RHSA-2021:0417MediumCVSS 7.5

Red Hat Security Advisory: Red Hat AMQ Broker 7.8.1 release and security update

Published
February 4, 2021
Last Modified
August 4, 2026

🔗 CVE IDs covered (5)

CVE-2019-10768 →CVE-2020-7676 →CVE-2020-8908 →CVE-2020-27218 →CVE-2021-26118 →

📋 Description

CVE-2019-10768 — AngularJS: Prototype pollution in merge function could result in code injection CVE-2020-7676 — nodejs-angular: XSS due to regex-based HTML replacement CVE-2020-8908 — guava: local information disclosure via temporary directory created with unsafe permissions CVE-2020-27218 — jetty: buffer not correctly recycled in Gzip Request inflation CVE-2021-26118 — 7: OpenWire can create destinations with an unpriviledged user

🎯 Affected products1

  • Red Hat AMQ 7.8.1

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). Workaround: If you are not using the openwire protocol, it can be disabled by removing it from the list of accepted protocols in the `broker.xml` ```xml <acceptor name="artemis">tcp://0.0.0.0:61616?tcpSendBufferSize=1048576;tcpReceiveBufferSize=1048576;amqpMinLargeMessageSize=102400;protocols=CORE,AMQP,STOMP,HORNETQ,MQTT;useEpoll=true;amqpCredits=1000;amqpLowCredits=300;amqpDuplicateDetection=true</acceptor> ```

🔗 References (7)