A flaw was found in the AMQ Online console, where it is vulnerable to a Cross-Site Request Forgery attack (CSRF), which is exploitable in cases where preflight checks are not instigated or bypassed. This flaw allows an attacker to target authorized users using an older browser with Adobe Flash. The highest threat from this vulnerability is to integrity and system availability.

Injecting an invalid field to a user’s AddressSpace configuration of the user namespace puts AMQ in an inconsistent state, where the AMQ components of all of the other users do not operate properly, such as the failure of provisioning and the failure of creating addresses.

A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.

The release of Red Hat AMQ Online 1.7.0 serves as a replacement for earlier AMQ Online releases, and includes bug fixes and enhancements, which are documented in the Release Notes document linked in the References.Security Fix(es): fabric8-kubernetes-client: vulnerable to a path traversal leading to integrity and availability compromise (CVE-2021-20218) netty: Information disclosure via the local system temporary directory (CVE-2021-21290) netty: possible request smuggling in HTTP/2 due missing validation (CVE-2021-21295) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The release of Red Hat AMQ Online 1.4.1 serves as a replacement for AMQ online 1.4.0, and includes bug fixes and enhancements, which are documented in the Release Notes document linked in the References.Security Fix(es): netty: compression/decompression codecs don't enforce limits on buffer allocation sizes (CVE-2020-11612) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.