Red Hat Security Advisory

RHSA-2021:0384

Red Hat JBoss Fuse/A-MQ 6.3 R18 security and bug fix update

Released 2021-02-02 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Fuse/AMQ 6.3.18

Fixes 3 records

TI-2020-16038 CVE-2020-26217 · GHSA-mw36-7c6c-q4q2

Remote Code Execution in XStream

CRITICAL 87

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.84968 Published 2020-11-16 Partial fix · 1.4.14, 1.4.14-java7 CWE-78

TI-2020-10910 CVE-2020-13933 · GHSA-2vgm-wxr3-6w2j

Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.

MEDIUM 62

Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.44411 Published 2020-08-17 Partial fix · 1.6.0 CWE-287

TI-2021-08067 CVE-2021-26117 · GHSA-9mgm-gcq8-86wq

ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind

MEDIUM 46

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.1133 Published 2021-01-27 Fixed in 2.16.0, 5.16.1 +1 CWE-287