Red Hat Security AdvisoryRHSA-2022:0219
Red Hat AMQ Streams 1.6.6 release and security update
Released 2022-01-20 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat AMQ Streams 1.6.6
Fixes 2 records
Priority HIGH 72
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.99999 · Published 2021-12-18 · Partial fix · 2.17.0, 2.12.3 +5 CWE-20
Priority LOW 36
Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.06201 · Published 2021-09-22 · Partial fix · 2.6.3, 2.7.2 +1 CWE-203
