Red Hat Security Advisory: Red Hat AMQ Broker 7.8.6 release and security update

🔗 CVE IDs covered (1)

📋 Description

🎯 Affected products1

• Red Hat AMQ 7.8.6

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). Workaround: For those who are not able to upgrade affected Spring classes to the fixed versions, there is a workaround customers can implement for their applications, via setting disallowed fields on the data binder, and denying various iterations of the string "class.*" For full implementation details, see Spring's early announcement post in the "suggested workarounds" section: https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement#suggested-workarounds

🔗 References (7)

• selfhttps://access.redhat.com/errata/RHSA-2022:1626
• externalhttps://access.redhat.com/security/updates/classification/#low
• externalhttps://access.redhat.com/security/vulnerabilities/RHSB-2022-003
• externalhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.amq.broker&version=7.8.6
• externalhttps://access.redhat.com/documentation/en-us/red_hat_amq/
• externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2070348
• selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1626.json