-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   
Red Hat Security Advisory

Synopsis:          Important: Red Hat A-MQ Broker 7.5 release and security update
Advisory ID:       RHSA-2019:2995-01
Product:           Red Hat JBoss AMQ
Advisory URL:      https://access.redhat.com/errata/RHSA-2019:2995
Issue date:        2019-10-10
Keywords:          amq,messaging,integration,broker
Cross references:  RHEA-2019:45713-01
CVE Names:         CVE-2014-0114
====================================================================
1. Summary:

Red Hat A-MQ Broker 7.5 is now available from the Red Hat Customer Portal.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

AMQ Broker is a high-performance messaging implementation based on ActiveMQ
Artemis. It uses an asynchronous journal for fast message persistence, and
supports multiple languages, protocols, and platforms.

This release of Red Hat A-MQ Broker 7.5.0 serves as a replacement for Red
Hat A-MQ Broker 7.4.1, and includes security and bug fixes, and
enhancements. For further information, refer to the release notes linked to
in the References section.

Security Fix(es):

* Apache Struts 1: Class Loader manipulation via request parameters
(CVE-2014-0114)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

3. Solution:

Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.

The References section of this erratum contains a download link (you must
log in to download the update).

4. Bugs fixed (https://bugzilla.redhat.com/):

1091938 - CVE-2014-0114 Apache Struts 1: Class Loader manipulation via request parameters

5. JIRA issues fixed (https://issues.jboss.org/):

ENTMQBR-2849 - CVE-2014-0114 Apache Struts 1: Class Loader manipulation via request parameters [amq-7.4.0]

6. References:

https://access.redhat.com/security/cve/CVE-2014-0114
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.amq.broker&version=7.5.0
https://access.redhat.com/documentation/en-us/red_hat_amq/7.5/

7. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXZ7b4tzjgjWX9erEAQhy1BAAlZY3SIVWWf78mbhIhS4x+DCzq6s6W+B7
gh7bSOfLCqLNVyuqI99PH920CgZwtrN01VVt2by822MdIKKKHtbjFTzstm1ucLso
QlYBLkmPzkC0xGPP4q67EDhr5KctJ4wlkerTnBhfwJxvFBLZnWzgGvmawbf3X7iQ
qWwigzfVjiUwen7pv5Bol4WkzhTbvUxPEVDS696ziJI0zPyqnnDXpl+9lnXcYL0m
GLsD59I984+gLxpl9fzgOPZxm2U1gGusO5rM9vUPmGX06XJo1nsUKUuhRfLoNwQm
YcK6yVFE+TAOAKbmM2o62hnA/+UemV/bBQJh3ymVgjcHSz8UYae4vfmiPfiyBsVv
STakDzO5yz+htMLJWVAnHjLEgbcGgzrH7jqXLzNO47bZR0oVVP6RjZnsZCdhxeT7
mPZtwWSVHFl8GRriGvEKQjC27Majwva5Hnwh82IPr5lgbLpWmvQSBzDHIObdyPts
UYk+zBhZHNXzdQrnEA2BzhsXehZiMigKefutBPPEc+iXjFsLSTmGYceECyhUP/No
RuQTYanb0GdgPDpgCOoDIgPtY3VyMiCur8BkQKGIyJt4aXdSaBoqAXt4KypAFExG
lRVXHA8RRVcnqsxcpCA+VesIbPuTzmCSsgkQckv/TGLFgdAMLOA4J38bUCjulvMm
9D+Pu+r8KbU=kdcn
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce