title: Red Hat Security Advisory: Red Hat AMQ Broker 7.9.0 release and security update
description: apache-httpclient: incorrect handling of malformed authority component in request URIs jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS Broker: discloses JDBC username and password in the application log file 7: Incorrect privilege in Management Console resteasy: Error message exposes endpoint class information netty: Information disclosure via the local system temporary directory netty: possible request smuggling in HTTP/2 due missing validation netty: Request smuggling via content-length header jetty: Symlink directory exposes webapp directory contents jetty: Ambiguous paths can access WEB-INF jetty: Resource exhaustion when receiving an invalid large TLS frame jetty: requests to the ConcatServlet and WelcomeFilter are able to access protected resources within the WEB-INF directory apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6 jetty: SessionListener can prevent a session from being invalidated breaking logout jetty: crafted URIs allow bypassing security constraints
cpes: cpe:/a:redhat:amq_broker:7