Chapter 5. Fixed issues

The following sections list the issues fixed in AMQ Streams 2.0.x. Red Hat recommends that you upgrade to the latest patch release.

For details of the issues fixed in Kafka 3.0.0, refer to the Kafka 3.0.0 Release Notes.

5.1. Fixed issues for AMQ Streams 2.0.1
링크 복사

The AMQ Streams 2.0.1 patch release is now available.

For additional details about the issues resolved in AMQ Streams 2.0.1, see AMQ Streams 2.0.x Resolved Issues.

Log4j vulnerabilities

AMQ Streams includes log4j 1.2.17. The release fixes a number of log4j vulnerabilities.

For more information on the vulnerabilities addressed in this release, see the following CVE articles:

Log4j2 vulnerabilities

AMQ Streams includes log4j2 2.17.1. The release fixes a number of log4j2 vulnerabilities.

For more information on the vulnerabilities addressed in this release, see the following CVE descriptions:

Expand

Table 5.1. Fixed issues
Issue Number	Description
ENTMQST-3250	Changing log level does not seem to work in Kafka Exporter

Expand

Table 5.2. Fixed common vulnerabilities and exposures (CVEs)
Issue Number	Description
ENTMQST-3146	CVE-2021-34429 jetty-server: jetty: crafted URIs allow bypassing security constraints
ENTMQST-3307	CVE-2021-38153 Kafka: Timing attack vulnerability for Apache Kafka Connect and Clients
ENTMQST-3308	CVE-2021-38153 kafka-clients: Kafka: Timing attack vulnerability for Apache Kafka Connect and Clients
ENTMQST-3316	CVE-2021-37136 netty-codec: Bzip2Decoder doesn’t allow setting size restrictions for decompressed data
ENTMQST-3317	CVE-2021-37137 netty-codec: SnappyFrameDecoder doesn’t restrict chunk length and may buffer skippable chunks in an unnecessary way
ENTMQST-3532	CVE-2021-44228 log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string valuer
ENTMQST-3555	CVE-2021-45046 log4j-core: DoS in log4j2.x with thread context message pattern and context lookup pattern
ENTMQST-3587	CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern
ENTMQST-3602	CVE-2021-44832 log4j-core: remote code execution through JDBC Appender