RHSA-2023:7678HighCVSS 9.8

Red Hat Security Advisory: Red Hat AMQ Streams 2.6.0 release and security update

Published
December 6, 2023
Last Modified
August 19, 2026

🔗 CVE IDs covered (11)

CVE-2023-31582 →CVE-2023-33201 →CVE-2023-44981 →CVE-2023-2976 →CVE-2023-5072 →CVE-2023-40167 →CVE-2023-41080 →CVE-2023-42445 →CVE-2023-44387 →CVE-2022-46751 →CVE-2023-20873 →

📋 Description

CVE-2022-46751 — apache-ivy: XML External Entity vulnerability CVE-2023-2976 — guava: insecure temporary directory creation CVE-2023-5072 — JSON-java: parser confusion leads to OOM CVE-2023-20873 — spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry CVE-2023-31582 — jose4j: Insecure iteration count setting CVE-2023-33201 — bouncycastle: potential blind LDAP injection attack using a self-signed certificate CVE-2023-40167 — jetty: Improper validation of HTTP/1 content-length CVE-2023-41080 — tomcat: Open Redirect vulnerability in FORM authentication CVE-2023-42445 — gradle: Possible local text file exfiltration by XML External entity injection CVE-2023-44387 — gradle: Incorrect permission assignment for symlinked files used in copy or archiving operations CVE-2023-44981 — zookeeper: Authorization Bypass in Apache ZooKeeper

🎯 Affected products1

  • Red Hat AMQ Streams 2.6.0

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). Workaround: Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder. Workaround: No current mitigation is available for this flaw. Workaround: Disable Cloud Foundry actuator endpoints by setting 'management.cloudfoundry.enabled' to false. Workaround: No mitigation is currently available for this flaw. Workaround: User should follow the documentation to explicitly set permissions when copying or create archives: https://docs.gradle.org/current/userguide/working_with_files.html#sec:setting_file_permissions Workaround: According to Apache's document: Ensure the ensemble election/quorum communication is protected by a firewall as this will mitigate the issue.

🔗 References (15)