Skip to content
OpenAdvisories
High WID-SEC-2023-3070 11 CVEs

Red Hat JBoss A-MQ: Mehrere Schwachstellen

Published Dec 6, 2023 · Updated Oct 16, 2025 · Revision 9 · de-DE

Vendor: Atlassian Vendor: IBM Vendor: Red Hat Product: Bamboo Product: Bitbucket Product: Confluence Product: Enterprise Linux Product: JBoss A-MQ Product: Jira Software Product: QRadar SIEM Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss A-MQ ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizuführen.

Product

JBoss A-MQ ist eine Messaging-Plattform.

Vulnerabilities 11

  • Critical 9.8
    CVE-2023-20873

    Spring Boot Security Bypass with Wildcard Pattern Matching on Cloud Foundry

    In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users sh…

    org.springframework.boot:spring-boot-actuator-autoconfigure Maven
  • Critical 9.1
    CVE-2023-44981

    Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication

    Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication …

    Apache Software Foundation Apache ZooKeeper trino zookeeper Debian Ubuntu Wolfi Maven
  • High 8.2
    CVE-2022-46751

    Apache Ivy: XML External Entity vulnerability in Apache Ivy

    Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML file…

    Apache Software Foundation Apache Ivy gradle-8 gradle-stage0 Wolfi Maven
  • High 7.5
    CVE-2023-31582

    jose4j uses weak cryptographic algorithm

    jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.

    org.bitbucket.b_c:jose4j libjose4j-java libjose4j-java Debian Ubuntu Maven
  • High 7.5
    CVE-2023-5072

    DoS Vulnerability in JSON-Java

    Denial of Service in JSON-Java versions up to and including 20230618.  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

    https://github.com/stleary/JSON-java openjdk17 openjdk21 libjettison-java Debian Ubuntu Alpine Maven
  • Medium 6.8
    CVE-2023-42445

    Possible local file exfiltration by XML External entity injection

    Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack (OOB-XXE), just parsing X…

    gradle gradle gradle gradle Debian Ubuntu
  • Medium 6.1
    CVE-2023-41080 Public exploit

    Apache Tomcat: Open redirect with FORM authentication

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 thr…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven
  • Medium 5.5
    CVE-2023-2976

    Use of temporary directory for file creation in `FileBackedOutputStream` in Guava

    Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary di…

    Google Guava celeborn-0.6 trino-plugin-clickhouse Debian Ubuntu Azure Linux Wolfi Maven
  • Medium 5.3
    CVE-2023-33201

    Bouncy Castle For Java LDAP injection vulnerability

    Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Cast…

    druid tez bouncycastle bouncycastle Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2023-40167 Public exploit

    Jetty accepts "+" prefixed value in Content-Length

    Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and othe…

    Eclipse Foundation jetty.project druid cassandra-reaper Debian Ubuntu Wolfi Maven
  • Low 3.2
    CVE-2023-44387

    Gradle has incorrect permission assignment for symlinked files used in copy or archiving operations

    Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves them but applies the permissions of the symlink itself instead of the permissions of the linked file…

    gradle gradle gradle gradle Debian Ubuntu

Revision history

  1. #9

    Neue Updates von IBM aufgenommen

  2. #8

    Neue Updates von Red Hat aufgenommen

  3. #7

    Neue Updates von Red Hat aufgenommen

  4. #6

    Neue Updates von Red Hat aufgenommen

  5. #5

    Neue Updates von Red Hat aufgenommen

  6. #4

    Neue Updates von Red Hat aufgenommen

  7. #3

    Neue Updates aufgenommen

  8. #2

    Neue Updates von Red Hat aufgenommen

  9. #1

    Initiale Fassung

References