Chapter 7. Fixed Common Vulnerabilities and Exposures

This section details Common Vulnerabilities and Exposures (CVEs) fixed in the AMQ Broker 7.13 release.

ENTMQBR-9545 - CVE-2024-38819 org.springframework/spring-webmvc: Path traversal vulnerability in functional web frameworks [amq-7]
ENTMQBR-9496 - CVE-2024-8184 org.eclipse.jetty/jetty-server: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks [amq-7]
ENTMQBR-9445 - CVE-2024-38809 org.springframework/spring-web: Spring Framework DoS via conditional HTTP request [amq-7]
ENTMQBR-9581 - CVE-2024-6763 org.eclipse.jetty/jetty-http: Jetty URI parsing of invalid authority [amq-7]
ENTMQBR-9539 - CVE-2024-38828 org.springframework/spring-webmvc: DoS via Spring MVC controller method with byte[] parameter [amq-7]
ENTMQBR-8648 - CVE-2020-23064 hawtio-core: jquery: Cross-site scripting [amq-7]
ENTMQBR-8887 - CVE-2024-26308 commons-compress: OutOfMemoryError unpacking broken Pack200 file [amq-7]
ENTMQBR-8888 - CVE-2024-25710 commons-compress: Denial of service caused by an infinite loop for a corrupted DUMP file [amq-7]