Red Hat Security Advisory

RHSA-2023:5946

Red Hat AMQ Broker 7.11.3 release and security update

Released 2023-10-19 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat AMQ Broker 7

Fixes 4 records

TI-2023-23979 CVE-2023-44487 · GHSA-qppj-fm5r-hxr3

The HTTP/2 protocol allows a denial of service (server resource consumption) because…

CRITICAL 90KEV

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.99999 Published 2023-10-10 Partial fix · 1.28.0, 0.17.0 +9 CWE-400

TI-2023-21704 CVE-2023-41080 · GHSA-q3mw-pvr8-9ggc

Apache Tomcat: Open redirect with FORM authentication

LOW 37

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.06459 Published 2023-08-25 Partial fix · 11.0.0-M11, 10.1.13 +2 CWE-601

TI-2023-17287 CVE-2023-34462 · GHSA-6mjq-h674-j845

netty-handler SniHandler 16MB allocation

LOW 34

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02459 Published 2023-06-22 Partial fix · 4.1.94.Final CWE-400

TI-2023-21041 CVE-2023-40167 · GHSA-hmr7-m48g-48f6

Jetty accepts "+" prefixed value in Content-Length

LOW 33

Jetty is a Java based web server and servlet engine.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01279 Published 2023-09-15 Partial fix · 9.4.52, 10.0.16 +2 CWE-130