Description
A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular permissions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | okhttp | — | 4.9.2 |
| Red Hat | Red Hat AMQ Streams 2.2.1 | — | — |
| Red Hat | Red Hat AMQ Streams 2.4.0 | — | — |
Advisories 4
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2024-3090 IBM App Connect Enterprise: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Oct 6, 2024
- WID-SEC-2024-0870 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 22, 2024
- WID-SEC-2023-0647 Red Hat JBoss A-MQ: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · May 18, 2023
References
- RHSA-2023:1241 vendor-advisory
- RHSA-2023:3223 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-0833 vdb-entry
- RHBZ#2169845 issue-tracking
- https://github.com/square/okhttp/issues/6738