Red Hat Product Errata RHSA-2020:1520 - Security Advisory
Issued:
2020-04-21
Updated:
2020-04-21

RHSA-2020:1520 - Security Advisory

Synopsis

Important: Red Hat JBoss Web Server 5.3 release

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Updated Red Hat JBoss Web Server 5.3.0 packages are now available for Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this release as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

Description

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 5.3 serves as a replacement for Red Hat JBoss Web Server 5.2, and includes bug fixes, enhancements, and component upgrades, which are documented in the Release Notes, linked to in the References.

Security Fix(es):

  • tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability (CVE-2020-1938)
  • tomcat: local privilege escalation (CVE-2019-12418)
  • tomcat: session fixation (CVE-2019-17563)
  • tomcat: Regression in handling of Transfer-Encoding header allows for HTTP request smuggling (CVE-2019-17569)
  • tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling (CVE-2020-1935)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Web Server 5 for RHEL 8 x86_64
  • JBoss Enterprise Web Server 5 for RHEL 7 x86_64
  • JBoss Enterprise Web Server 5 for RHEL 6 x86_64
  • JBoss Enterprise Web Server 5 for RHEL 6 i386

Fixes

  • BZ - 1785699 - CVE-2019-12418 tomcat: local privilege escalation
  • BZ - 1785711 - CVE-2019-17563 tomcat: session fixation when using FORM authentication
  • BZ - 1806398 - CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability
  • BZ - 1806835 - CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling
  • BZ - 1806849 - CVE-2019-17569 tomcat: Regression in handling of Transfer-Encoding header allows for HTTP request smuggling

JBoss Enterprise Web Server 5 for RHEL 8

SRPM
jws5-tomcat-9.0.30-3.redhat_4.1.el8jws.src.rpm SHA-256: 41a2c65c1e3b7b2606837b4c8c1b91fc27109ca8706f3c5deb587fbf8382d4d3
jws5-tomcat-native-1.2.23-4.redhat_4.el8jws.src.rpm SHA-256: 9234f69c978e5c50f41de7f7b07638ac8ec072c7682f94e9098c200e3baa2cb7
x86_64
jws5-tomcat-9.0.30-3.redhat_4.1.el8jws.noarch.rpm SHA-256: 6a90585a73a6ee82192086711d430234d232c07244a1c37097877408d656b821
jws5-tomcat-admin-webapps-9.0.30-3.redhat_4.1.el8jws.noarch.rpm SHA-256: 203b99fc897ecd038090c8ce411d38a81dd24db21187a9afe37130777701ae41
jws5-tomcat-docs-webapp-9.0.30-3.redhat_4.1.el8jws.noarch.rpm SHA-256: 91ffec185d3afab89ff885114a87ce3710b1f39de4fde41d1b1aae2e6936d0ea
jws5-tomcat-el-3.0-api-9.0.30-3.redhat_4.1.el8jws.noarch.rpm SHA-256: d3bce51fcb20c2dceb94591192c5b023748cde3b0231aaa84430419869f51e42
jws5-tomcat-javadoc-9.0.30-3.redhat_4.1.el8jws.noarch.rpm SHA-256: 04e84c22e2b2701728b89f6aa975316e73cea40f07934c56c9d8f4c48fdb3583
jws5-tomcat-jsp-2.3-api-9.0.30-3.redhat_4.1.el8jws.noarch.rpm SHA-256: 00eb2ed260629e6ae480b5141072db9d8ca6e94cf597fdeecf77e03cb0927fdd
jws5-tomcat-lib-9.0.30-3.redhat_4.1.el8jws.noarch.rpm SHA-256: 1277781af3a41cc7ec55161f0d40e8ff034ca76d783255332d69021a8a44487d
jws5-tomcat-native-1.2.23-4.redhat_4.el8jws.x86_64.rpm SHA-256: 5ccb2a00ba20778eeec85a3f1cb54023a886a117d44fb24ee5e5eff983fe316f
jws5-tomcat-native-debuginfo-1.2.23-4.redhat_4.el8jws.x86_64.rpm SHA-256: bd6d37d8054566ac90a52133b6a3d7a10a1a062c18a9bab045acc57e426f7986
jws5-tomcat-selinux-9.0.30-3.redhat_4.1.el8jws.noarch.rpm SHA-256: 3d44c62d8e2e18c34ca479c19a5bb0ed337bca5d663d6fa9cd8faf14cfa72394
jws5-tomcat-servlet-4.0-api-9.0.30-3.redhat_4.1.el8jws.noarch.rpm SHA-256: e62c7e1ab167b2c2576454a5aecd80f2c2f8224fd320979e651d8beec87ed0f1
jws5-tomcat-webapps-9.0.30-3.redhat_4.1.el8jws.noarch.rpm SHA-256: 57bca8beec3ac8b751b079831bc93268d985484046ce2f788bbcba042977956f

