Red Hat Product Errata RHSA-2024:1324 - Security Advisory
Issued:
2024-03-18
Updated:
2024-03-19

RHSA-2024:1324 - Security Advisory

Synopsis

Important: Red Hat JBoss Web Server 6.0.1 release and security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Web Server 6.0.1 on Red Hat Enterprise Linux versions 8 and 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 6.0.1 serves as a replacement for Red Hat JBoss Web Server 6.0.0. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes linked to in the References section.

Security Fix(es):

  • tomcat: HTTP request smuggling via malformed trailer headers (CVE-2023-46589)
  • tomcat: Open Redirect vulnerability in FORM authentication (CVE-2023-41080)
  • tomcat: : Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Web Server 6 for RHEL 9 x86_64
  • JBoss Enterprise Web Server 6 for RHEL 8 x86_64

Fixes

  • BZ - 2235370 - CVE-2023-41080 tomcat: Open Redirect vulnerability in FORM authentication
  • BZ - 2252050 - CVE-2023-46589 tomcat: HTTP request smuggling via malformed trailer headers
  • BZ - 2269607 - CVE-2024-24549 : Apache Tomcat: HTTP/2 header handling DoS

JBoss Enterprise Web Server 6 for RHEL 9

SRPM
jws6-tomcat-10.1.8-6.redhat_00013.1.el9jws.src.rpm SHA-256: d6bba0cdde0ef5ddb203d7cf44c34c84624bfc26f6162161c42ab6ea404fc322
x86_64
jws6-tomcat-10.1.8-6.redhat_00013.1.el9jws.noarch.rpm SHA-256: 3f461ea87d1a79cb4f1f79c7a099eef8ac0e983182d8c1e53c613245546ecaf7
jws6-tomcat-admin-webapps-10.1.8-6.redhat_00013.1.el9jws.noarch.rpm SHA-256: cd71efaaa401525bae3fa5aa8a80ac71724f3bdec6776e9a97465096ff645c69
jws6-tomcat-docs-webapp-10.1.8-6.redhat_00013.1.el9jws.noarch.rpm SHA-256: e2c4c09df531a2b341150236167223a28a8a0cf7118548653fea84b6ebad8c1e
jws6-tomcat-el-5.0-api-10.1.8-6.redhat_00013.1.el9jws.noarch.rpm SHA-256: 79f75838a4689c736926437548c7acf5e52bc379acc97a59691b718713b6c01f
jws6-tomcat-javadoc-10.1.8-6.redhat_00013.1.el9jws.noarch.rpm SHA-256: d2fc8a91d2681a1e8ce3ef9aa0fe49de55dfa8a068f4e4bdcc232f2a665f62dd
jws6-tomcat-jsp-3.1-api-10.1.8-6.redhat_00013.1.el9jws.noarch.rpm SHA-256: 9af19f0313e5583d41792ac23b6b7a8f5bd2db70ea6e47dbccf3ffd91646f8d3
jws6-tomcat-lib-10.1.8-6.redhat_00013.1.el9jws.noarch.rpm SHA-256: 6e7f3d21ad78f42acfb2ef4b9d74fd71ac6d9be33f164ab049f6ab38963c5f8b
jws6-tomcat-selinux-10.1.8-6.redhat_00013.1.el9jws.noarch.rpm SHA-256: 8126f62a5f1f83cc4656df1b1e99dde1e87acea7fede90c965450d8993de4877
jws6-tomcat-servlet-6.0-api-10.1.8-6.redhat_00013.1.el9jws.noarch.rpm SHA-256: 862c68d73c55a25ea537648b86e3ebe7b8c0ca279ebbf6061f129f8957560c94
jws6-tomcat-webapps-10.1.8-6.redhat_00013.1.el9jws.noarch.rpm SHA-256: 102e9f86284b0587dea0fe5ef1e5342d39e5ed519ff2fe0ff02fd3887425168e

JBoss Enterprise Web Server 6 for RHEL 8

SRPM
jws6-tomcat-10.1.8-6.redhat_00013.1.el8jws.src.rpm SHA-256: 75e62d5e88d1f1e4e445b40c9a13409a1560c9f4143fc522ad088e9638756df3
x86_64
jws6-tomcat-10.1.8-6.redhat_00013.1.el8jws.noarch.rpm SHA-256: f4c2419d180a6307acdcc94c675c062833cec251cf59a9213c98fcd85f98723b
jws6-tomcat-admin-webapps-10.1.8-6.redhat_00013.1.el8jws.noarch.rpm SHA-256: b87151d1cc654bf49c0137829ef328cbd6fccf99b239c5456651126340927a77
jws6-tomcat-docs-webapp-10.1.8-6.redhat_00013.1.el8jws.noarch.rpm SHA-256: c9d79291a6c351e611f7decf59d7096504f15505029ede662bf8707172ee65f2
jws6-tomcat-el-5.0-api-10.1.8-6.redhat_00013.1.el8jws.noarch.rpm SHA-256: f443465a908de1d6c4a45a2bd2a9b61ba03d09178a021bc2fa77cc277f887b40
jws6-tomcat-javadoc-10.1.8-6.redhat_00013.1.el8jws.noarch.rpm SHA-256: 297e0d9377a4253258bef7343f2aa4a45c737165df595e09f08964f7d5c85eea
jws6-tomcat-jsp-3.1-api-10.1.8-6.redhat_00013.1.el8jws.noarch.rpm SHA-256: 9e274b0baa3704643e2a2b8da70a84f2fc343ef814cc6c9216c52997b8f6b5b1
jws6-tomcat-lib-10.1.8-6.redhat_00013.1.el8jws.noarch.rpm SHA-256: f1aa7bb003c5b083b1f35f65b0daec0667633ff2e5830d01d6f707ecef101282
jws6-tomcat-selinux-10.1.8-6.redhat_00013.1.el8jws.noarch.rpm SHA-256: ee2f56120112f1799fcbe8d723eeeaba6bb036d58cab3d6c67655ca1ef117e19
jws6-tomcat-servlet-6.0-api-10.1.8-6.redhat_00013.1.el8jws.noarch.rpm SHA-256: 4b8d9c9569b16138f240620c4c9c75c5ff04e287286cfc9836e839e3d32ad013
jws6-tomcat-webapps-10.1.8-6.redhat_00013.1.el8jws.noarch.rpm SHA-256: 31b3f84ed7b6be85e1ad7d4052e50bf03b79a05c8ffe90efcbca16cace0e3105

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.