RHSA-2020:5365MediumCVSS 8.1

Red Hat Security Advisory: Red Hat AMQ Broker 7.8 release and security update

Published
December 8, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (6)

CVE-2015-5183 →CVE-2019-9827 →CVE-2020-13932 →CVE-2020-27216 →CVE-2021-26117 →CVE-2021-26118 →

📋 Description

CVE-2015-5183 — Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ CVE-2019-9827 — hawtio: server side request forgery via initial /proxy/ substring of a URI CVE-2020-13932 — activemq: remote XSS in web console diagram plugin CVE-2020-27216 — jetty: local temporary directory hijacking vulnerability CVE-2021-26117 — activemq: LDAP authentication bypass with anonymous bind CVE-2021-26118 — 7: OpenWire can create destinations with an unpriviledged user

🎯 Affected products1

  • Red Hat AMQ

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). Workaround: Jetty users should create temp folders outside the normal /tmp structure, and ensure that their permissions are set so as not to be accessible by an attacker. Workaround: There is currently no known mitigation for this issue. Workaround: If you are not using the openwire protocol, it can be disabled by removing it from the list of accepted protocols in the `broker.xml` ```xml <acceptor name="artemis">tcp://0.0.0.0:61616?tcpSendBufferSize=1048576;tcpReceiveBufferSize=1048576;amqpMinLargeMessageSize=102400;protocols=CORE,AMQP,STOMP,HORNETQ,MQTT;useEpoll=true;amqpCredits=1000;amqpLowCredits=300;amqpDuplicateDetection=true</acceptor> ```

🔗 References (9)