AMQ Streams 1.6.x Resolved Issues

Updated -

The AMQ Streams 1.6.7 release is now available for download from the Customer Portal and Red Hat Container Catalog. AMQ Streams 1.6.7 is a patch release for AMQ Streams 1.6.0. Note, AMQ Streams patches are cumulative and include fixes from previous patch releases as noted below.



The following issues have been resolved in the AMQ Streams 1.6.7 release:

ID Component Summary
ENTMQST-3626 CVE-2021-44832 log4j-core: remote code execution via JDBC Appender [amq-st-1] (AMQ Streams 1.6)
ENTMQST-3627 CVE-2021-4178 kubernetes-client: Insecure deserialization in unmarshalYaml method [amq-st-1]
ENTMQST-3680 CVE-2022-23307 log4j: A deserialization flaw could lead to malicious code execution [amq-st-1] => 1.6.7
ENTMQST-3683 CVE-2022-23305 log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender [amq-st-1] - AMq Streams 1.6.x
ENTMQST-3684 CVE-2022-23302 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink [amq-st-1] - AMQ Streams 1.6.x



The following issues have been resolved in the AMQ Streams 1.6.6 release:

ID Component Summary
ENTMQST-3312 CVE-2021-38153 kafka-clients: Kafka: Timing Attack Vulnerability for Apache Kafka Connect and Clients [amq-st-1]
ENTMQST-3313 CVE-2021-38153 kafka: Timing Attack Vulnerability for Apache Kafka Connect and Clients [amq-st-1]
ENTMQST-3588 CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern [amq-st-1]



The following issues have been resolved in the AMQ Streams 1.6.5 release:

ID Component Summary
ENTMQST-3530 CVE-2021-44228 log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value. [amq-st-1]



The following issues have been resolved in the AMQ Streams 1.6.4* release:

ID Component Summary
ENTMQST-2642 [LTS] Deadlock in Kafka Connect
ENTMQST-2785 CVE-2021-28163 jetty-server: jetty: Symlink directory exposes webapp directory contents [amq-st-1]
ENTMQST-2787 CVE-2021-28164 jetty-server: jetty: Ambiguous paths can access WEB-INF [amq-st-1]
ENTMQST-2786 CVE-2021-28165 jetty-server: jetty: Resource exhaustion when receiving an invalid large TLS frame [amq-st-1]

AMQ Streams 1.6.4 is based on Apache Kafka 2.6.2, in addition to the above fixes please see the upstream release notes for a full list of issues resolved in this release.



The following issues have been resolved in the AMQ Streams 1.6.3* release:

ID Component Summary
ENTMQST-2629 Respin AMQ Streams images in response to RHSA :69500



The following issues have been resolved in the AMQ Streams 1.6.2* release:

ID Component Summary
ENTMQST-2414 Comparing String with Map in KafkaConnectApiImpl in Connect logging configuration
ENTMQST-2440 Missing CRB RBAC will break Kafka Connect even when not needed
ENTMQST-2450 Connect default logging not expanded
ENTMQST-2509 Avoid changing custom resource status because of HashSet ordering
ENTMQST-2510 Remove owner referneces from ClusterRoleBindings
ENTMQST-2511 Fine-tune the Kafka Exporter health checks
ENTMQST-2512 Topic operator bug-fixes



The following issues have been resolved in the AMQ Streams 1.6.1* release:

ID Component Summary
ENTMQST-2479 Update to AMQ Streams images to fix openssl CVE-2020-1971



* Denotes the release is only applicable to deployments on OpenShift.

Comments