Red Hat Product Errata RHSA-2023:6206 - Security Advisory
Issued:
2023-10-31
Updated:
2023-10-31

RHSA-2023:6206 - Security Advisory

Synopsis

Moderate: Red Hat JBoss Web Server 5.7.6 release and security update

Type/Severity

Security Advisory: Moderate

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Web Server 5.7.6 on Red Hat Enterprise Linux versions 7, 8, and 9.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 5.7.6 serves as a replacement for Red Hat JBoss Web Server 5.7.5. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes, linked to in the References section.

Security Fix(es):

  • tomcat: improper cleaning of recycled objects could lead to information leak (CVE-2023-42795)
  • tomcat: incorrectly parsed http trailer headers can cause request smuggling (CVE-2023-45648)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Web Server 5 for RHEL 9 x86_64
  • JBoss Enterprise Web Server 5 for RHEL 8 x86_64
  • JBoss Enterprise Web Server 5 for RHEL 7 x86_64

Fixes

  • BZ - 2243749 - CVE-2023-45648 tomcat: incorrectly parsed http trailer headers can cause request smuggling
  • BZ - 2243752 - CVE-2023-42795 tomcat: improper cleaning of recycled objects could lead to information leak

JBoss Enterprise Web Server 5 for RHEL 9

SRPM
jws5-tomcat-9.0.62-18.redhat_00016.1.el9jws.src.rpm SHA-256: b9c463cded60d699ebc04e3eeea69559c3504d285d6e57dd6bc1e9536c9b71c3
x86_64
jws5-tomcat-9.0.62-18.redhat_00016.1.el9jws.noarch.rpm SHA-256: bf429c00f201228e17438f1577e311c7bcc28227ce2a962bd81dc50f700fea88
jws5-tomcat-admin-webapps-9.0.62-18.redhat_00016.1.el9jws.noarch.rpm SHA-256: a7848ab3db28d7d3e724af6abf80c58a4f9e0c72324caa0b1939e8c73263fdc2
jws5-tomcat-docs-webapp-9.0.62-18.redhat_00016.1.el9jws.noarch.rpm SHA-256: 029c0b5df2695118a09b6cbdd0b3c11ac301c2a4dff8aeb69669ec4c388747d9
jws5-tomcat-el-3.0-api-9.0.62-18.redhat_00016.1.el9jws.noarch.rpm SHA-256: 78c586e3a8a315f3a080d8e63a03fe1505f571c0f71454f204e88ba94f42cb4b
jws5-tomcat-javadoc-9.0.62-18.redhat_00016.1.el9jws.noarch.rpm SHA-256: 7cfba1a00d12f9b55fd721d525113bcb75171d664d71bd155c1d77cf5fb4a236
jws5-tomcat-jsp-2.3-api-9.0.62-18.redhat_00016.1.el9jws.noarch.rpm SHA-256: da4ce8631bd8afb4d770b2c5dba1d12a4729442b42cd66f00ae5672e903965db
jws5-tomcat-lib-9.0.62-18.redhat_00016.1.el9jws.noarch.rpm SHA-256: b626fc5779bf444fad922da483c93b7eafe804efa747463873906401f2cb4ef3
jws5-tomcat-selinux-9.0.62-18.redhat_00016.1.el9jws.noarch.rpm SHA-256: cfeb17264eac0eff87973804d0b4f2935585a231db2f13575a76fd0a9743b838
jws5-tomcat-servlet-4.0-api-9.0.62-18.redhat_00016.1.el9jws.noarch.rpm SHA-256: 60ec9efb6f0150a9e27339788e7a4cc0e05a5975bce797d5347c240478dc8992
jws5-tomcat-webapps-9.0.62-18.redhat_00016.1.el9jws.noarch.rpm SHA-256: 3230b5594d3ef24cd10c82f6ca62bbbc9c7605c60149455b38474fa508d13511

