Red Hat 제품 에라타 RHSA-2020:1521 - Security Advisory
발행된 날짜:
2020-04-21
업데이트된 날짜:
2020-04-21

RHSA-2020:1521 - Security Advisory

요약

Important: Red Hat JBoss Web Server 5.3 release

유형/심각도

Security Advisory: Important

주제

Red Hat JBoss Web Server 5.3.0 zip release for RHEL 6, RHEL 7, RHEL 8 and Microsoft Windows is available.

Red Hat Product Security has rated this release as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

설명

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 5.3 serves as a replacement for Red Hat JBoss Web Server 5.2, and includes bug fixes, enhancements, and component
upgrades, which are documented in the Release Notes, linked to in the
References.

Security Fix(es):

  • tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability (CVE-2020-1938)
  • tomcat: local privilege escalation (CVE-2019-12418)
  • tomcat: session fixation (CVE-2019-17563)
  • tomcat: Regression in handling of Transfer-Encoding header allows for HTTP request smuggling (CVE-2019-17569)
  • tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling (CVE-2020-1935)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

솔루션

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

영향을 받는 제품

  • JBoss Enterprise Web Server Text-Only Advisories x86_64

수정

  • BZ - 1785699 - CVE-2019-12418 tomcat: local privilege escalation
  • BZ - 1785711 - CVE-2019-17563 tomcat: session fixation when using FORM authentication
  • BZ - 1806398 - CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability
  • BZ - 1806835 - CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling
  • BZ - 1806849 - CVE-2019-17569 tomcat: Regression in handling of Transfer-Encoding header allows for HTTP request smuggling

Red Hat 제품 보안팀 연락처는 secalert@redhat.com입니다. https://access.redhat.com/security/team/contact/에 더 많은 연락처 정보가 있습니다.