what you don't know can hurt you

Red Hat Security Advisory 2020-3817-01

Red Hat Security Advisory 2020-3817-01
Posted Sep 23, 2020
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2020-3817-01 - Red Hat AMQ Clients enable connecting, sending, and receiving messages over the AMQP 1.0 wire transport protocol to or from AMQ Broker 6 and 7. This update provides various bug fixes and enhancements in addition to the client package versions previously released on Red Hat Enterprise Linux 6, 7, and 8. Issues addressed include a denial of service vulnerability.

tags | advisory, denial of service, protocol
systems | linux, redhat
advisories | CVE-2020-11113, CVE-2020-14297, CVE-2020-14307, CVE-2020-9488
MD5 | b01fa8b7e8f6b990dfe586a552da815c

Red Hat Security Advisory 2020-3817-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Moderate: AMQ Clients 2.8.0 Release
Advisory ID: RHSA-2020:3817-01
Product: Red Hat AMQ Clients
Advisory URL: https://access.redhat.com/errata/RHSA-2020:3817
Issue date: 2020-09-23
CVE Names: CVE-2020-9488 CVE-2020-11113 CVE-2020-14297
CVE-2020-14307
====================================================================
1. Summary:

An update is now available for Red Hat AMQ Clients 2.8.0.

Red Hat Product Security has rated this update as having a Moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

6Client-AMQ-Clients-2 - i386, noarch, x86_64
6ComputeNode-AMQ-Clients-2 - noarch, x86_64
6Server-AMQ-Clients-2 - i386, noarch, x86_64
6Workstation-AMQ-Clients-2 - i386, noarch, x86_64
7Client-AMQ-Clients-2 - noarch, x86_64
7ComputeNode-AMQ-Clients-2 - noarch, x86_64
7Server-AMQ-Clients-2 - noarch, x86_64
7Workstation-AMQ-Clients-2 - noarch, x86_64
8Base-AMQ-Clients-2 - noarch, x86_64

3. Description:

Red Hat AMQ Clients enable connecting, sending, and receiving messages over
the AMQP 1.0 wire transport protocol to or from AMQ Broker 6 and 7.

This update provides various bug fixes and enhancements in addition to the
client package versions previously released on Red Hat Enterprise Linux 6,
7, and 8.

Security Fix(es):

* jackson-databind: Serialization gadgets in
org.apache.openjpa.ee.WASRegistryManagedRuntime (CVE-2020-11113)

* wildfly: Some EJB transaction objects may get accumulated causing Denial
of Service (CVE-2020-14297)

* wildfly: EJB SessionOpenInvocations may not be removed properly after a
response is received causing Denial of Service (CVE-2020-14307)

* log4j: improper validation of certificate with host mismatch in SMTP
appender (CVE-2020-9488)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1821315 - CVE-2020-11113 jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime
1831139 - CVE-2020-9488 log4j: improper validation of certificate with host mismatch in SMTP appender
1851327 - CVE-2020-14307 wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing Denial of Service
1853595 - CVE-2020-14297 wildfly: Some EJB transaction objects may get accumulated causing Denial of Service

6. JIRA issues fixed (https://issues.jboss.org/):

ENTMQCL-1987 - AMQ Resource Adapter example project is incompatible with Maven 3.6
ENTMQCL-1988 - AMQ Resource Adapter example project does not run
ENTMQCL-2070 - [jms] Log successful reconnects more prominently

7. Package List:

6Client-AMQ-Clients-2:

Source:
qpid-cpp-1.36.0-31.el6_10amq.src.rpm
qpid-proton-0.32.0-1.el6_10.src.rpm

i386:
python-qpid-proton-0.32.0-1.el6_10.i686.rpm
qpid-proton-c-0.32.0-1.el6_10.i686.rpm
qpid-proton-c-devel-0.32.0-1.el6_10.i686.rpm
qpid-proton-cpp-0.32.0-1.el6_10.i686.rpm
qpid-proton-cpp-devel-0.32.0-1.el6_10.i686.rpm
qpid-proton-debuginfo-0.32.0-1.el6_10.i686.rpm

