Red Hat Security Advisory

RHSA-2020:3817

AMQ Clients 2.8.0 Release

Released 2020-09-23 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat AMQ Clients 2 nodejs-rhea-1.0.24-1.el8, python-qpid-proton-0.32.0-1.el6_10, python-qpid-proton-0.32.0-2.el7 +38

Fixes 4 records

TI-2020-08985 CVE-2020-11113 · GHSA-9vvp-fxw6-jcxr

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between…

MEDIUM 49

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.06278 Published 2020-03-31 Partial fix · 2.9.10.4 CWE-502

TI-2020-11178 CVE-2020-14307 · GHSA-q562-x7c7-5fc9

A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with…

LOW 31

A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote InvocationTracker after a response is received…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01203 Published 2020-07-24 Partial fix CWE-404

TI-2020-11168 CVE-2020-14297 · GHSA-qcch-9268-59jw

Uncontrolled resource consumption in Red Hat wildfly

LOW 31

A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavaila…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01203 Published 2020-07-24 Partial fix · 4.0.34.Final CWE-400

TI-2020-07597 CVE-2020-9488 · GHSA-vwqq-5vrc-xw9h

Improper certificate validation in Apache Log4j

LOW 29

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.08216 Published 2020-04-27 Partial fix · 2.12.3, 2.13.2 +1 CWE-295