Red Hat Product Errata RHSA-2023:5783 - Security Advisory
Issued:
2023-10-17
Updated:
2023-10-17

RHSA-2023:5783 - Security Advisory

Synopsis

Important: Red Hat JBoss Web Server 5.7.5 release and security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Web Server 5.7.5 on Red Hat Enterprise Linux versions 7, 8, and 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 5.7.5 serves as a replacement for Red Hat JBoss Web Server 5.7.4. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes, linked to in the References section.

Security Fix(es):

  • tomcat: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

A Red Hat Security Bulletin which addresses further details about this flaw is available in the References section.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Web Server 5 for RHEL 9 x86_64
  • JBoss Enterprise Web Server 5 for RHEL 8 x86_64
  • JBoss Enterprise Web Server 5 for RHEL 7 x86_64

Fixes

  • BZ - 2242803 - CVE-2023-44487 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

JBoss Enterprise Web Server 5 for RHEL 9

SRPM
jws5-tomcat-9.0.62-16.redhat_00014.1.el9jws.src.rpm SHA-256: d2faec374d797db599991e00a29d0dbc82088b1fea6734593b346f279d89dd27
x86_64
jws5-tomcat-9.0.62-16.redhat_00014.1.el9jws.noarch.rpm SHA-256: 83d617eac20768c69fccc70a21044ddd796a0c35b58819994c4a4a6711deaf11
jws5-tomcat-admin-webapps-9.0.62-16.redhat_00014.1.el9jws.noarch.rpm SHA-256: cda3dabaa2377ff0eba148082f4784ca62d0799313c81237c974376441ac16c9
jws5-tomcat-docs-webapp-9.0.62-16.redhat_00014.1.el9jws.noarch.rpm SHA-256: c8a843c5f5b9d0dfe91375684113835333e321b1f67477493dd95a78d87a6976
jws5-tomcat-el-3.0-api-9.0.62-16.redhat_00014.1.el9jws.noarch.rpm SHA-256: f5cdabbd29a3f8ec2cafd1719816d3718a3de608946c0ac8ca9c8402d66c0ad2
jws5-tomcat-javadoc-9.0.62-16.redhat_00014.1.el9jws.noarch.rpm SHA-256: 8ee0734acd61d3b07b491913e52e767c24e60b869aca3e66a56f7532af3b2c5b
jws5-tomcat-jsp-2.3-api-9.0.62-16.redhat_00014.1.el9jws.noarch.rpm SHA-256: fa6eea0419a48cea5595f845120f3259e9750872a56cba86868b22b6ad99a0ad
jws5-tomcat-lib-9.0.62-16.redhat_00014.1.el9jws.noarch.rpm SHA-256: 5bea93cb500eb46c998634ec0f3c156a0daed4b1420a913146c4c0aac921f6a2
jws5-tomcat-selinux-9.0.62-16.redhat_00014.1.el9jws.noarch.rpm SHA-256: 1ab91c705205b209a5ddce894e18b408309013825395048a911fadb44d238626
jws5-tomcat-servlet-4.0-api-9.0.62-16.redhat_00014.1.el9jws.noarch.rpm SHA-256: bd1b6c16c2d0e87afe47d5a93d0cebd35f3736629a6d23246f96eb343765f551
jws5-tomcat-webapps-9.0.62-16.redhat_00014.1.el9jws.noarch.rpm SHA-256: c9f4a9efb38baf3f616c3db1455e8b819a21a77b7cd4e5d933ff50fcf90a5b42

