ESB-2018.0673 - [RedHat] Red Hat JBoss Web Server: Multiple vulnerabilities - 2018-03-08


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.0673
 Important: Red Hat JBoss Web Server 3.1.0 Service Pack 2 security update
                               8 March 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Red Hat JBoss Web Server
Publisher:         Red Hat
Operating System:  Red Hat Enterprise Linux Server 6
                   Red Hat Enterprise Linux WS/Desktop 6
                   Red Hat Enterprise Linux Server 7
                   Red Hat Enterprise Linux WS/Desktop 7
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated
                   Denial of Service               -- Existing Account      
                   Access Confidential Data        -- Remote/Unauthenticated
                   Reduced Security                -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-1305 CVE-2018-1304 CVE-2017-15698
                   CVE-2017-12617 CVE-2017-12616 CVE-2017-12615
                   CVE-2017-12613  

Reference:         ESB-2018.0652
                   ESB-2018.0542

Original Bulletin: 
   https://access.redhat.com/errata/RHSA-2018:0465
   https://access.redhat.com/errata/RHSA-2018:0466

Comment: This bulletin contains two (2) Red Hat security advisories.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat JBoss Web Server 3.1.0 Service Pack 2 security update
Advisory ID:       RHSA-2018:0465-01
Product:           Red Hat JBoss Web Server
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:0465
Issue date:        2018-03-07
CVE Names:         CVE-2017-12613 CVE-2017-12615 CVE-2017-12616 
                   CVE-2017-12617 CVE-2017-15698 CVE-2018-1304 
                   CVE-2018-1305 
=====================================================================

1. Summary:

An update is now available for Red Hat JBoss Web Server 3.1.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Red Hat JBoss Web Server is a fully integrated and certified set of
components for hosting Java web applications. It is comprised of the Apache
HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector
(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat
Native library.

This release of Red Hat JBoss Web Server 3.1 Service Pack 2 serves as a
replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which
are documented in the Release Notes document linked to in the References.

Security Fix(es):

* apr: Out-of-bounds array deref in apr_time_exp*() functions
(CVE-2017-12613)

* tomcat: Remote Code Execution via JSP Upload (CVE-2017-12615)

* tomcat: Information Disclosure when using VirtualDirContext
(CVE-2017-12616)

* tomcat: Remote Code Execution bypass for CVE-2017-12615 (CVE-2017-12617)

* tomcat-native: Mishandling of client certificates can allow for OCSP
check bypass (CVE-2017-15698)

* tomcat: Incorrect handling of empty string URL in security constraints
can lead to unintended exposure of resources (CVE-2018-1304)

* tomcat: Late application of security constraints can lead to resource
exposure for unauthorised users (CVE-2018-1305)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

Before applying the update, back up your existing Red Hat JBoss Web Server
installation (including all applications and configuration files).

The References section of this erratum contains a download link (you must
log in to download the update).

4. Bugs fixed (https://bugzilla.redhat.com/):

1493220 - CVE-2017-12615 tomcat: Remote Code Execution via JSP Upload
1493222 - CVE-2017-12616 tomcat: Information Disclosure when using VirtualDirContext
1494283 - CVE-2017-12617 tomcat: Remote Code Execution bypass for CVE-2017-12615
1506523 - CVE-2017-12613 apr: Out-of-bounds array deref in apr_time_exp*() functions
1540824 - CVE-2017-15698 tomcat-native: Mishandling of client certificates can allow for OCSP check bypass
1548282 - CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users
1548289 - CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources

5. References:

https://access.redhat.com/security/cve/CVE-2017-12613
https://access.redhat.com/security/cve/CVE-2017-12615
https://access.redhat.com/security/cve/CVE-2017-12616
https://access.redhat.com/security/cve/CVE-2017-12617
https://access.redhat.com/security/cve/CVE-2017-15698
https://access.redhat.com/security/cve/CVE-2018-1304
https://access.redhat.com/security/cve/CVE-2018-1305
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver&downloadType=securityPatches&version=3.1
https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/
https://access.redhat.com/security/vulnerabilities/httpoxy
https://access.redhat.com/solutions/2435491