JBoss Enterprise Web Server 5 for RHEL 7

SRPM
jws5-tomcat-9.0.30-3.redhat_4.1.el7jws.src.rpm SHA-256: 189156e691774af7f50b5e59175709ce47d22d4d84d304dcfa59317b0bc8d9e1
jws5-tomcat-native-1.2.23-4.redhat_4.el7jws.src.rpm SHA-256: fc4a1aa341fa1eaa4d9abf10caf0b07509ea595bf9ea9053f8240e87cc31b7db
x86_64
jws5-tomcat-9.0.30-3.redhat_4.1.el7jws.noarch.rpm SHA-256: b0367ffde04614d1bbf2d61aa9ace0de8c2f0364496aa3dd22b23d9bf5865ef0
jws5-tomcat-admin-webapps-9.0.30-3.redhat_4.1.el7jws.noarch.rpm SHA-256: a589d06f6be13793008ff02d0ecdd57f36a02150e5085a1b3a28d59d5273dc18
jws5-tomcat-docs-webapp-9.0.30-3.redhat_4.1.el7jws.noarch.rpm SHA-256: 5d14d5b7176c012839c766deb06f58f33f9032313d0826e6752e861af9d1f372
jws5-tomcat-el-3.0-api-9.0.30-3.redhat_4.1.el7jws.noarch.rpm SHA-256: b17504adfcff42decb82e13f25026968a9ed8c154516bd604ba8b0f27617fc0c
jws5-tomcat-javadoc-9.0.30-3.redhat_4.1.el7jws.noarch.rpm SHA-256: 6a47e421e31675952e0e988047d924c0c10cb4e212895b67a3fe1392df92f422
jws5-tomcat-jsp-2.3-api-9.0.30-3.redhat_4.1.el7jws.noarch.rpm SHA-256: c85c5b4b703c2e57a44cc711366a3387f5362281825cbead778126f5548acb85
jws5-tomcat-lib-9.0.30-3.redhat_4.1.el7jws.noarch.rpm SHA-256: 6b3a9d0f41fc56dca6f8c28cc1b32df9785bc0cff51f0b10568ced1d8504bcb1
jws5-tomcat-native-1.2.23-4.redhat_4.el7jws.x86_64.rpm SHA-256: 2e3c9e2aef691bbc47a716feec6fcd335cbeede8084b89b3d71198763cf2855e
jws5-tomcat-native-debuginfo-1.2.23-4.redhat_4.el7jws.x86_64.rpm SHA-256: c167abc1e1b4b725ef6c9973a31f4c8dd1b9fef9dfa3dedab38dba54be148fc4
jws5-tomcat-selinux-9.0.30-3.redhat_4.1.el7jws.noarch.rpm SHA-256: 3117a24b3bac07bb1d9093fcec3300d35c181cb7d14ef4e317d10e07ec8d1493
jws5-tomcat-servlet-4.0-api-9.0.30-3.redhat_4.1.el7jws.noarch.rpm SHA-256: 7d710ee802ffe5b7391d53b18d31b8521b9e7cdec43eef98d429ec47888e4c6a
jws5-tomcat-webapps-9.0.30-3.redhat_4.1.el7jws.noarch.rpm SHA-256: 4ba694dac42d008f5f1f1d545e6652459b67f675fe4762737139d8b113906e9c

