Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.0522
Red Hat JBoss Web Server 5.4.1 Security Update
12 February 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Red Hat JBoss Web Server 5.4.1
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Denial of Service -- Remote/Unauthenticated
Provide Misleading Information -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Reduced Security -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2021-24122 CVE-2020-17527 CVE-2020-13943
CVE-2020-1971
Reference: ESB-2021.0273
ESB-2021.0212
ESB-2021.0103
Original Bulletin:
https://access.redhat.com/errata/RHSA-2021:0494
https://access.redhat.com/errata/RHSA-2021:0495
Comment: This bulletin contains two (2) Red Hat security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Red Hat JBoss Web Server 5.4.1 Security Update
Advisory ID: RHSA-2021:0494-01
Product: Red Hat JBoss Web Server
Advisory URL: https://access.redhat.com/errata/RHSA-2021:0494
Issue date: 2021-02-11
CVE Names: CVE-2020-1971 CVE-2020-13943 CVE-2020-17527
CVE-2021-24122
=====================================================================
1. Summary:
Updated Red Hat JBoss Web Server 5.4.1 packages are now available for Red
Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this release as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat JBoss Web Server 5.4 for RHEL 7 Server - noarch, x86_64
Red Hat JBoss Web Server 5.4 for RHEL 8 - noarch, x86_64
3. Description:
Red Hat JBoss Web Server is a fully integrated and certified set of
components for hosting Java web applications. It is comprised of the Apache
Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the
PicketLink Vault extension for Apache Tomcat, and the Tomcat Native
library.
This release of Red Hat JBoss Web Server 5.4.1 serves as a replacement for
Red Hat JBoss Web Server 5.4.0, and includes bug fixes, enhancements and
component upgrades, which are documented in the Release Notes, linked to in
the References.
Security Fix(es):
* tomcat: Apache Tomcat HTTP/2 Request mix-up (CVE-2020-13943)
* tomcat: HTTP/2 request header mix-up (CVE-2020-17527)
* tomcat: Information disclosure when using NTFS file system
(CVE-2021-24122)
* openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1887648 - CVE-2020-13943 tomcat: Apache Tomcat HTTP/2 Request mix-up
1903409 - CVE-2020-1971 openssl: EDIPARTYNAME NULL pointer de-reference
1904221 - CVE-2020-17527 tomcat: HTTP/2 request header mix-up
1917209 - CVE-2021-24122 tomcat: Information disclosure when using NTFS file system
6. Package List:
Red Hat JBoss Web Server 5.4 for RHEL 7 Server:
Source:
jws5-tomcat-9.0.36-9.redhat_8.1.el7jws.src.rpm
jws5-tomcat-native-1.2.25-3.redhat_3.el7jws.src.rpm
noarch:
jws5-tomcat-9.0.36-9.redhat_8.1.el7jws.noarch.rpm
jws5-tomcat-admin-webapps-9.0.36-9.redhat_8.1.el7jws.noarch.rpm
jws5-tomcat-docs-webapp-9.0.36-9.redhat_8.1.el7jws.noarch.rpm
jws5-tomcat-el-3.0-api-9.0.36-9.redhat_8.1.el7jws.noarch.rpm
jws5-tomcat-javadoc-9.0.36-9.redhat_8.1.el7jws.noarch.rpm
jws5-tomcat-jsp-2.3-api-9.0.36-9.redhat_8.1.el7jws.noarch.rpm
jws5-tomcat-lib-9.0.36-9.redhat_8.1.el7jws.noarch.rpm
jws5-tomcat-selinux-9.0.36-9.redhat_8.1.el7jws.noarch.rpm
jws5-tomcat-servlet-4.0-api-9.0.36-9.redhat_8.1.el7jws.noarch.rpm
jws5-tomcat-webapps-9.0.36-9.redhat_8.1.el7jws.noarch.rpm
x86_64:
jws5-tomcat-native-1.2.25-3.redhat_3.el7jws.x86_64.rpm
jws5-tomcat-native-debuginfo-1.2.25-3.redhat_3.el7jws.x86_64.rpm
Red Hat JBoss Web Server 5.4 for RHEL 8:
Source:
jws5-tomcat-9.0.36-9.redhat_8.1.el8jws.src.rpm
jws5-tomcat-native-1.2.25-3.redhat_3.el8jws.src.rpm
noarch:
jws5-tomcat-9.0.36-9.redhat_8.1.el8jws.noarch.rpm
jws5-tomcat-admin-webapps-9.0.36-9.redhat_8.1.el8jws.noarch.rpm
jws5-tomcat-docs-webapp-9.0.36-9.redhat_8.1.el8jws.noarch.rpm
jws5-tomcat-el-3.0-api-9.0.36-9.redhat_8.1.el8jws.noarch.rpm
jws5-tomcat-javadoc-9.0.36-9.redhat_8.1.el8jws.noarch.rpm
jws5-tomcat-jsp-2.3-api-9.0.36-9.redhat_8.1.el8jws.noarch.rpm
jws5-tomcat-lib-9.0.36-9.redhat_8.1.el8jws.noarch.rpm
jws5-tomcat-selinux-9.0.36-9.redhat_8.1.el8jws.noarch.rpm
jws5-tomcat-servlet-4.0-api-9.0.36-9.redhat_8.1.el8jws.noarch.rpm
jws5-tomcat-webapps-9.0.36-9.redhat_8.1.el8jws.noarch.rpm
x86_64:
jws5-tomcat-native-1.2.25-3.redhat_3.el8jws.x86_64.rpm
jws5-tomcat-native-debuginfo-1.2.25-3.redhat_3.el8jws.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2020-1971
https://access.redhat.com/security/cve/CVE-2020-13943
https://access.redhat.com/security/cve/CVE-2020-17527
https://access.redhat.com/security/cve/CVE-2021-24122
https://access.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYCU2ktzjgjWX9erEAQgbVhAApvQsmnCGPuAPf0CNAwKteY0i+2j78mxR
SZlICmXTNYE/L9LCBqyG60Ya8XGahVoZdoeWi9Ez4fuH1jZi1dw4vn7BhYB41Qpj
daTuCKjNp/wuKPAF3n4meZ0xleC2wTOGDHiXhh9mCMugVSgU9Hu9SC3VEIvug52O
nGCcdn7B+7+QUlg8hitVSAFDYxexKBX33AWx4ylKDOmdinC27eXN5j5Y8ChBEz11
i6mhAdmCGfC4/fqsM6qZSQjECZBx2D1ZQvKGfNYluGZYty20QV2YzBK4w7lLmfSj
bFB34bWt6kI0bnwBojuZcPD6X//AP0EbDDrZvMLM/z0f8LLAldT74dcKghd2mjMP
nAMnYM2VKUE9h7PTfnH7elS249BOvm6MjTUZDV443TaL0JcbegJUvbsQJncp0v9S
oBW7cypecOUtVjosUV6AOWuIptEkHG3HtsxCvrvPO6m5dDQBMkgTKOQTgrDa7FGi
/3DgPvofjY2+wdR9YbY73Fy/Y15qm8KAiEzsm9i8zLoMvZ3mJeiMcSpL/O5MU/+q
f6rizcErIU0j2H7y2sBRD3dp8mHfgkxhXLYV5x5jJBomZHl31wWKst8FM3+gu27p
LleKKXRjkIzCQbBBBnhVycdYdYTy1MxXjYdBG59HO+YmimYC1P4QE+FysCkKPGAv
3QJLVipYpGE=
=ir9P
- -----END PGP SIGNATURE-----
- ---------------------------------------------------------------------------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Red Hat JBoss Web Server 5.4.1 Security Update
Advisory ID: RHSA-2021:0495-01
Product: Red Hat JBoss Web Server
Advisory URL: https://access.redhat.com/errata/RHSA-2021:0495
Issue date: 2021-02-11
CVE Names: CVE-2020-1971 CVE-2020-13943 CVE-2020-17527
CVE-2021-24122
=====================================================================
1. Summary:
Red Hat JBoss Web Server 5.4.1 zip release is now available for Red Hat
Enterprise Linux 7, Red Hat Enterprise Linux 8 and Windows.
Red Hat Product Security has rated this release as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Description:
Red Hat JBoss Web Server is a fully integrated and certified set of
components for hosting Java web applications. It is comprised of the Apache
Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the
PicketLink Vault extension for Apache Tomcat, and the Tomcat Native
library.
This release of Red Hat JBoss Web Server 5.4.1 serves as a replacement for
Red Hat JBoss Web Server 5.4.0, and includes bug fixes, enhancements, and
component upgrades, which are documented in the Release Notes, linked to in
the References.
Security Fix(es):
* tomcat: Apache Tomcat HTTP/2 Request mix-up (CVE-2020-13943)
* tomcat: HTTP/2 request header mix-up (CVE-2020-17527)
* tomcat: Information disclosure when using NTFS file system
(CVE-2021-24122)
* openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
3. Solution:
Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.
