Issued:
2021-02-11
Updated:
2021-02-11

RHSA-2021:0494 - Security Advisory

Synopsis

Moderate: Red Hat JBoss Web Server 5.4.1 Security Update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Updated Red Hat JBoss Web Server 5.4.1 packages are now available for Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 5.4.1 serves as a replacement for Red Hat JBoss Web Server 5.4.0, and includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes, linked to in the References.

Security Fix(es):

  • tomcat: Apache Tomcat HTTP/2 Request mix-up (CVE-2020-13943)
  • tomcat: HTTP/2 request header mix-up (CVE-2020-17527)
  • tomcat: Information disclosure when using NTFS file system (CVE-2021-24122)
  • openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Web Server 5 for RHEL 8 x86_64
  • JBoss Enterprise Web Server 5 for RHEL 7 x86_64

Fixes

  • BZ - 1887648 - CVE-2020-13943 tomcat: Apache Tomcat HTTP/2 Request mix-up
  • BZ - 1903409 - CVE-2020-1971 openssl: EDIPARTYNAME NULL pointer de-reference
  • BZ - 1904221 - CVE-2020-17527 tomcat: HTTP/2 request header mix-up
  • BZ - 1917209 - CVE-2021-24122 tomcat: Information disclosure when using NTFS file system

JBoss Enterprise Web Server 5 for RHEL 8

SRPM
jws5-tomcat-9.0.36-9.redhat_8.1.el8jws.src.rpm SHA-256: 0a721960200f3eb7ca03b0020dfd0a605062417b44a9f7dd2d13c80a1393030d
jws5-tomcat-native-1.2.25-3.redhat_3.el8jws.src.rpm SHA-256: d4379ff879ccb2b687bc50ad2c10dd65ec580a01e72bf8fb75b2c0231a1b8e5e
x86_64
jws5-tomcat-9.0.36-9.redhat_8.1.el8jws.noarch.rpm SHA-256: 60fe8fcbccca079ddb313bd8c356115b35fe939a631692897507603c01b08eb9
jws5-tomcat-admin-webapps-9.0.36-9.redhat_8.1.el8jws.noarch.rpm SHA-256: 6aed478b921b1c6b779de39a06ac6f7166e458af8ee8a40d36565b2f8ad7fe01
jws5-tomcat-docs-webapp-9.0.36-9.redhat_8.1.el8jws.noarch.rpm SHA-256: f005e46ecbbe9ef7203d9b55305d1747e27b86fed51bdf43d6785a0b23f6eb8c
jws5-tomcat-el-3.0-api-9.0.36-9.redhat_8.1.el8jws.noarch.rpm SHA-256: 282e6feccc230bc7e9facc31e69461edf533e5dc1a09933e3ddbafc266bcd00e
jws5-tomcat-javadoc-9.0.36-9.redhat_8.1.el8jws.noarch.rpm SHA-256: 1fefeab933de249eb03502502f296186bef454ab05605f2e7f540610530decd1
jws5-tomcat-jsp-2.3-api-9.0.36-9.redhat_8.1.el8jws.noarch.rpm SHA-256: 8e39ce500692daac0e308480ba21ae6cf01a030fd9f44a831b559bacc2b3e906
jws5-tomcat-lib-9.0.36-9.redhat_8.1.el8jws.noarch.rpm SHA-256: 94aa389ba1b7c4d0114d1dc73145738e9fc6688ff6a9ef0795ab7e6bc36f66f4
jws5-tomcat-native-1.2.25-3.redhat_3.el8jws.x86_64.rpm SHA-256: 459d833beeeedfdd3cae498133f0b4638bf374d9ff7dff8ec7252464a4f7bc75
jws5-tomcat-native-debuginfo-1.2.25-3.redhat_3.el8jws.x86_64.rpm SHA-256: eb770a5e0b76d987c61f871faa07252339dfd9b89dc6cae694880c05dc2c71c1
jws5-tomcat-selinux-9.0.36-9.redhat_8.1.el8jws.noarch.rpm SHA-256: 86c55fcc89f56963c44e5197bd288b729e9a2abc64c28bcea645c6f7654492b4
jws5-tomcat-servlet-4.0-api-9.0.36-9.redhat_8.1.el8jws.noarch.rpm SHA-256: b467405ae8a9950f54d1f2181566dad1486df53615091c5d215b08b691b9db84
jws5-tomcat-webapps-9.0.36-9.redhat_8.1.el8jws.noarch.rpm SHA-256: d24c939df233b3a63befe8169ea593f4b72dc956405eec290f8338387fa01567

