RHSA-2022:8876MediumCVSS 9.8

Red Hat Security Advisory: Red Hat AMQ Broker 7.10.2 release and security update

Published
December 7, 2022
Last Modified
August 4, 2026

🔗 CVE IDs covered (7)

CVE-2022-42003 →CVE-2022-42004 →CVE-2022-42889 →CVE-2022-25857 →CVE-2022-38749 →CVE-2022-38750 →CVE-2022-38751 →

📋 Description

CVE-2022-25857 — snakeyaml: Denial of Service due to missing nested depth limitation for collections CVE-2022-38749 — snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode CVE-2022-38750 — snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject CVE-2022-38751 — snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match CVE-2022-42003 — jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS CVE-2022-42004 — jackson-databind: use of deeply nested arrays CVE-2022-42889 — apache-commons-text: variable interpolation RCE

🎯 Affected products1

  • Red Hat AMQ Broker 7

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings. The References section of this erratum contains a download link (you must log in to download the update). Workaround: This flaw may be avoided by ensuring that any external inputs used with the Commons-Text lookup methods are sanitized properly. Untrusted input should always be thoroughly sanitized before using in any potentially risky situations.

🔗 References (12)