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFaoADQXlSAg2UNWIIRArVFAJ9tO9mdpKlTu6YVn7e8hdQq/+cYwwCgozn3
lEB5PiC2kBh2pu3P5kHZloU=
=ju3W
- -----END PGP SIGNATURE-----

- ------------------------------------------------------------------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat JBoss Web Server 3.1.0 Service Pack 2 security update
Advisory ID:       RHSA-2018:0466-01
Product:           Red Hat JBoss Web Server
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:0466
Issue date:        2018-03-07
CVE Names:         CVE-2017-12613 CVE-2017-12615 CVE-2017-12616 
                   CVE-2017-12617 CVE-2017-15698 CVE-2018-1304 
                   CVE-2018-1305 
=====================================================================

1. Summary:

An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6 and
Red Hat JBoss Web Server 3.1 for RHEL 7.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat JBoss Web Server 3.1 for RHEL 6 - i386, noarch, x86_64
Red Hat JBoss Web Server 3.1 for RHEL 7 - noarch, x86_64

3. Description:

Red Hat JBoss Web Server is a fully integrated and certified set of
components for hosting Java web applications. It is comprised of the Apache
HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector
(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat
Native library.

This release of Red Hat JBoss Web Server 3.1 Service Pack 2 serves as a
replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which
are documented in the Release Notes document linked to in the References.

Security Fix(es):

* apr: Out-of-bounds array deref in apr_time_exp*() functions
(CVE-2017-12613)

* tomcat: Remote Code Execution via JSP Upload (CVE-2017-12615)

* tomcat: Information Disclosure when using VirtualDirContext
(CVE-2017-12616)

* tomcat: Remote Code Execution bypass for CVE-2017-12615 (CVE-2017-12617)

* tomcat-native: Mishandling of client certificates can allow for OCSP
check bypass (CVE-2017-15698)

* tomcat: Incorrect handling of empty string URL in security constraints
can lead to unintended exposure of resources (CVE-2018-1304)

* tomcat: Late application of security constraints can lead to resource
exposure for unauthorised users (CVE-2018-1305)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

Before applying the update, back up your existing Red Hat JBoss Web Server
installation (including all applications and configuration files).

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1493220 - CVE-2017-12615 tomcat: Remote Code Execution via JSP Upload
1493222 - CVE-2017-12616 tomcat: Information Disclosure when using VirtualDirContext
1494283 - CVE-2017-12617 tomcat: Remote Code Execution bypass for CVE-2017-12615
1506523 - CVE-2017-12613 apr: Out-of-bounds array deref in apr_time_exp*() functions
1540824 - CVE-2017-15698 tomcat-native: Mishandling of client certificates can allow for OCSP check bypass
1548282 - CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users
1548289 - CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources

6. Package List:

Red Hat JBoss Web Server 3.1 for RHEL 6:

Source:
mod_cluster-1.3.8-2.Final_redhat_2.1.ep7.el6.src.rpm
tomcat-native-1.2.8-11.redhat_11.ep7.el6.src.rpm
tomcat-vault-1.1.6-1.Final_redhat_1.1.ep7.el6.src.rpm
tomcat7-7.0.70-25.ep7.el6.src.rpm
tomcat8-8.0.36-29.ep7.el6.src.rpm

i386:
tomcat-native-1.2.8-11.redhat_11.ep7.el6.i686.rpm
tomcat-native-debuginfo-1.2.8-11.redhat_11.ep7.el6.i686.rpm