JBoss Enterprise Web Server 5 for RHEL 6

SRPM
jws5-tomcat-9.0.30-3.redhat_4.1.el6jws.src.rpm SHA-256: 3b0c917c1070db08b5f4e485169d1a6be4d4670d260d7fb3cff53c5c11c0bdcf
jws5-tomcat-native-1.2.23-4.redhat_4.el6jws.src.rpm SHA-256: 469f36f262f66d33e0a326266219dc03c16a938758925d013b1315ebf613d80f
x86_64
jws5-tomcat-9.0.30-3.redhat_4.1.el6jws.noarch.rpm SHA-256: ae52153194cdf08339091fcdc6a3d44a534c2e60f5adc587a6daff30111730b4
jws5-tomcat-admin-webapps-9.0.30-3.redhat_4.1.el6jws.noarch.rpm SHA-256: 1f48766db695beff25db6feadd9e080df5521e62ce18b2349ab5602425792e71
jws5-tomcat-docs-webapp-9.0.30-3.redhat_4.1.el6jws.noarch.rpm SHA-256: 1082b352af6cd3beed8a919c3ecf0bf7c395a5848ee9e469603abc1803d4fafa
jws5-tomcat-el-3.0-api-9.0.30-3.redhat_4.1.el6jws.noarch.rpm SHA-256: a28b90e394c9893ab37b8c26f5f06727ab95d0cbf972e54955bdd97fcb4b7ee1
jws5-tomcat-javadoc-9.0.30-3.redhat_4.1.el6jws.noarch.rpm SHA-256: 37278ae26fb4bdd543b2e590c0b65ccceafd9594d80537d2047d1600bab066d5
jws5-tomcat-jsp-2.3-api-9.0.30-3.redhat_4.1.el6jws.noarch.rpm SHA-256: 5da1b35eff9710cb64b47bfad088649e3b74b7eedb233db689bfdb5534376ec0
jws5-tomcat-lib-9.0.30-3.redhat_4.1.el6jws.noarch.rpm SHA-256: e15b194361dde793eb6ab11725e70ba59b3412d942a829f1743c210497f3e0a5
jws5-tomcat-native-1.2.23-4.redhat_4.el6jws.x86_64.rpm SHA-256: 336a5ed04c452a564563b41f8d88009ccc74b8364a135d7ef65fcc1da1381e97
jws5-tomcat-native-debuginfo-1.2.23-4.redhat_4.el6jws.x86_64.rpm SHA-256: b28400f02462754e98b8341e985a32abb3a74101167dccc75423a1d21e739ea7
jws5-tomcat-selinux-9.0.30-3.redhat_4.1.el6jws.noarch.rpm SHA-256: 53bb9b03c127196325e20dfaebe5ae12266293a62f3c04c4c6b6e0576d4ac8e8
jws5-tomcat-servlet-4.0-api-9.0.30-3.redhat_4.1.el6jws.noarch.rpm SHA-256: f301dbade6e3b7d4f51e9201c9453574b6fdabfebe4905629afcaad9667bbdae
jws5-tomcat-webapps-9.0.30-3.redhat_4.1.el6jws.noarch.rpm SHA-256: 7b75c6aff9914d1459a1af73895667a5da6cf994b1b8103b2daceda137c2ed42
i386
jws5-tomcat-9.0.30-3.redhat_4.1.el6jws.noarch.rpm SHA-256: ae52153194cdf08339091fcdc6a3d44a534c2e60f5adc587a6daff30111730b4
jws5-tomcat-admin-webapps-9.0.30-3.redhat_4.1.el6jws.noarch.rpm SHA-256: 1f48766db695beff25db6feadd9e080df5521e62ce18b2349ab5602425792e71
jws5-tomcat-docs-webapp-9.0.30-3.redhat_4.1.el6jws.noarch.rpm SHA-256: 1082b352af6cd3beed8a919c3ecf0bf7c395a5848ee9e469603abc1803d4fafa
jws5-tomcat-el-3.0-api-9.0.30-3.redhat_4.1.el6jws.noarch.rpm SHA-256: a28b90e394c9893ab37b8c26f5f06727ab95d0cbf972e54955bdd97fcb4b7ee1
jws5-tomcat-javadoc-9.0.30-3.redhat_4.1.el6jws.noarch.rpm SHA-256: 37278ae26fb4bdd543b2e590c0b65ccceafd9594d80537d2047d1600bab066d5
jws5-tomcat-jsp-2.3-api-9.0.30-3.redhat_4.1.el6jws.noarch.rpm SHA-256: 5da1b35eff9710cb64b47bfad088649e3b74b7eedb233db689bfdb5534376ec0
jws5-tomcat-lib-9.0.30-3.redhat_4.1.el6jws.noarch.rpm SHA-256: e15b194361dde793eb6ab11725e70ba59b3412d942a829f1743c210497f3e0a5
jws5-tomcat-native-1.2.23-4.redhat_4.el6jws.i686.rpm SHA-256: 71f51bdf32a7f1792dd67837eadd446ba5f360f518c622f559ebc10b06453c75
jws5-tomcat-native-debuginfo-1.2.23-4.redhat_4.el6jws.i686.rpm SHA-256: 64400a0c3a4ba98ebfc3766a885a89b22a4cdc3277d82a8843c779fb1710ece8
jws5-tomcat-selinux-9.0.30-3.redhat_4.1.el6jws.noarch.rpm SHA-256: 53bb9b03c127196325e20dfaebe5ae12266293a62f3c04c4c6b6e0576d4ac8e8
jws5-tomcat-servlet-4.0-api-9.0.30-3.redhat_4.1.el6jws.noarch.rpm SHA-256: f301dbade6e3b7d4f51e9201c9453574b6fdabfebe4905629afcaad9667bbdae
jws5-tomcat-webapps-9.0.30-3.redhat_4.1.el6jws.noarch.rpm SHA-256: 7b75c6aff9914d1459a1af73895667a5da6cf994b1b8103b2daceda137c2ed42

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.