Red Hat Product Errata RHSA-2024:1318 - Security Advisory
Issued:
2024-03-18
Updated:
2024-03-19

RHSA-2024:1318 - Security Advisory

Synopsis

Important: Red Hat JBoss Web Server 5.7.8 release and security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Web Server 5.7.8 on Red Hat Enterprise Linux versions 7, 8, and 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 5.7.8 serves as a replacement for Red Hat JBoss Web Server 5.7.7. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes linked to in the References section.

Security Fix(es):

  • openssl: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow (CVE-2023-5678)
  • tomcat: HTTP request smuggling via malformed trailer headers (CVE-2023-46589)
  • tomcat: : Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Web Server 5 for RHEL 9 x86_64
  • JBoss Enterprise Web Server 5 for RHEL 8 x86_64
  • JBoss Enterprise Web Server 5 for RHEL 7 x86_64

Fixes

  • BZ - 2248616 - CVE-2023-5678 openssl: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow
  • BZ - 2252050 - CVE-2023-46589 tomcat: HTTP request smuggling via malformed trailer headers
  • BZ - 2269607 - CVE-2024-24549 : Apache Tomcat: HTTP/2 header handling DoS

JBoss Enterprise Web Server 5 for RHEL 9

SRPM
jws5-tomcat-9.0.62-41.redhat_00020.1.el9jws.src.rpm SHA-256: e8151e8f61e44f3f66ecb1ada804cf736c926e06a14f5d6ef5bc37b2fc9308f9
jws5-tomcat-native-1.2.31-17.redhat_17.el9jws.src.rpm SHA-256: c41fc87eb8d9be9ed7bb308cb7c4a1e341135654ee4e0b53edf73e7aec82603a
x86_64
jws5-tomcat-9.0.62-41.redhat_00020.1.el9jws.noarch.rpm SHA-256: c773c83a97fe898ca7474ecf65d8427df16ba11e930a917bdd85aa7d6218ad12
jws5-tomcat-admin-webapps-9.0.62-41.redhat_00020.1.el9jws.noarch.rpm SHA-256: eedad6a3e24e3e2505dd9ac25bcda4c574819c61a0e362295ce55d2b9b060815
jws5-tomcat-docs-webapp-9.0.62-41.redhat_00020.1.el9jws.noarch.rpm SHA-256: c4c375aa9a7195c416154c5424e25380d107d7643a87751bbbaed45738bd4f94
jws5-tomcat-el-3.0-api-9.0.62-41.redhat_00020.1.el9jws.noarch.rpm SHA-256: 51739f9bce1541fb6b2e9b0bcd9971cb0d5a0212c8df733b23bb9ba10efec96e
jws5-tomcat-javadoc-9.0.62-41.redhat_00020.1.el9jws.noarch.rpm SHA-256: 7c0a23465890738807e33a1996ce537a0f5ef37ed9d720da318bbc98d2095db9
jws5-tomcat-jsp-2.3-api-9.0.62-41.redhat_00020.1.el9jws.noarch.rpm SHA-256: d6b5f0f48369677e97b3603ee1db0752d79695c8309fffafe5477e9dd066a930
jws5-tomcat-lib-9.0.62-41.redhat_00020.1.el9jws.noarch.rpm SHA-256: e419d544172aeee1d35a042eef060ccb4baf99a853c79c70bbdd7a0b8c8b2a58
jws5-tomcat-native-1.2.31-17.redhat_17.el9jws.x86_64.rpm SHA-256: 5eb6b8c2b3d11c826ac318fb255b727f7269e5f801fecc9e919782d47e39c281
jws5-tomcat-native-debuginfo-1.2.31-17.redhat_17.el9jws.x86_64.rpm SHA-256: 2dfdaa8223c38c765642af3b3584e2db9ce3b9573f915ebfe485347b253d0536
jws5-tomcat-selinux-9.0.62-41.redhat_00020.1.el9jws.noarch.rpm SHA-256: d6ff5d57572f8424629187fe64f71a7b79ec4f20bb5af8870bbb788977a39e0f
jws5-tomcat-servlet-4.0-api-9.0.62-41.redhat_00020.1.el9jws.noarch.rpm SHA-256: 3086ca100475b7187c3f2b59c2a1099e7e9ed44249813a33005c29eae6d6fb9f
jws5-tomcat-webapps-9.0.62-41.redhat_00020.1.el9jws.noarch.rpm SHA-256: de7cd3ca6cc0d74b9b400e294e12ee3c73f8ba8030af128753d62a88a4778c18

