RHSA-2020:1521 - Security Advisory

Topic

Red Hat JBoss Web Server 5.3.0 zip release for RHEL 6, RHEL 7, RHEL 8 and Microsoft Windows is available.

Red Hat Product Security has rated this release as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

Description

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 5.3 serves as a replacement for Red Hat JBoss Web Server 5.2, and includes bug fixes, enhancements, and component
upgrades, which are documented in the Release Notes, linked to in the
References.

Security Fix(es):

• tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability (CVE-2020-1938)
• tomcat: local privilege escalation (CVE-2019-12418)
• tomcat: session fixation (CVE-2019-17563)
• tomcat: Regression in handling of Transfer-Encoding header allows for HTTP request smuggling (CVE-2019-17569)
• tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling (CVE-2020-1935)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• JBoss Enterprise Web Server Text-Only Advisories x86_64

Fixes

• BZ - 1785699 - CVE-2019-12418 tomcat: local privilege escalation
• BZ - 1785711 - CVE-2019-17563 tomcat: session fixation when using FORM authentication
• BZ - 1806398 - CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability
• BZ - 1806835 - CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling
• BZ - 1806849 - CVE-2019-17569 tomcat: Regression in handling of Transfer-Encoding header allows for HTTP request smuggling

CVEs

• CVE-2019-12418
• CVE-2019-17563
• CVE-2019-17569
• CVE-2020-1935
• CVE-2020-1938

References

• https://access.redhat.com/security/updates/classification/#important