Red Hat Security Advisory

RHSA-2020:5365

Red Hat AMQ Broker 7.8 release and security update

Released 2020-12-08 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat AMQ

Fixes 6 records

TI-2019-07212 CVE-2019-9827 · GHSA-mcg9-64cp-xwp7

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an…

MEDIUM 64

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.26803 Published 2019-07-03 Partial fix · 2.5.0 CWE-918

TI-2021-08067 CVE-2021-26117 · GHSA-9mgm-gcq8-86wq

ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind

MEDIUM 46

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.1133 Published 2021-01-27 Fixed in 2.16.0, 5.16.1 +1 CWE-287

TI-2021-08068 CVE-2021-26118 · GHSA-q7fr-vqhq-v5xr

Flaw in ActiveMQ Artemis OpenWire support

LOW 39

While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03859 Published 2021-01-27 Partial fix · 2.16.0 CWE-284

TI-2020-16542 CVE-2020-27216 · GHSA-g3wg-6mcf-8jj6

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and…

LOW 38

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that syste…

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.04352 Published 2020-10-23 Partial fix · 9.4.33.v20201020, 9.4.33 +2 CWE-378

TI-2015-04351 CVE-2015-5183 · GHSA-mr89-3f5g-76w3

Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.

LOW 37

Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02204 Published 2017-09-25 Partial fix

TI-2020-10909 CVE-2020-13932 · GHSA-3h2h-xqr2-2jp7

Cross-site scripting in Apache ActiveMQ Artemis

LOW 34

In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.04347 Published 2020-07-20 Partial fix · 2.14.0 CWE-79