RHSA-2020:5365: Moderate: Red Hat AMQ Broker 7.8 release and security update
AMQ Broker is a high-performance messaging implementation based on ActiveMQ Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms. This release of Red Hat AMQ Broker 7.8.0 serves as a replacement for Red Hat AMQ Broker 7.7.0, and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section.Security Fix(es): hawtio: server side request forgery via initial /proxy/ substring of a URI (CVE-2019-9827) mqtt-client: activemq: remote XSS in web console diagram plugin (CVE-2020-13932) jetty: local temporary directory hijacking vulnerability (CVE-2020-27216) Hawtio: HTTPOnly and Secure attributes not set on cookies (CVE-2015-5183) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2020:5365?
The severity of RHSA-2020:5365 is classified as important.
How do I fix RHSA-2020:5365?
To fix RHSA-2020:5365, you need to update to the latest version of Red Hat AMQ Broker.
What systems are affected by RHSA-2020:5365?
RHSA-2020:5365 affects users of Red Hat AMQ Broker versions prior to the latest 7.8.0 release.
What vulnerabilities does RHSA-2020:5365 address?
RHSA-2020:5365 addresses several security vulnerabilities related to message persistence and asynchronous journal handling.
Is RHSA-2020:5365 applicable to all ActiveMQ Artemis users?
No, RHSA-2020:5365 specifically applies to users of Red Hat AMQ Broker, which is based on ActiveMQ Artemis.