JBoss Enterprise Web Server 5 for RHEL 8

SRPM
jws5-tomcat-9.0.62-16.redhat_00014.1.el8jws.src.rpm SHA-256: bc32a756806f7d6fb31f9864798ab0ce5c082817610e019d6ee803af40631e10
x86_64
jws5-tomcat-9.0.62-16.redhat_00014.1.el8jws.noarch.rpm SHA-256: 9831512ccc69705c7ad87651ab23491d84a308c782f656b11cb339d088503173
jws5-tomcat-admin-webapps-9.0.62-16.redhat_00014.1.el8jws.noarch.rpm SHA-256: c054d1a5fe38d64630f617cc73b3a4725ed535f518aa45172a1f5678a31ec545
jws5-tomcat-docs-webapp-9.0.62-16.redhat_00014.1.el8jws.noarch.rpm SHA-256: c738d43b7d78527c2ae45750987ad1d35d376c560ab68a914f30065e7938db5a
jws5-tomcat-el-3.0-api-9.0.62-16.redhat_00014.1.el8jws.noarch.rpm SHA-256: 92f7c3a40a1731a859cf9e0bcf7589c81d152e4f69f712ccc60c65af35eca534
jws5-tomcat-javadoc-9.0.62-16.redhat_00014.1.el8jws.noarch.rpm SHA-256: 6eae9c719495ad0ed227f087c22a54cb607f7486c670ba9ce085e6f94e5ad1b1
jws5-tomcat-jsp-2.3-api-9.0.62-16.redhat_00014.1.el8jws.noarch.rpm SHA-256: 20c7012bf0756b2a6bc7d86a9382191f32d1f2b9d586898e1931807335613108
jws5-tomcat-lib-9.0.62-16.redhat_00014.1.el8jws.noarch.rpm SHA-256: 0d383f4d60e958f94d208d72a681ee7d44cff595bf9dd992006c8c8c90a7719e
jws5-tomcat-selinux-9.0.62-16.redhat_00014.1.el8jws.noarch.rpm SHA-256: 97bf26084c90b05c827163001cb18ba74e2d956c0cd88377927f0079b9fa0c3f
jws5-tomcat-servlet-4.0-api-9.0.62-16.redhat_00014.1.el8jws.noarch.rpm SHA-256: 0f51d337013263cd806f53fbd6ab16dca6b09d77dc04eccecd25854cef57a2f8
jws5-tomcat-webapps-9.0.62-16.redhat_00014.1.el8jws.noarch.rpm SHA-256: 2cd241e4d7d578f6ff3879323ec5e1bf06a7774b778d3966d12e6a4186f01ef9

JBoss Enterprise Web Server 5 for RHEL 7

SRPM
jws5-tomcat-9.0.62-16.redhat_00014.1.el7jws.src.rpm SHA-256: f74114bea4eda01591c8401fd5bf3d4edc48ddf2ca057d9fcea33169da8f9c26
x86_64
jws5-tomcat-9.0.62-16.redhat_00014.1.el7jws.noarch.rpm SHA-256: ddc5f239630f73e96c8984cc435a4bd5c7ba42c56d03ad7f6a908c3613fb220f
jws5-tomcat-admin-webapps-9.0.62-16.redhat_00014.1.el7jws.noarch.rpm SHA-256: 470a759de54bf1d5869a2bccf03ce67f3c599e6da9d74891615d7f749e7d9b10
jws5-tomcat-docs-webapp-9.0.62-16.redhat_00014.1.el7jws.noarch.rpm SHA-256: 8796d59daec99c3aad0adbfa2c9e42220878fdba39fea52dc337880933d19305
jws5-tomcat-el-3.0-api-9.0.62-16.redhat_00014.1.el7jws.noarch.rpm SHA-256: c0ddfa5861ee206174544e8560f4d078da5bd49d5896a8849cd32cd0d8b5c4b6
jws5-tomcat-java-jdk11-9.0.62-16.redhat_00014.1.el7jws.noarch.rpm SHA-256: fb2acd7e2d7797be88deef42fc3e7bf45f574a730e5e18054dde23dff7d92c64
jws5-tomcat-java-jdk8-9.0.62-16.redhat_00014.1.el7jws.noarch.rpm SHA-256: 419284d1b68bbf28a30692b84c4e83d27ba83efdce8db56df6ebc89abb84735f
jws5-tomcat-javadoc-9.0.62-16.redhat_00014.1.el7jws.noarch.rpm SHA-256: 1838e374d26ff5ac61813bd88f0851ac93d05b6bd713d2ab6c8b3b72d5472308
jws5-tomcat-jsp-2.3-api-9.0.62-16.redhat_00014.1.el7jws.noarch.rpm SHA-256: c6b6dcb431c73cbd17f561e21f87da768620f313794247b6ad5b23675e07f98d
jws5-tomcat-lib-9.0.62-16.redhat_00014.1.el7jws.noarch.rpm SHA-256: 44c4b4b06334585f19da91abb9d9554714ad107b41d1664004bc58fd0a0c70a3
jws5-tomcat-selinux-9.0.62-16.redhat_00014.1.el7jws.noarch.rpm SHA-256: 6df1e39b94e3f0e5dfdb8ebd8d481e3ab9035a553f3948edf0a7fa7d6b5f89b8
jws5-tomcat-servlet-4.0-api-9.0.62-16.redhat_00014.1.el7jws.noarch.rpm SHA-256: 487585467eb80f90ef311e39db1c2b8984831de149167b58fbb756e3e7e66c11
jws5-tomcat-webapps-9.0.62-16.redhat_00014.1.el7jws.noarch.rpm SHA-256: 521f6a8c67c302f0e9f18f945c4ca13bb4a2d46f8f9da2b996336a99d1c046c8

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.