Lucene search

RedHatRHSA-2023:7697

HistoryDec 07, 2023 - 1:39 p.m.

(RHSA-2023:7697) Moderate: AMQ Clients 2023.Q4

2023-12-0713:39:41

access.redhat.com

red hat amq

client package

bug fixes

enhancements

security fixes

cve-2023-34050

cve-2023-34462

cve-2023-40167

cve-2022-1471

cve-2022-25857

cve-2022-38749

cve-2022-41854

cve-2023-1370

cvss score

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.008 Low

EPSS

Percentile

81.7%

JSON

Each Red Hat AMQ Client enables sending, and receiving messages to or from AMQ Broker 7.

This update provides various bug fixes and enhancements in addition to the
client package versions previously released on Red Hat Enterprise Linux 8
and 9.

Security Fix(es):

(CVE-2023-34050) springframework-amqp: Deserialization Vulnerability
(CVE-2023-34462) netty: SniHandler 16MB allocation leads to OOM
(CVE-2023-40167) jetty: Improper validation of HTTP/1 content-length
(CVE-2022-1471) SnakeYaml: Constructor Deserialization Remote Code Execution
(CVE-2022-25857) snakeyaml: Denial of Service due to missing nested depth limitation for collections
(CVE-2022-38749) snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode
(CVE-2022-41854) dev-java/snakeyaml: DoS via stack overflow
(CVE-2023-1370) json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.