cleartext storage of sensitive information in Red Hat ActiveMQ Artemis

LOW 26

A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executi…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00697 Published 2020-06-26 Fixed in 2.13.0 CWE-312