JBoss Enterprise Web Server 5 for RHEL 8

SRPM
jws5-tomcat-9.0.62-18.redhat_00016.1.el8jws.src.rpm SHA-256: d65cfc858258cc90d3ad58c1c6b0f441b55770dcd5d161681c0e525ac11ecf2c
x86_64
jws5-tomcat-9.0.62-18.redhat_00016.1.el8jws.noarch.rpm SHA-256: 11e12d08e45120887395e0c25f1131a9f07fd607fd8d09c03ff5a4f9cd264fb9
jws5-tomcat-admin-webapps-9.0.62-18.redhat_00016.1.el8jws.noarch.rpm SHA-256: 41b14c2bd3da895871547cad7f1c54701b2c5be34df03e43f108d2a918ddb12c
jws5-tomcat-docs-webapp-9.0.62-18.redhat_00016.1.el8jws.noarch.rpm SHA-256: 90fea4818d4b7b90068891f72d5e7859b8e779ced8c083aaf9f9c7c405cbd4e5
jws5-tomcat-el-3.0-api-9.0.62-18.redhat_00016.1.el8jws.noarch.rpm SHA-256: 49c3aecaad90764d9f932e4191231833c6741dc294612a51d4a3515363d029e7
jws5-tomcat-javadoc-9.0.62-18.redhat_00016.1.el8jws.noarch.rpm SHA-256: cf0607bc7062e293d9d4787b2e29e57ec3c09d4a8396f875f8f5a0b745dda324
jws5-tomcat-jsp-2.3-api-9.0.62-18.redhat_00016.1.el8jws.noarch.rpm SHA-256: b969f872fc3ce25b19aac309e56c65e7b98a50229004d8b85d4e2ae8e33a9434
jws5-tomcat-lib-9.0.62-18.redhat_00016.1.el8jws.noarch.rpm SHA-256: 9ca5c1e3c20e10682394dc33d7e5d919e415ca7663e2bee0db792d820261faa4
jws5-tomcat-selinux-9.0.62-18.redhat_00016.1.el8jws.noarch.rpm SHA-256: e4961377f97476f9c2b7dad09c6ab0e8ef50bb9782e4594ba7114e2b12410222
jws5-tomcat-servlet-4.0-api-9.0.62-18.redhat_00016.1.el8jws.noarch.rpm SHA-256: f97e54bcf2489eff0fa6c401f5f911a43d46e0588db4c56ffeb5b42e9cebcfcc
jws5-tomcat-webapps-9.0.62-18.redhat_00016.1.el8jws.noarch.rpm SHA-256: 7e0657555101c1ddfcd1bfea0a7491f5533fe1fa388755e6ec8081239e75aa09

JBoss Enterprise Web Server 5 for RHEL 7

SRPM
jws5-tomcat-9.0.62-18.redhat_00016.1.el7jws.src.rpm SHA-256: 94c6da7f3ea522e1c304d7fcf6d23facdfac07a92fe74aeb9e2010e1604edbf8
x86_64
jws5-tomcat-9.0.62-18.redhat_00016.1.el7jws.noarch.rpm SHA-256: c0ae77d8a1c8b76a4a8ebd1a32eb97ffd1a7e07c08145f5d9d4d97c27903c445
jws5-tomcat-admin-webapps-9.0.62-18.redhat_00016.1.el7jws.noarch.rpm SHA-256: 158d5d18b8cb289486a30f93e9452fb85657dfabff62c1099b3086595ad41339
jws5-tomcat-docs-webapp-9.0.62-18.redhat_00016.1.el7jws.noarch.rpm SHA-256: 45d2f62a6d3941896631f7e5946884183090ecacec4e67cd72935b7afb1a9820
jws5-tomcat-el-3.0-api-9.0.62-18.redhat_00016.1.el7jws.noarch.rpm SHA-256: bfc924094765d0777a12dbbe9b39d624310c780b143dd34ae162ce362ab433a1
jws5-tomcat-java-jdk11-9.0.62-18.redhat_00016.1.el7jws.noarch.rpm SHA-256: 9a93c075c87bc0e14358dbb3b10347ad389d3db896a1630bf07e99f778f3c143
jws5-tomcat-java-jdk8-9.0.62-18.redhat_00016.1.el7jws.noarch.rpm SHA-256: 07f9131944278c2135422f0dfb662337272d1dc5d991bfe253ecd4aa3dbda0ed
jws5-tomcat-javadoc-9.0.62-18.redhat_00016.1.el7jws.noarch.rpm SHA-256: 25d550143c448fca415a0574f01c7f33bb2e7e525438351fc3473a8671af50d6
jws5-tomcat-jsp-2.3-api-9.0.62-18.redhat_00016.1.el7jws.noarch.rpm SHA-256: e00311363dcc03945f5bd64b0fb8331dce9909f982b4293d8528c07a2c6a531f
jws5-tomcat-lib-9.0.62-18.redhat_00016.1.el7jws.noarch.rpm SHA-256: a00e73f09962311e0b1a13d62df4dbe94f955bab6c4bf88d415e5eae3b8926dd
jws5-tomcat-selinux-9.0.62-18.redhat_00016.1.el7jws.noarch.rpm SHA-256: 54b501ee05a5cdf35b8a122f1f019317085d79f5148a92afff260508b4f6f622
jws5-tomcat-servlet-4.0-api-9.0.62-18.redhat_00016.1.el7jws.noarch.rpm SHA-256: 2e8b4a034b3bcb6b5b29da94f0e7eeea36b50ae353add147203ca793dbf94348
jws5-tomcat-webapps-9.0.62-18.redhat_00016.1.el7jws.noarch.rpm SHA-256: 69ee30b6a807e1cbad81601aaa215723449ba8093ebd998b6c80caafc7e11344

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.