RHSA-2023:0189: Moderate: Red Hat AMQ Streams 2.3.0 release and security update
Red Hat AMQ Streams, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency. This release of Red Hat AMQ Streams 2.3.0 serves as a replacement for Red Hat AMQ Streams 2.2.0, and includes security and bug fixes, and enhancements.Security Fix(es): http2-server: Invalid HTTP/2 requests cause DoS (CVE-2022-2048) jetty-server: Improper release of ByteBuffers in SslConnections (CVE-2022-2191) jackson-databind: deep wrapper array nesting wrt UNWRAPSINGLEVALUEARRAYS (CVE-2022-42003) jackson-databind: use of deeply nested arrays (CVE-2022-42004) jetty-http: improver hostname input handling (CVE-2022-2047) snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode (CVE-2022-38752) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Red Hat AMQ Streamsto a version that resolves this vulnerability.Fixed in 2.3.0 - Operational
Before applying the update, back up the existing installation, including all applications, configuration files, databases, and database settings.
Event History
Frequently Asked Questions
What is the severity of RHSA-2023:0189?
The severity of RHSA-2023:0189 is classified as critical due to potential vulnerabilities that could affect system security.
How do I fix RHSA-2023:0189?
To fix RHSA-2023:0189, you should update your Red Hat AMQ Streams installation to the latest version provided by the advisory.
What vulnerabilities are addressed in RHSA-2023:0189?
RHSA-2023:0189 addresses multiple vulnerabilities that could allow unauthorized access or data exposure.
Is RHSA-2023:0189 applicable to all Red Hat AMQ Streams versions?
RHSA-2023:0189 specifically applies to Red Hat AMQ Streams 2.3.0 and surrounding versions that may be affected by these vulnerabilities.
How can I verify if my system is affected by RHSA-2023:0189?
You can verify if your system is affected by checking the version of Red Hat AMQ Streams you are currently running against the details in RHSA-2023:0189.