The References section of this erratum contains a download link for the
update. You must be logged in to download the update.
4. Bugs fixed (https://bugzilla.redhat.com/):
1887648 - CVE-2020-13943 tomcat: Apache Tomcat HTTP/2 Request mix-up
1903409 - CVE-2020-1971 openssl: EDIPARTYNAME NULL pointer de-reference
1904221 - CVE-2020-17527 tomcat: HTTP/2 request header mix-up
1917209 - CVE-2021-24122 tomcat: Information disclosure when using NTFS file system
5. References:
https://access.redhat.com/security/cve/CVE-2020-1971
https://access.redhat.com/security/cve/CVE-2020-13943
https://access.redhat.com/security/cve/CVE-2020-17527
https://access.redhat.com/security/cve/CVE-2021-24122
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver&downloadType=securityPatches&version=5.4
https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/5.4/
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYCU2rdzjgjWX9erEAQh/qA//fBFrMVOlc6ZUXh3b+/2ZbmqEvt7bcwPz
ual1XJCnNuzjk8f5M9wcZ+B9Vw9qJgt+p+e4s2lrXeow/gkNYNx8+WiH+AdRTg2i
COHM+34qRLhPKFX2nQ0/0/bqfH7Tx+XYw5RROBog9AmXGqqly5y0qwOMEmCKT+mf
g9xx5gKdvP960WAIz+qqgKnWq3geRCYXrqQ83FRIKV2OtUpxiNtYnIeHNmDtjut8
Jr3aWqHUVH0Ylu4QG5QunJloDLuSGcR3Kvs9vKr2Z05N7dVZLft/iuUwTzz8jNL7
4Fqsu0MJhTRmkWaCmF9p7FfdjuzlL8WTpSwTPdUlWDxNCV+HK+HMbSTdKkCaizxo
t1/CIcfFFT/eFPCcKAFZ9ybAwOZ8JUVsx8twW6sdtPEpggRPMX00rGiI/uHSKW9R
kLCKnmJKllRgHBXUR+MepXFkjTpD6jc1PLDeofNV2IWHbQkdK+oK3Kp9pTuuYbsP
sQo1rraUDLlsDtqGhUUzoGo610DGQ7E0Aqm2LOOXGva4jmXWLpdppM6uWOU1FEjI
2YNDeio010ePWqcsEr1TCjn6ColTjtZYgmFOe6L0xrWmnO5jPfQjECWPyqpfzKCR
ooWWozPCz6NYSoMizAMpzbSQ3l6AOBtZ0Wglmzc+i1t++IeLJR4cT3nonClLgG4x
AcBW8P9Iy5w=
=LSdp
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYCXvLONLKJtyKPYoAQhqPg//ePJ7zgbSoktyBZd9CwhGYYYoUw91tNXS
9oH3Rh1b1NkLbW8e9LRE0ChoCZeoS6pRY74o734G9VwjnLdamobcu3dJEueSLRbE
5hSFxvIm+LZZ8rS3e99bl6dOm7g/zOJHHY6kIfY/fkOHMSwCUUU38UpQzlwB5Hnq
EyS7leNcU/p8NhNug+a1HxHk0hu0nWW7o88NAskdAL/DvLXhQfUK8aKuZ5cuiUmR
8R/KmEifD57XEfUTRCqTxQt8ATEV7nYPYv3u2idlQ21Ycv5etCoSmMQcbYnwchkW
WgknimbWL6vuZm3y58xuHDej1VougQvOhvAhMENiVTlUrNW7+Uht564MVMDU2q+D
9RqZVCGmmwdphjKnEL7QPv5i1TlYVXngobq9ZwCWSPFgLlPSMmPqQj5AuqgT2aOC
LDVhGUuRYqrl53nRhErDCxoXyCRmAZngsEgUE2j8e8n0b0GEerAUrXrv9VKyktu+
RRHjVnt6t7YsGQEyk0HGMFFs0pPkbM2dtDG4Dsrmz5waXVYS+dUuH7Hmpm/Cx3+T
FDCHnPNCK10FGGPdSZNC9EHzhOqLvnlwt9n1kWckbgHf+JuBL2udnUGm+wnpaTLD
2HjLYGomm28ACM0T2pHldJfU+JcFFUw0UIsj2kcPBVPkuiUlhq7yCVp0tK/MB2H4
ldX78BjOzZY=
=zv3+
-----END PGP SIGNATURE-----