Red Hat AMQ Broker 7.12.1 is now available from the Red Hat Customer Portal.

Red Hat Product Security has rated this update as having a security impact of
 Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

AMQ Broker is a high-performance messaging implementation based on ActiveMQ
 Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms.

This release of Red Hat AMQ Broker 7.12.1 includes security and bug fixes, and
 enhancements. For further information, refer to the release notes linked to in the References section.

Security Fix(es):

* (CVE-2023-5072) JSON-java: parser confusion leads to OOM
* (CVE-2024-30172) Infinite loop in ED25519 verification in the ScalarUtil
 class
* (CVE-2024-29857) org.bouncycastle: Importing an EC certificate with crafted
 F2m parameters may lead to Denial of Service
* (CVE-2024-30171) bc-java: BouncyCastle vulnerable to a timing variant of
 Bleichenbacher (Marvin Attack)
* (CVE-2024-34447) org.bouncycastle: Use of Incorrectly-Resolved Name or
 Reference

For more details about the security issue(s), including the impact, a CVSS
 score, and other related information, refer to the CVE page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2023-5072: Allocation of Resources Without Limits or Throttling (CWE-770)
CVE-2024-29857: Improper Input Validation (CWE-20)
CVE-2024-30171: Observable Timing Discrepancy (CWE-208)
CVE-2024-30172: Loop with Unreachable Exit Condition ('Infinite Loop')
 (CWE-835)
CVE-2024-34447: Use of Incorrectly-Resolved Name or Reference (CWE-706)