RHSA-2024:2944HighCVSS 9.8

Red Hat Security Advisory: AMQ Broker 7.12.0.OPR.1.GA Container Images release and security update

Published
May 21, 2024
Last Modified
September 8, 2026

🔗 CVE IDs covered (18)

CVE-2023-29400 →CVE-2021-43565 →CVE-2022-27664 →CVE-2022-41678 →CVE-2022-41715 →CVE-2022-41724 →CVE-2023-24536 →CVE-2023-24537 →CVE-2023-24538 →CVE-2023-24540 →CVE-2022-2880 →CVE-2022-21698 →CVE-2022-32189 →CVE-2023-24534 →CVE-2022-2879 →CVE-2022-41723 →CVE-2022-41725 →CVE-2023-24539 →

📋 Description

CVE-2021-43565 — golang.org/x/crypto: empty plaintext packet causes panic CVE-2022-2879 — golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers CVE-2022-2880 — golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters CVE-2022-21698 — prometheus/client_golang: Denial of service using InstrumentHandlerCounter CVE-2022-27664 — golang: net/http: handle server errors after sending GOAWAY CVE-2022-32189 — golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service CVE-2022-41678 — ActiveMQ: Deserialization vulnerability on Jolokia that allows authenticated users to perform RCE CVE-2022-41715 — golang: regexp/syntax: limit memory used by parsing regexps CVE-2022-41723 — golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding CVE-2022-41724 — golang: crypto/tls: large handshake records may cause panics CVE-2022-41725 — golang: net/http, mime/multipart: denial of service from excessive resource consumption CVE-2023-24534 — golang: net/http, net/textproto: denial of service from excessive memory allocation CVE-2023-24536 — golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption CVE-2023-24537 — golang: go/parser: Infinite loop in parsing CVE-2023-24538 — golang: html/template: backticks not treated as string delimiters CVE-2023-24539 — golang: html/template: improper sanitization of CSS values CVE-2023-24540 — golang: html/template: improper handling of JavaScript whitespace CVE-2023-29400 — golang: html/template: improper handling of empty HTML attributes

🎯 Affected products14

  • Middleware Containers for OpenShift
  • amq7/amq-broker-init-rhel8@sha256:3bd3ed2acad8c5792c7222254c8ef09c2eeb4dcfd3e96622fe98f50ce094ca3e_ppc64le as a component of Middleware Containers for OpenShift
  • amq7/amq-broker-init-rhel8@sha256:4755cc6d13566065f6fd0b9544001ece5e0424ddbff774420f5be9bbfe03ae9e_amd64 as a component of Middleware Containers for OpenShift
  • amq7/amq-broker-init-rhel8@sha256:de1724d437174eefb20ed7dd8981a05607c55cfe8d6ea6667df94fdfdefe6ead_arm64 as a component of Middleware Containers for OpenShift
  • amq7/amq-broker-init-rhel8@sha256:e3c7913dc5a441fc38f35081cd405425ec3f4d299d77890db9d57b042f459852_s390x as a component of Middleware Containers for OpenShift
  • amq7/amq-broker-rhel8-operator-bundle@sha256:22ba090595eb88cc56d69c759388310d477e50fd97a4c6fcf3e7eecd94df99f9_amd64 as a component of Middleware Containers for OpenShift
  • amq7/amq-broker-rhel8-operator@sha256:27deae2dfec99135f1dd3dcfffdaf6167e056e29aa481cb3f78ee36d407181b8_arm64 as a component of Middleware Containers for OpenShift
  • amq7/amq-broker-rhel8-operator@sha256:7231e51c0f078cd742b12c52c6616f19e669909ebb2fb6e02292173a5def5fab_s390x as a component of Middleware Containers for OpenShift
  • amq7/amq-broker-rhel8-operator@sha256:996d20078a6a4f98f220793bded0b1c7ad08df3a292f26be71e52070fc538367_amd64 as a component of Middleware Containers for OpenShift
  • amq7/amq-broker-rhel8-operator@sha256:a840f54acec50b424b1c4a8d984230777bf042fb98b526d213cbb5b3df023435_ppc64le as a component of Middleware Containers for OpenShift
  • amq7/amq-broker-rhel8@sha256:081c73ec804f236ff0d00d7495a6d1053d1b6161ae7d944c889fc2d1181caa3f_amd64 as a component of Middleware Containers for OpenShift
  • amq7/amq-broker-rhel8@sha256:25100bd1bb6b113af4e51deb6538ed554340091389ab2639ec77824c6cb0bc15_s390x as a component of Middleware Containers for OpenShift
  • amq7/amq-broker-rhel8@sha256:b2aa89fb6eb23d41b1101ef2080a628a51d2a0949395e921247be302ff0e9778_ppc64le as a component of Middleware Containers for OpenShift
  • amq7/amq-broker-rhel8@sha256:cd306c06c811d5e5c3d1912dd2bf2d08c10e057f1d7c59cba8475e105dd72cf0_arm64 as a component of Middleware Containers for OpenShift

✅ Remediation

To update to the latest image please refer to the AMQ container images in the Red Hat Container catalog. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (36)