Chapter 5. Fixed issues The following sections list the issues fixed in AMQ Streams 1.6.x. Red Hat recommends that you upgrade to the latest patch release if you are using AMQ Streams 1.6.x with OpenShift Container Platform 3.11 For details of the issues fixed in: Kafka 2.6.3, refer to the Kafka 2.6.3 Release Notes Kafka 2.6.2, refer to the Kafka 2.6.2 Release Notes Kafka 2.6.1, refer to the Kafka 2.6.1 Release Notes Kafka 2.6.0, refer to the Kafka 2.6.0 Release Notes 5.1. Fixed issues for AMQ Streams 1.6.7 The AMQ Streams 1.6.7 patch release (Long Term Support) is now available. AMQ Streams 1.6.7 is the latest Long Term Support release for use with OpenShift Container Platform 3.11 only, and is supported only for as long as OpenShift Container Platform 3.11 is supported. Note that AMQ Streams 1.6.7 is supported on OCP 3.11 only. The AMQ Streams product images have been upgraded to version 1.6.7. For additional details about the issues resolved in AMQ Streams 1.6.7, see AMQ Streams 1.6.x Resolved Issues . Log4j vulnerabilities AMQ Streams includes log4j 1.2.17. The release fixes a number of log4j vulnerabilities. For more information on the vulnerabilities addressed in this release, see the following CVE articles: CVE-2022-23307 CVE-2022-23305 CVE-2022-23302 CVE-2021-4104 CVE-2020-9488 CVE-2019-17571 CVE-2017-5645 5.2. Fixed issues for AMQ Streams 1.6.6 For additional details about the issues resolved in AMQ Streams 1.6.6, see AMQ Streams 1.6.x Resolved Issues . Log4j2 vulnerabilities AMQ Streams includes log4j2 2.17.1. The release fixes a number of log4j2 vulnerabilities. For more information on the vulnerabilities addressed in this release, see the following CVE articles: CVE-2021-45046 CVE-2021-45105 CVE-2021-44832 CVE-2021-44228 5.3. Fixed issues for AMQ Streams 1.6.5 For additional details about the issues resolved in AMQ Streams 1.6.5, see AMQ Streams 1.6.x Resolved Issues . Log4j2 vulnerability The 1.6.5 release fixes a remote code execution vulnerability for AMQ Streams components that use log4j2. The vulnerability could allow a remote code execution on the server if the system logs a string value from an unauthorized source. This affects log4j versions between 2.0 and 2.14.1. For more information, see CVE-2021-44228 . 5.4. Fixed issues for AMQ Streams 1.6.4 For additional details about the issues resolved in AMQ Streams 1.6.4, see AMQ Streams 1.6.x Resolved Issues . 5.5. Fixed issues for AMQ Streams 1.6.2 The AMQ Streams 1.6.2 patch release is now available. The release includes a number fixes related to Kafka Connect. The AMQ Streams product images have not changed and remain at version 1.6. For additional details about the issues resolved in AMQ Streams 1.6.2, see AMQ Streams 1.6.2 Resolved Issues . Note Following a CVE update, the version of AMQ Streams managed by the Operator Lifecycle Manager (OLM) was changed to 1.6.1. To avoid confusion, the patch release for AMQ Streams 1.6 was given a version number of 1.6.2. 5.6. Fixed issues for AMQ Streams 1.6.0 Issue Number Description ENTMQST-2049 Kafka Bridge: Kafka consumer should be tracked with group-consumerid key ENTMQST-2289 Allow downgrade with message version older than the downgrade version ENTMQST-2292 Diff PodDisruptionBudgets before patching them to not recreate them on every reconciliation ENTMQST-2146 MirrorMaker 2 on OCP doesn't properly mirror messages with headers ENTMQST-2147 MirrorMaker 2 doesn't properly configure Jaeger tracing in the connectors ENTMQST-2099 When set to blank value for toleration Kafka cluster keeps rolling updates repeatedly ENTMQST-2084 Zookeeper version on the docs doesn't match with the version in AMQ Streams 1.5 ENTMQST-2340 Connection Leak in Operator when Using KafkaConnect API ENTMQST-2338 Fix Secrets or ConfigMaps with dots mounted into Connect ENTMQST-2294 OLM install - yaml contains typo for 'authentication' Table 5.1. Fixed common vulnerabilities and exposures (CVEs) Issue Number Description ENTMQST-2332 CVE-2020-13956 httpclient: apache-httpclient: incorrect handling of malformed authority component in request URIs [amq-st-1]

Commands: