-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Red Hat AMQ Interconnect 1.9.0 release and security update
Advisory ID: RHSA-2020:4211-01
Product: Red Hat JBoss AMQ Interconnect
Advisory URL: https://access.redhat.com/errata/RHSA-2020:4211
Issue date: 2020-10-08
CVE Names: CVE-2020-7656 CVE-2020-11022 CVE-2020-11023
====================================================================
1. Summary:
Red Hat AMQ Interconnect 1.9.0 release packages are available for A-MQ
Interconnect on RHEL 6, 7, and 8.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
6ComputeNode-RH6-A-MQ-Interconnect-1 - noarch, x86_64
6Server-RH6-A-MQ-Interconnect-1 - i386, noarch, x86_64
6Workstation-RH6-A-MQ-Interconnect-1 - i386, noarch, x86_64
7ComputeNode-RH7-A-MQ-Interconnect-1 - noarch, x86_64
7Server-RH7-A-MQ-Interconnect-1 - noarch, x86_64
7Workstation-RH7-A-MQ-Interconnect-1 - noarch, x86_64
8Base-A-MQ-Interconnect-1 - noarch, x86_64
3. Description:
Red Hat AMQ Interconnect is a component of the AMQ 7 product family. AMQ
Interconnect provides flexible routing of messages between AMQP-enabled
endpoints, whether they are clients, servers, brokers, or any other entity
that can send or receive standard AMQP messages.
This release of Red Hat AMQ Interconnect 1.9.0 serves as a replacement for
Red Hat AMQ Interconnect 1.8.0 and includes security and bug fixes, and
enhancements. For further information, refer to the release notes linked
to in the References section.
Security Fix(es):
* jQuery: allows XSS via the load method (CVE-2020-7656)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter
method (CVE-2020-11022)
* jQuery: passing HTML containing