Red Hat Security Advisory: Red Hat AMQ Broker 7.9.4 release and security update
🔗 CVE IDs covered (1)
📋 Description
CVE-2022-22965 — spring-framework: RCE via Data Binding on JDK 9+
🎯 Affected products1
- Red Hat AMQ 7.9.4
✅ Remediation
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). Workaround: For those who are not able to upgrade affected Spring classes to the fixed versions, there is a workaround customers can implement for their applications, via setting disallowed fields on the data binder, and denying various iterations of the string "class.*" For full implementation details, see Spring's early announcement post in the "suggested workarounds" section: https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement#suggested-workarounds
🔗 References (7)
- selfhttps://access.redhat.com/errata/RHSA-2022:1627
- externalhttps://access.redhat.com/security/updates/classification/#low
- externalhttps://access.redhat.com/security/vulnerabilities/RHSB-2022-003
- externalhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.amq.broker&version=7.9.4
- externalhttps://access.redhat.com/documentation/en-us/red_hat_amq/
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2070348
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1627.json