RHSA-2020:0497: Important: AMQ Online security update
The release of Red Hat AMQ Online 1.3.3 serves as a replacement for AMQ online 1.3.2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked in the References. Security Fix(es): netty: HTTP request smuggling (CVE-2019-20444) netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header (CVE-2019-20445) netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Red Hat AMQ Onlineto a version that resolves this vulnerability.Fixed in 1.3.3
Event History
Frequently Asked Questions
What is the severity of RHSA-2020:0497?
The severity of RHSA-2020:0497 is classified as moderate.
What vulnerabilities does RHSA-2020:0497 address?
RHSA-2020:0497 addresses the HTTP request smuggling vulnerability identified by CVE-2019-20444.
How do I fix RHSA-2020:0497?
To fix RHSA-2020:0497, upgrade to Red Hat AMQ Online 1.3.3 or later.
What software is affected by RHSA-2020:0497?
RHSA-2020:0497 affects Red Hat AMQ Online version 1.3.2.
Is there a workaround for RHSA-2020:0497?
No specific workaround for RHSA-2020:0497 is recommended; upgrading is the best approach.