noarch:
python-qpid-proton-docs-0.32.0-1.el6_10.noarch.rpm
qpid-cpp-client-docs-1.36.0-31.el6_10amq.noarch.rpm
qpid-proton-c-docs-0.32.0-1.el6_10.noarch.rpm
qpid-proton-cpp-docs-0.32.0-1.el6_10.noarch.rpm
qpid-proton-tests-0.32.0-1.el6_10.noarch.rpm

x86_64:
python-qpid-proton-0.32.0-1.el6_10.x86_64.rpm
qpid-cpp-client-1.36.0-31.el6_10amq.x86_64.rpm
qpid-cpp-client-devel-1.36.0-31.el6_10amq.x86_64.rpm
qpid-cpp-debuginfo-1.36.0-31.el6_10amq.x86_64.rpm
qpid-proton-c-0.32.0-1.el6_10.x86_64.rpm
qpid-proton-c-devel-0.32.0-1.el6_10.x86_64.rpm
qpid-proton-cpp-0.32.0-1.el6_10.x86_64.rpm
qpid-proton-cpp-devel-0.32.0-1.el6_10.x86_64.rpm
qpid-proton-debuginfo-0.32.0-1.el6_10.x86_64.rpm

6ComputeNode-AMQ-Clients-2:

Source:
qpid-cpp-1.36.0-31.el6_10amq.src.rpm
qpid-proton-0.32.0-1.el6_10.src.rpm

noarch:
python-qpid-proton-docs-0.32.0-1.el6_10.noarch.rpm
qpid-cpp-client-docs-1.36.0-31.el6_10amq.noarch.rpm
qpid-proton-c-docs-0.32.0-1.el6_10.noarch.rpm
qpid-proton-cpp-docs-0.32.0-1.el6_10.noarch.rpm
qpid-proton-tests-0.32.0-1.el6_10.noarch.rpm

x86_64:
python-qpid-proton-0.32.0-1.el6_10.x86_64.rpm
qpid-cpp-client-1.36.0-31.el6_10amq.x86_64.rpm
qpid-cpp-client-devel-1.36.0-31.el6_10amq.x86_64.rpm
qpid-cpp-debuginfo-1.36.0-31.el6_10amq.x86_64.rpm
qpid-proton-c-0.32.0-1.el6_10.x86_64.rpm
qpid-proton-c-devel-0.32.0-1.el6_10.x86_64.rpm
qpid-proton-cpp-0.32.0-1.el6_10.x86_64.rpm
qpid-proton-cpp-devel-0.32.0-1.el6_10.x86_64.rpm
qpid-proton-debuginfo-0.32.0-1.el6_10.x86_64.rpm

6Server-AMQ-Clients-2:

Source:
qpid-cpp-1.36.0-31.el6_10amq.src.rpm
qpid-proton-0.32.0-1.el6_10.src.rpm

i386:
python-qpid-proton-0.32.0-1.el6_10.i686.rpm
qpid-proton-c-0.32.0-1.el6_10.i686.rpm
qpid-proton-c-devel-0.32.0-1.el6_10.i686.rpm
qpid-proton-cpp-0.32.0-1.el6_10.i686.rpm
qpid-proton-cpp-devel-0.32.0-1.el6_10.i686.rpm
qpid-proton-debuginfo-0.32.0-1.el6_10.i686.rpm

noarch:
python-qpid-proton-docs-0.32.0-1.el6_10.noarch.rpm
qpid-cpp-client-docs-1.36.0-31.el6_10amq.noarch.rpm
qpid-proton-c-docs-0.32.0-1.el6_10.noarch.rpm
qpid-proton-cpp-docs-0.32.0-1.el6_10.noarch.rpm
qpid-proton-tests-0.32.0-1.el6_10.noarch.rpm

x86_64:
python-qpid-proton-0.32.0-1.el6_10.x86_64.rpm
qpid-cpp-client-1.36.0-31.el6_10amq.x86_64.rpm
qpid-cpp-client-devel-1.36.0-31.el6_10amq.x86_64.rpm
qpid-cpp-debuginfo-1.36.0-31.el6_10amq.x86_64.rpm
qpid-proton-c-0.32.0-1.el6_10.x86_64.rpm
qpid-proton-c-devel-0.32.0-1.el6_10.x86_64.rpm
qpid-proton-cpp-0.32.0-1.el6_10.x86_64.rpm
qpid-proton-cpp-devel-0.32.0-1.el6_10.x86_64.rpm
qpid-proton-debuginfo-0.32.0-1.el6_10.x86_64.rpm