noarch:
mod_cluster-1.3.8-2.Final_redhat_2.1.ep7.el6.noarch.rpm
mod_cluster-tomcat7-1.3.8-2.Final_redhat_2.1.ep7.el6.noarch.rpm
mod_cluster-tomcat8-1.3.8-2.Final_redhat_2.1.ep7.el6.noarch.rpm
tomcat-vault-1.1.6-1.Final_redhat_1.1.ep7.el6.noarch.rpm
tomcat-vault-tomcat7-1.1.6-1.Final_redhat_1.1.ep7.el6.noarch.rpm
tomcat-vault-tomcat8-1.1.6-1.Final_redhat_1.1.ep7.el6.noarch.rpm
tomcat7-7.0.70-25.ep7.el6.noarch.rpm
tomcat7-admin-webapps-7.0.70-25.ep7.el6.noarch.rpm
tomcat7-docs-webapp-7.0.70-25.ep7.el6.noarch.rpm
tomcat7-el-2.2-api-7.0.70-25.ep7.el6.noarch.rpm
tomcat7-javadoc-7.0.70-25.ep7.el6.noarch.rpm
tomcat7-jsp-2.2-api-7.0.70-25.ep7.el6.noarch.rpm
tomcat7-jsvc-7.0.70-25.ep7.el6.noarch.rpm
tomcat7-lib-7.0.70-25.ep7.el6.noarch.rpm
tomcat7-log4j-7.0.70-25.ep7.el6.noarch.rpm
tomcat7-selinux-7.0.70-25.ep7.el6.noarch.rpm
tomcat7-servlet-3.0-api-7.0.70-25.ep7.el6.noarch.rpm
tomcat7-webapps-7.0.70-25.ep7.el6.noarch.rpm
tomcat8-8.0.36-29.ep7.el6.noarch.rpm
tomcat8-admin-webapps-8.0.36-29.ep7.el6.noarch.rpm
tomcat8-docs-webapp-8.0.36-29.ep7.el6.noarch.rpm
tomcat8-el-2.2-api-8.0.36-29.ep7.el6.noarch.rpm
tomcat8-javadoc-8.0.36-29.ep7.el6.noarch.rpm
tomcat8-jsp-2.3-api-8.0.36-29.ep7.el6.noarch.rpm
tomcat8-jsvc-8.0.36-29.ep7.el6.noarch.rpm
tomcat8-lib-8.0.36-29.ep7.el6.noarch.rpm
tomcat8-log4j-8.0.36-29.ep7.el6.noarch.rpm
tomcat8-selinux-8.0.36-29.ep7.el6.noarch.rpm
tomcat8-servlet-3.1-api-8.0.36-29.ep7.el6.noarch.rpm
tomcat8-webapps-8.0.36-29.ep7.el6.noarch.rpm

x86_64:
tomcat-native-1.2.8-11.redhat_11.ep7.el6.x86_64.rpm
tomcat-native-debuginfo-1.2.8-11.redhat_11.ep7.el6.x86_64.rpm

Red Hat JBoss Web Server 3.1 for RHEL 7:

Source:
mod_cluster-1.3.8-2.Final_redhat_2.1.ep7.el7.src.rpm
tomcat-native-1.2.8-11.redhat_11.ep7.el7.src.rpm
tomcat-vault-1.1.6-1.Final_redhat_1.1.ep7.el7.src.rpm
tomcat7-7.0.70-25.ep7.el7.src.rpm
tomcat8-8.0.36-29.ep7.el7.src.rpm

