RHSA-2020:3817MediumCVSS 8.1

Red Hat Security Advisory: AMQ Clients 2.8.0 Release

Published
September 23, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (4)

CVE-2020-9488 →CVE-2020-11113 →CVE-2020-14297 →CVE-2020-14307 →

📋 Description

CVE-2020-9488 — log4j: improper validation of certificate with host mismatch in SMTP appender CVE-2020-11113 — jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime CVE-2020-14297 — wildfly: Some EJB transaction objects may get accumulated causing Denial of Service CVE-2020-14307 — wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing Denial of Service

🎯 Affected products59

  • Red Hat AMQ Clients 2
  • nodejs-rhea-0:1.0.24-1.el8.noarch as a component of Red Hat AMQ Clients 2
  • nodejs-rhea-0:1.0.24-1.el8.src as a component of Red Hat AMQ Clients 2
  • python-qpid-proton-0:0.32.0-1.el6_10.i686 as a component of Red Hat AMQ Clients 2
  • python-qpid-proton-0:0.32.0-1.el6_10.x86_64 as a component of Red Hat AMQ Clients 2
  • python-qpid-proton-0:0.32.0-2.el7.x86_64 as a component of Red Hat AMQ Clients 2
  • python-qpid-proton-docs-0:0.32.0-1.el6_10.noarch as a component of Red Hat AMQ Clients 2
  • python-qpid-proton-docs-0:0.32.0-2.el7.noarch as a component of Red Hat AMQ Clients 2
  • python-qpid-proton-docs-0:0.32.0-2.el8.noarch as a component of Red Hat AMQ Clients 2
  • python3-qpid-proton-0:0.32.0-2.el8.x86_64 as a component of Red Hat AMQ Clients 2
  • python3-qpid-proton-debuginfo-0:0.32.0-2.el8.x86_64 as a component of Red Hat AMQ Clients 2
  • qpid-cpp-0:1.36.0-31.el6_10amq.src as a component of Red Hat AMQ Clients 2
  • qpid-cpp-0:1.36.0-31.el7amq.src as a component of Red Hat AMQ Clients 2
  • qpid-cpp-client-0:1.36.0-31.el6_10amq.x86_64 as a component of Red Hat AMQ Clients 2
  • qpid-cpp-client-0:1.36.0-31.el7amq.x86_64 as a component of Red Hat AMQ Clients 2
  • qpid-cpp-client-devel-0:1.36.0-31.el6_10amq.x86_64 as a component of Red Hat AMQ Clients 2
  • qpid-cpp-client-devel-0:1.36.0-31.el7amq.x86_64 as a component of Red Hat AMQ Clients 2
  • qpid-cpp-client-docs-0:1.36.0-31.el6_10amq.noarch as a component of Red Hat AMQ Clients 2
  • qpid-cpp-client-docs-0:1.36.0-31.el7amq.noarch as a component of Red Hat AMQ Clients 2
  • qpid-cpp-debuginfo-0:1.36.0-31.el6_10amq.x86_64 as a component of Red Hat AMQ Clients 2
  • qpid-cpp-debuginfo-0:1.36.0-31.el7amq.x86_64 as a component of Red Hat AMQ Clients 2
  • qpid-proton-0:0.32.0-1.el6_10.src as a component of Red Hat AMQ Clients 2
  • qpid-proton-0:0.32.0-2.el7.src as a component of Red Hat AMQ Clients 2
  • qpid-proton-0:0.32.0-2.el8.src as a component of Red Hat AMQ Clients 2
  • qpid-proton-c-0:0.32.0-1.el6_10.i686 as a component of Red Hat AMQ Clients 2
  • qpid-proton-c-0:0.32.0-1.el6_10.x86_64 as a component of Red Hat AMQ Clients 2
  • qpid-proton-c-0:0.32.0-2.el7.x86_64 as a component of Red Hat AMQ Clients 2
  • qpid-proton-c-0:0.32.0-2.el8.x86_64 as a component of Red Hat AMQ Clients 2
  • qpid-proton-c-debuginfo-0:0.32.0-2.el8.x86_64 as a component of Red Hat AMQ Clients 2
  • qpid-proton-c-devel-0:0.32.0-1.el6_10.i686 as a component of Red Hat AMQ Clients 2
  • +29 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Previous versions can set the system property mail.smtp.ssl.checkserveridentity to true to globally enable hostname verification for SMTPS connections. Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`

🔗 References (11)