6Workstation-AMQ-Clients-2:

Source:
qpid-cpp-1.36.0-31.el6_10amq.src.rpm
qpid-proton-0.32.0-1.el6_10.src.rpm

i386:
python-qpid-proton-0.32.0-1.el6_10.i686.rpm
qpid-proton-c-0.32.0-1.el6_10.i686.rpm
qpid-proton-c-devel-0.32.0-1.el6_10.i686.rpm
qpid-proton-cpp-0.32.0-1.el6_10.i686.rpm
qpid-proton-cpp-devel-0.32.0-1.el6_10.i686.rpm
qpid-proton-debuginfo-0.32.0-1.el6_10.i686.rpm

noarch:
python-qpid-proton-docs-0.32.0-1.el6_10.noarch.rpm
qpid-cpp-client-docs-1.36.0-31.el6_10amq.noarch.rpm
qpid-proton-c-docs-0.32.0-1.el6_10.noarch.rpm
qpid-proton-cpp-docs-0.32.0-1.el6_10.noarch.rpm
qpid-proton-tests-0.32.0-1.el6_10.noarch.rpm

x86_64:
python-qpid-proton-0.32.0-1.el6_10.x86_64.rpm
qpid-cpp-client-1.36.0-31.el6_10amq.x86_64.rpm
qpid-cpp-client-devel-1.36.0-31.el6_10amq.x86_64.rpm
qpid-cpp-debuginfo-1.36.0-31.el6_10amq.x86_64.rpm
qpid-proton-c-0.32.0-1.el6_10.x86_64.rpm
qpid-proton-c-devel-0.32.0-1.el6_10.x86_64.rpm
qpid-proton-cpp-0.32.0-1.el6_10.x86_64.rpm
qpid-proton-cpp-devel-0.32.0-1.el6_10.x86_64.rpm
qpid-proton-debuginfo-0.32.0-1.el6_10.x86_64.rpm

7Client-AMQ-Clients-2:

Source:
qpid-cpp-1.36.0-31.el7amq.src.rpm
qpid-proton-0.32.0-2.el7.src.rpm

noarch:
python-qpid-proton-docs-0.32.0-2.el7.noarch.rpm
qpid-cpp-client-docs-1.36.0-31.el7amq.noarch.rpm
qpid-proton-c-docs-0.32.0-2.el7.noarch.rpm
qpid-proton-cpp-docs-0.32.0-2.el7.noarch.rpm
qpid-proton-tests-0.32.0-2.el7.noarch.rpm

x86_64:
python-qpid-proton-0.32.0-2.el7.x86_64.rpm
qpid-cpp-client-1.36.0-31.el7amq.x86_64.rpm
qpid-cpp-client-devel-1.36.0-31.el7amq.x86_64.rpm
qpid-cpp-debuginfo-1.36.0-31.el7amq.x86_64.rpm
qpid-proton-c-0.32.0-2.el7.x86_64.rpm
qpid-proton-c-devel-0.32.0-2.el7.x86_64.rpm
qpid-proton-cpp-0.32.0-2.el7.x86_64.rpm
qpid-proton-cpp-devel-0.32.0-2.el7.x86_64.rpm
qpid-proton-debuginfo-0.32.0-2.el7.x86_64.rpm
rubygem-qpid_proton-0.32.0-2.el7.x86_64.rpm

7ComputeNode-AMQ-Clients-2:

Source:
qpid-cpp-1.36.0-31.el7amq.src.rpm
qpid-proton-0.32.0-2.el7.src.rpm

noarch:
python-qpid-proton-docs-0.32.0-2.el7.noarch.rpm
qpid-cpp-client-docs-1.36.0-31.el7amq.noarch.rpm
qpid-proton-c-docs-0.32.0-2.el7.noarch.rpm
qpid-proton-cpp-docs-0.32.0-2.el7.noarch.rpm
qpid-proton-tests-0.32.0-2.el7.noarch.rpm

x86_64:
python-qpid-proton-0.32.0-2.el7.x86_64.rpm
qpid-cpp-client-1.36.0-31.el7amq.x86_64.rpm
qpid-cpp-client-devel-1.36.0-31.el7amq.x86_64.rpm
qpid-cpp-debuginfo-1.36.0-31.el7amq.x86_64.rpm
qpid-proton-c-0.32.0-2.el7.x86_64.rpm
qpid-proton-c-devel-0.32.0-2.el7.x86_64.rpm
qpid-proton-cpp-0.32.0-2.el7.x86_64.rpm
qpid-proton-cpp-devel-0.32.0-2.el7.x86_64.rpm
qpid-proton-debuginfo-0.32.0-2.el7.x86_64.rpm
rubygem-qpid_proton-0.32.0-2.el7.x86_64.rpm

7Server-AMQ-Clients-2:

Source:
qpid-cpp-1.36.0-31.el7amq.src.rpm
qpid-proton-0.32.0-2.el7.src.rpm

noarch:
python-qpid-proton-docs-0.32.0-2.el7.noarch.rpm
qpid-cpp-client-docs-1.36.0-31.el7amq.noarch.rpm
qpid-proton-c-docs-0.32.0-2.el7.noarch.rpm
qpid-proton-cpp-docs-0.32.0-2.el7.noarch.rpm
qpid-proton-tests-0.32.0-2.el7.noarch.rpm

x86_64:
python-qpid-proton-0.32.0-2.el7.x86_64.rpm
qpid-cpp-client-1.36.0-31.el7amq.x86_64.rpm
qpid-cpp-client-devel-1.36.0-31.el7amq.x86_64.rpm
qpid-cpp-debuginfo-1.36.0-31.el7amq.x86_64.rpm
qpid-proton-c-0.32.0-2.el7.x86_64.rpm
qpid-proton-c-devel-0.32.0-2.el7.x86_64.rpm
qpid-proton-cpp-0.32.0-2.el7.x86_64.rpm
qpid-proton-cpp-devel-0.32.0-2.el7.x86_64.rpm
qpid-proton-debuginfo-0.32.0-2.el7.x86_64.rpm
rubygem-qpid_proton-0.32.0-2.el7.x86_64.rpm

7Workstation-AMQ-Clients-2:

Source:
qpid-cpp-1.36.0-31.el7amq.src.rpm
qpid-proton-0.32.0-2.el7.src.rpm

noarch:
python-qpid-proton-docs-0.32.0-2.el7.noarch.rpm
qpid-cpp-client-docs-1.36.0-31.el7amq.noarch.rpm
qpid-proton-c-docs-0.32.0-2.el7.noarch.rpm
qpid-proton-cpp-docs-0.32.0-2.el7.noarch.rpm
qpid-proton-tests-0.32.0-2.el7.noarch.rpm

x86_64:
python-qpid-proton-0.32.0-2.el7.x86_64.rpm
qpid-cpp-client-1.36.0-31.el7amq.x86_64.rpm
qpid-cpp-client-devel-1.36.0-31.el7amq.x86_64.rpm
qpid-cpp-debuginfo-1.36.0-31.el7amq.x86_64.rpm
qpid-proton-c-0.32.0-2.el7.x86_64.rpm
qpid-proton-c-devel-0.32.0-2.el7.x86_64.rpm
qpid-proton-cpp-0.32.0-2.el7.x86_64.rpm
qpid-proton-cpp-devel-0.32.0-2.el7.x86_64.rpm
qpid-proton-debuginfo-0.32.0-2.el7.x86_64.rpm
rubygem-qpid_proton-0.32.0-2.el7.x86_64.rpm

8Base-AMQ-Clients-2:

Source:
nodejs-rhea-1.0.24-1.el8.src.rpm
qpid-proton-0.32.0-2.el8.src.rpm

noarch:
nodejs-rhea-1.0.24-1.el8.noarch.rpm
python-qpid-proton-docs-0.32.0-2.el8.noarch.rpm
qpid-proton-c-docs-0.32.0-2.el8.noarch.rpm
qpid-proton-cpp-docs-0.32.0-2.el8.noarch.rpm
qpid-proton-tests-0.32.0-2.el8.noarch.rpm

x86_64:
python3-qpid-proton-0.32.0-2.el8.x86_64.rpm
python3-qpid-proton-debuginfo-0.32.0-2.el8.x86_64.rpm
qpid-proton-c-0.32.0-2.el8.x86_64.rpm
qpid-proton-c-debuginfo-0.32.0-2.el8.x86_64.rpm
qpid-proton-c-devel-0.32.0-2.el8.x86_64.rpm
qpid-proton-cpp-0.32.0-2.el8.x86_64.rpm
qpid-proton-cpp-debuginfo-0.32.0-2.el8.x86_64.rpm
qpid-proton-cpp-devel-0.32.0-2.el8.x86_64.rpm
qpid-proton-debuginfo-0.32.0-2.el8.x86_64.rpm
qpid-proton-debugsource-0.32.0-2.el8.x86_64.rpm
rubygem-qpid_proton-0.32.0-2.el8.x86_64.rpm
rubygem-qpid_proton-debuginfo-0.32.0-2.el8.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

8. References:

https://access.redhat.com/security/cve/CVE-2020-9488
https://access.redhat.com/security/cve/CVE-2020-11113
https://access.redhat.com/security/cve/CVE-2020-14297
https://access.redhat.com/security/cve/CVE-2020-14307
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_amq

9. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBX2sPG9zjgjWX9erEAQiUhQ/+JX8PxKtJxrUU/dq1RKraMhmSIMuYNJ2I
8yiRcXDkXo5Ph4bsUSkPltNNJ+uxZ9yIg/8s/Xao27Y72b1PZ5FPBL0GmtpSYL2G
aDzaPmpFP7KKGoi92lf2FEIcK1NgUyzZteIhegkAhvZtw27/dnlwY3vLfSfXiCPO
RImbUL4lHQ54V5gmWw6rQP1UUtpBnOZSkI5rl0ifIaB9ad0a3n5NxBj2oVuyhCJw
YiEz+K8we9wnTRXy3Dxpa5IHiVAsaAUDY4Pja5OQboOS9OnWniLOJMqLts4vUuQ5
HlDCVvzHZbCxaAquM7mrD63wk5Jq/Tn7OXdx2qe+naqwTj/9giX11nuRLMxLGSCZ
rBsak2dJ3Qa5j/mUEwh55ytao+k3t6OjULHu6m3TYJOZ0C32h98uboNeJBK5Zrko
7qlQaYZ1H3gdnneBRiAf8AwTyRZsMJAG+nlmW+heE2hXwrMyphWR/pWYjC+unJwr
feLE/UWju8qQxaDVp+qPutubatFbV1jIbgYugvMTlefWTO3cRSc7AbGLRpKfo2uN
ICiPKeOkMBupU8ln1P2KaaKO35iai1LXNjAY1q575ChVXgo+um388f1cpj9hqUOU
pR+f1OD1rv631WxKxbNc0Xwprxw8R2ocNuYzYxxnHuanCz9M3Gev+F35klAG6GjZ
JiQCOpBa2fE=BMtP
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

October 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    25 Files
  • 2
    Oct 2nd
    13 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    1 Files
  • 5
    Oct 5th
    15 Files
  • 6
    Oct 6th
    15 Files
  • 7
    Oct 7th
    15 Files
  • 8
    Oct 8th
    11 Files
  • 9
    Oct 9th
    3 Files
  • 10
    Oct 10th
    1 Files
  • 11
    Oct 11th
    1 Files
  • 12
    Oct 12th
    8 Files
  • 13
    Oct 13th
    12 Files
  • 14
    Oct 14th
    23 Files
  • 15
    Oct 15th
    4 Files
  • 16
    Oct 16th
    13 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    1 Files
  • 19
    Oct 19th
    27 Files
  • 20
    Oct 20th
    41 Files
  • 21
    Oct 21st
    18 Files
  • 22
    Oct 22nd
    16 Files
  • 23
    Oct 23rd
    2 Files
  • 24
    Oct 24th
    1 Files
  • 25
    Oct 25th
    1 Files
  • 26
    Oct 26th
    17 Files
  • 27
    Oct 27th
    19 Files
  • 28
    Oct 28th
    29 Files
  • 29
    Oct 29th
    13 Files
  • 30
    Oct 30th
    8 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close