noarch:
mod_cluster-1.3.8-2.Final_redhat_2.1.ep7.el7.noarch.rpm
mod_cluster-tomcat7-1.3.8-2.Final_redhat_2.1.ep7.el7.noarch.rpm
mod_cluster-tomcat8-1.3.8-2.Final_redhat_2.1.ep7.el7.noarch.rpm
tomcat-vault-1.1.6-1.Final_redhat_1.1.ep7.el7.noarch.rpm
tomcat-vault-tomcat7-1.1.6-1.Final_redhat_1.1.ep7.el7.noarch.rpm
tomcat-vault-tomcat8-1.1.6-1.Final_redhat_1.1.ep7.el7.noarch.rpm
tomcat7-7.0.70-25.ep7.el7.noarch.rpm
tomcat7-admin-webapps-7.0.70-25.ep7.el7.noarch.rpm
tomcat7-docs-webapp-7.0.70-25.ep7.el7.noarch.rpm
tomcat7-el-2.2-api-7.0.70-25.ep7.el7.noarch.rpm
tomcat7-javadoc-7.0.70-25.ep7.el7.noarch.rpm
tomcat7-jsp-2.2-api-7.0.70-25.ep7.el7.noarch.rpm
tomcat7-jsvc-7.0.70-25.ep7.el7.noarch.rpm
tomcat7-lib-7.0.70-25.ep7.el7.noarch.rpm
tomcat7-log4j-7.0.70-25.ep7.el7.noarch.rpm
tomcat7-selinux-7.0.70-25.ep7.el7.noarch.rpm
tomcat7-servlet-3.0-api-7.0.70-25.ep7.el7.noarch.rpm
tomcat7-webapps-7.0.70-25.ep7.el7.noarch.rpm
tomcat8-8.0.36-29.ep7.el7.noarch.rpm
tomcat8-admin-webapps-8.0.36-29.ep7.el7.noarch.rpm
tomcat8-docs-webapp-8.0.36-29.ep7.el7.noarch.rpm
tomcat8-el-2.2-api-8.0.36-29.ep7.el7.noarch.rpm
tomcat8-javadoc-8.0.36-29.ep7.el7.noarch.rpm
tomcat8-jsp-2.3-api-8.0.36-29.ep7.el7.noarch.rpm
tomcat8-jsvc-8.0.36-29.ep7.el7.noarch.rpm
tomcat8-lib-8.0.36-29.ep7.el7.noarch.rpm
tomcat8-log4j-8.0.36-29.ep7.el7.noarch.rpm
tomcat8-selinux-8.0.36-29.ep7.el7.noarch.rpm
tomcat8-servlet-3.1-api-8.0.36-29.ep7.el7.noarch.rpm
tomcat8-webapps-8.0.36-29.ep7.el7.noarch.rpm

x86_64:
tomcat-native-1.2.8-11.redhat_11.ep7.el7.x86_64.rpm
tomcat-native-debuginfo-1.2.8-11.redhat_11.ep7.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2017-12613
https://access.redhat.com/security/cve/CVE-2017-12615
https://access.redhat.com/security/cve/CVE-2017-12616
https://access.redhat.com/security/cve/CVE-2017-12617
https://access.redhat.com/security/cve/CVE-2017-15698
https://access.redhat.com/security/cve/CVE-2018-1304
https://access.redhat.com/security/cve/CVE-2018-1305
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFaoAQYXlSAg2UNWIIRAgRJAJ988PKIrvC29xdOMmDhRe7Qq93v4wCgpMRe
GbSPUWI2Fje2c9Qt6N17wKk=
=b56C
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWqCxH4x+lLeg9Ub1AQh/FQ/+I89Vts5QOArneuuxY4ULQaYRf986jTDM
RgcsuEWGPTuOfsJyBkg+AemcJjwBUwSOxCiCpIjOYkCwr+uke/0u+3/FQkuk1cK7
DyHivYlI+jh+JCEFTr5xuVQTBPdcUXcm7MW/uVMQSiM60nv8xCh7Tdlzx9EYInP1
ovLWtc66aRrF+ilgDLPa/1IJQ0JUE2NOOnLOW3R/Rqu+WIIQMHSjjtUVg8ebYupJ
9LhNywsv4QLx2FvJLTNAhPbMJIzzJIdHim8hB6mi+Bljdl/0dAxMTXLq4KWxo3Cb
S8KYUM+Y2KBbfy1i+3HlT/I2WqmFZNeR5uL5OoXrBjy5xjmTgJs81chRhhVA8ClF
6VcqqGfWi45xHpl8A4/zIRs8uC+/Bxehse7v7nik0JMmg5jYNsnpSKwGUyYQtrm9
Kha/jiV2uMZOlKZSgADzRyI3C2GeRNVqCnub1jstDkyD/FZRjo4AX8wseRCTnO//
DaXPluAi7vtt5S2kgjA4WX8zlhcq1FUb9mweMQaHqs+65cpN1M5+DQ0QcHPyaZca
ngMqD22VWXzRrtL5JABUVbzFpmZ32OD9k3wo9e3Kvk8KtO7rFOT7PPmUxfaviyws
ihzaBKL0bz82kwEyNlK7UQWW+2+2QuVMqXRDE6+2RwNqWNBRpPEI63ZAVwSMoHNn
6T766JxCOGg=
=7qwG
-----END PGP SIGNATURE-----