Chapter 5. Fixed issues

The following sections list the issues fixed in AMQ Streams 2.0.x. Red Hat recommends that you upgrade to the latest patch release.

For details of the issues fixed in Kafka 3.0.0, refer to the Kafka 3.0.0 Release Notes.

5.1. Fixed issues for AMQ Streams 2.0.1
复制链接

The AMQ Streams 2.0.1 patch release is now available.

The AMQ Streams product images have been upgraded to version 2.0.1.

For additional details about the issues resolved in AMQ Streams 2.0.1, see AMQ Streams 2.0.x Resolved Issues.

Log4j vulnerabilities

AMQ Streams includes log4j 1.2.17. The release fixes a number of log4j vulnerabilities.

For more information on the vulnerabilities addressed in this release, see the following CVE articles:

Log4j2 vulnerabilities

AMQ Streams includes log4j2 2.17.1. The release fixes a number of log4j2 vulnerabilities.

For more information on the vulnerabilities addressed in this release, see the following CVE articles:

Expand

Table 5.1. Fixed issues
Issue Number	Description
ENTMQST-3022	Metrics not working properly for explicit specified watching namespaces
ENTMQST-3053	`strimzi_resource_state` not updated to 0 when operator doesn’t see a Kafka resource anymore due to changed selector label
ENTMQST-3207	Add advertised hostnames to certificate SANs even for internal listeners
ENTMQST-3250	Changing log level does not seem to work in Kafka Exporter
ENTMQST-3274	Fix regex validation in CRDs
ENTMQST-3296	Load all certificates in Kafka Exporter
ENTMQST-3297	Use all public keys from Cluster CA in `ZookeeperScaler` and in `DefaultAdminClientProvider`
ENTMQST-3318	Fix reconciliation of TLS users with quotas
ENTMQST-3601	Certificates of internal components are not renewed after executing force-renew

Expand

Table 5.2. Fixed common vulnerabilities and exposures (CVEs)
Issue Number	Description
ENTMQST-3146	CVE-2021-34429 jetty-server: jetty: crafted URIs allow bypassing security constraints
ENTMQST-3307	CVE-2021-38153 Kafka: Timing attack vulnerability for Apache Kafka Connect and Clients
ENTMQST-3308	CVE-2021-38153 kafka-clients: Kafka: Timing attack vulnerability for Apache Kafka Connect and Clients
ENTMQST-3316	CVE-2021-37136 netty-codec: Bzip2Decoder doesn’t allow setting size restrictions for decompressed data
ENTMQST-3317	CVE-2021-37137 netty-codec: SnappyFrameDecoder doesn’t restrict chunk length and may buffer skippable chunks in an unnecessary way
ENTMQST-3428	CVE-2021-37136 netty-codec: Bzip2Decoder doesn’t allow setting size restrictions for decompressed data - Drain Cleaner
ENTMQST-3532	CVE-2021-44228 log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string valuer
ENTMQST-3555	CVE-2021-45046 log4j-core: DoS in log4j2.x with thread context message pattern and context lookup pattern
ENTMQST-3587	CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern
ENTMQST-3602	CVE-2021-44832 log4j-core: remote code execution through JDBC Appender