JBoss Enterprise Web Server 5 for RHEL 8

SRPM
jws5-tomcat-9.0.62-41.redhat_00020.1.el8jws.src.rpm SHA-256: b753648e3d03c3fbf9b146bb2e8ee35290f3d461162d23fb96b2d135e7d6212f
jws5-tomcat-native-1.2.31-17.redhat_17.el8jws.src.rpm SHA-256: 7be08b79a79198b723143cdcc48309a94f798688c892aafe4689f56831935646
x86_64
jws5-tomcat-9.0.62-41.redhat_00020.1.el8jws.noarch.rpm SHA-256: a852a084b7d31604c54758d8b076c7a3872e27e3ed3d81fcfa3b9d9ded49831c
jws5-tomcat-admin-webapps-9.0.62-41.redhat_00020.1.el8jws.noarch.rpm SHA-256: f9c99f66ff8e23157c6d412ac33a520d67d878fab570fcf36fcd8afc0d0f6ab0
jws5-tomcat-docs-webapp-9.0.62-41.redhat_00020.1.el8jws.noarch.rpm SHA-256: 076d9432123b3606ab8b442cf73e28455eec15c175ffd6ff61c74c1e79a21fa1
jws5-tomcat-el-3.0-api-9.0.62-41.redhat_00020.1.el8jws.noarch.rpm SHA-256: fa69399b8280153dae59bdd22c87e4131f8336bc6c7c925789e3367619ed59fb
jws5-tomcat-javadoc-9.0.62-41.redhat_00020.1.el8jws.noarch.rpm SHA-256: 241d94bbc72e3d0236de818fee20ffe91ed898d58c980cea761a02632ec91bc3
jws5-tomcat-jsp-2.3-api-9.0.62-41.redhat_00020.1.el8jws.noarch.rpm SHA-256: 153c804848bbed24487b3dcd79b2dc322e5714efc3e689a5edbd98c3b69b8183
jws5-tomcat-lib-9.0.62-41.redhat_00020.1.el8jws.noarch.rpm SHA-256: e446acc5a037cd37e327ae948a73c892e4817907e50760aa3c2bd5c06be57a5e
jws5-tomcat-native-1.2.31-17.redhat_17.el8jws.x86_64.rpm SHA-256: b7ec9550495e6cc552472dd0e4cb03f00bbd4f125ef9dd534d49e95d1606ad3a
jws5-tomcat-native-debuginfo-1.2.31-17.redhat_17.el8jws.x86_64.rpm SHA-256: 5f920f5dc3c7f33095898b27f73947e6e736f67af2cf615a8a986bbdb6ea66ba
jws5-tomcat-selinux-9.0.62-41.redhat_00020.1.el8jws.noarch.rpm SHA-256: bf83b8c11af2349fde33a9a7ed5b95cfbcb85e17b83ddb3d1147c3d978f1b72c
jws5-tomcat-servlet-4.0-api-9.0.62-41.redhat_00020.1.el8jws.noarch.rpm SHA-256: e2236fc0cfba9f43e8820e406573ee005fd05e46101cf7f546248bd71bd10b6f
jws5-tomcat-webapps-9.0.62-41.redhat_00020.1.el8jws.noarch.rpm SHA-256: 8a2416bf6b8d39df8c581ddc9f3ea229d3b7fe5b654a511b0ef19317cf72dfb1

