RHSA-2023:7697MediumCVSS 9.8

Red Hat Security Advisory: AMQ Clients 2023.Q4

Published
December 7, 2023
Last Modified
August 4, 2026

🔗 CVE IDs covered (8)

CVE-2023-34462 →CVE-2023-40167 →CVE-2022-1471 →CVE-2022-25857 →CVE-2022-38749 →CVE-2022-41854 →CVE-2023-1370 →CVE-2023-34050 →

📋 Description

CVE-2022-1471 — SnakeYaml: Constructor Deserialization Remote Code Execution CVE-2022-25857 — snakeyaml: Denial of Service due to missing nested depth limitation for collections CVE-2022-38749 — snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode CVE-2022-41854 — dev-java/snakeyaml: DoS via stack overflow CVE-2023-1370 — json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) CVE-2023-34050 — springframework-amqp: Deserialization Vulnerability CVE-2023-34462 — netty: SniHandler 16MB allocation leads to OOM CVE-2023-40167 — jetty: Improper validation of HTTP/1 content-length

🎯 Affected products1

  • Red Hat AMQ Clients

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: An application may be vulnerable if: - The SimpleMessageConverter or SerializerMessageConverter is used - The user does not configure allowed list patterns - Untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content Make sure these are avoided in order to mitigate the issue. Workaround: Configuration of SniHandler with an idle timeout will mitigate this issue.

🔗 References (15)