JBoss Enterprise Web Server 5 for RHEL 7

SRPM
jws5-tomcat-9.0.36-9.redhat_8.1.el7jws.src.rpm SHA-256: 83bc88d6420b5d8175c45233441612112c7b52944350953f2654c3777dd94330
jws5-tomcat-native-1.2.25-3.redhat_3.el7jws.src.rpm SHA-256: 9bf7923a4d17ae88f2c3ef17fb58f73d7f9bf585b0706ff395eafddf002846fc
x86_64
jws5-tomcat-9.0.36-9.redhat_8.1.el7jws.noarch.rpm SHA-256: 64a199222bae36fb905da11b42c29ac50093b7e7a09bd2b33abc8c8529c5dc50
jws5-tomcat-admin-webapps-9.0.36-9.redhat_8.1.el7jws.noarch.rpm SHA-256: 28d6d3480ace97ff0e1d33e92077cab29db2744494a1e7ec27983324509f25cd
jws5-tomcat-docs-webapp-9.0.36-9.redhat_8.1.el7jws.noarch.rpm SHA-256: 262a8ded6e58d234e200c423ac0775a06735db37eeb9159689bacc0737052202
jws5-tomcat-el-3.0-api-9.0.36-9.redhat_8.1.el7jws.noarch.rpm SHA-256: 5ebab9c4b138705614e84254cc4fb4210ec8ef355188cbf9deab84adc60c292d
jws5-tomcat-javadoc-9.0.36-9.redhat_8.1.el7jws.noarch.rpm SHA-256: 224b2cc7473a38570e33bc8855b35aa2545ac179119959aab5db88a4cbc76c13
jws5-tomcat-jsp-2.3-api-9.0.36-9.redhat_8.1.el7jws.noarch.rpm SHA-256: 84437a13808a6087b25ffe8e394fdd3295a5097193c2c3b6ce275fd59b7c6acb
jws5-tomcat-lib-9.0.36-9.redhat_8.1.el7jws.noarch.rpm SHA-256: 76b345fdaf39760195aef0a02bd026c7cf5b9df12dee2b3f19a0cc7c5cc3868b
jws5-tomcat-native-1.2.25-3.redhat_3.el7jws.x86_64.rpm SHA-256: adbc639b8a602a16c955f3e6d4b31569dcb89a429c9b0c879c57d3cb2daeb83d
jws5-tomcat-native-debuginfo-1.2.25-3.redhat_3.el7jws.x86_64.rpm SHA-256: 3ade4c63775880091eab4e3d749a39035b70a553503634179b495d691d2344ff
jws5-tomcat-selinux-9.0.36-9.redhat_8.1.el7jws.noarch.rpm SHA-256: f1bf91a14e9d1f663baa577a18ee0c9c0e7a54385410a57263c0c87e30c5527c
jws5-tomcat-servlet-4.0-api-9.0.36-9.redhat_8.1.el7jws.noarch.rpm SHA-256: 3960ac92ae6a45656fef838959b58176a3beeaa7d27ad028901bf46693c504bc
jws5-tomcat-webapps-9.0.36-9.redhat_8.1.el7jws.noarch.rpm SHA-256: 7e5b4f665e5ce10eb2ea24f681ebfba6b90c9d2d1eec6ea05bc1bf70db837274

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.