JBoss Enterprise Web Server 5 for RHEL 7

SRPM
jws5-tomcat-9.0.62-41.redhat_00020.1.el7jws.src.rpm SHA-256: a56e24e16a9fc1a652c88529a36079db7e61ac860fe3cbe93f238a900a899a75
jws5-tomcat-native-1.2.31-17.redhat_17.el7jws.src.rpm SHA-256: ecd68371c9a65e7554eb6dc61866dd4f3b8c8000ae1775b7dff8a6f343dc493b
x86_64
jws5-tomcat-9.0.62-41.redhat_00020.1.el7jws.noarch.rpm SHA-256: 586d38a11738e90f20f140a69ba62782a7749585797390969d0d35129789d76e
jws5-tomcat-admin-webapps-9.0.62-41.redhat_00020.1.el7jws.noarch.rpm SHA-256: 42d36cf0c60d52fbc27e1fb7386dd23050a3779edb1663c052bb9b8fbac7e848
jws5-tomcat-docs-webapp-9.0.62-41.redhat_00020.1.el7jws.noarch.rpm SHA-256: 499416587e9a468b7530cb2c76317c68f8fffcdb8d8730994b8b04fe69e6be7e
jws5-tomcat-el-3.0-api-9.0.62-41.redhat_00020.1.el7jws.noarch.rpm SHA-256: 3e05cb420936e5a22fa219dda4277b5de9d7683a35eb7aeca6bc996f89a1883f
jws5-tomcat-java-jdk11-9.0.62-41.redhat_00020.1.el7jws.noarch.rpm SHA-256: 455b29577898ecb4029d01cbed6df57d0385c5b80e532b3b676e568d382f765a
jws5-tomcat-java-jdk8-9.0.62-41.redhat_00020.1.el7jws.noarch.rpm SHA-256: 09300adf96b0e88750111069e12a5d77865f86076aa8628116dd915278de290f
jws5-tomcat-javadoc-9.0.62-41.redhat_00020.1.el7jws.noarch.rpm SHA-256: d383887a1be809eb2c3aeab6ee70260289c7790a1c8bce8c14a1d74276c0fc06
jws5-tomcat-jsp-2.3-api-9.0.62-41.redhat_00020.1.el7jws.noarch.rpm SHA-256: d469f38139a6616289138243dd8ed19a04cbc7013e2c98e79c5f759ec7e39fe5
jws5-tomcat-lib-9.0.62-41.redhat_00020.1.el7jws.noarch.rpm SHA-256: 666570acf8c07f3e8040dee58517c5ee02fc69c88afe8a195b6b3a52fc6200ee
jws5-tomcat-native-1.2.31-17.redhat_17.el7jws.x86_64.rpm SHA-256: 4a39e7bc22e5f86ffb0532ae7bbd06bfbeab39b3a02aa32d20f4fe0532f30ef5
jws5-tomcat-native-debuginfo-1.2.31-17.redhat_17.el7jws.x86_64.rpm SHA-256: 2d07b219e539a2a7e109cb563d1fc4230615e112b99f848005d6a3439152e7f9
jws5-tomcat-selinux-9.0.62-41.redhat_00020.1.el7jws.noarch.rpm SHA-256: a0640d73f693784829f5b1941e35f9e0dec8f3dcf3e67c50d1d372cb58c8a3a0
jws5-tomcat-servlet-4.0-api-9.0.62-41.redhat_00020.1.el7jws.noarch.rpm SHA-256: 360a4ca61fce6840408c78fe540aa9e8c44cf7269da7c3e307bd699c42aff3ec
jws5-tomcat-webapps-9.0.62-41.redhat_00020.1.el7jws.noarch.rpm SHA-256: fdd00a4e2defa4214953cf96039771395d2ca23704317b2580b81609a4486334

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.