Red Hat Product Errata RHSA-2024:2693 - Security Advisory
Issued:
2024-05-07
Updated:
2024-05-07

RHSA-2024:2693 - Security Advisory

Synopsis

Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4 security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Red Hat JBoss Core Services Apache HTTP Server 2.4.57 Service Pack 4 is now available.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products and packaged under Red Hat JBoss Core Services, to allow for faster distribution of updates and for a more consistent update experience.

This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.57 Service Pack 4 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.57 Service Pack 3, and includes bug fixes and enhancements, which are documented in the Release Notes linked to in the References section.

Security Fix(es):

  • curl: Usage of disabled protocol (CVE-2024-2004)
  • curl: QUIC certificate check bypass with wolfSSL (CVE-2024-2379)
  • curl: HTTP/2 push headers memory-leak (CVE-2024-2398)
  • curl: TLS certificate check bypass with mbedTLS (CVE-2024-2466)
  • jbcs-httpd24-httpd: httpd: CONTINUATION frames DoS (CVE-2024-27316)
  • jbcs-httpd24-mod_http2: httpd: CONTINUATION frames DoS (CVE-2024-27316)
  • jbcs-httpd24-nghttp2: httpd: CONTINUATION frames DoS (CVE-2024-27316)
  • jbcs-httpd24-nghttp2: nghttp2: CONTINUATION frames DoS (CVE-2024-28182)

A Red Hat Security Bulletin which addresses further details about this flaw is available in the References section.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat JBoss Core Services 1 for RHEL 8 x86_64
  • Red Hat JBoss Core Services 1 for RHEL 7 x86_64

Fixes

  • BZ - 2268277 - CVE-2024-27316 httpd: CONTINUATION frames DoS
  • BZ - 2268639 - CVE-2024-28182 nghttp2: CONTINUATION frames DoS
  • BZ - 2270497 - CVE-2024-2466 curl: TLS certificate check bypass with mbedTLS
  • BZ - 2270498 - CVE-2024-2398 curl: HTTP/2 push headers memory-leak
  • BZ - 2270499 - CVE-2024-2379 curl: QUIC certificate check bypass with wolfSSL
  • BZ - 2270500 - CVE-2024-2004 curl: Usage of disabled protocol

Red Hat JBoss Core Services 1 for RHEL 8

SRPM
jbcs-httpd24-curl-8.7.1-2.el8jbcs.src.rpm SHA-256: 5131553e5568a2899844b46c7c842982abd05131e6b9d15738d460e1a46c7606
jbcs-httpd24-httpd-2.4.57-10.el8jbcs.src.rpm SHA-256: d6f3e94815f534ffec716d5431e032710e3d47d4284473796671a323e568c2f5
jbcs-httpd24-mod_http2-1.15.19-37.el8jbcs.src.rpm SHA-256: 3815abc47e20bf0e07d57b8172337d14ae1f11071290ade6ff7c1947c440700f
jbcs-httpd24-mod_jk-1.2.49-6.redhat_1.el8jbcs.src.rpm SHA-256: 081a1c972397ab7a317dabc0e1fb6edd7940bd8a5164478ab45ed9e37fa5aa5d
jbcs-httpd24-mod_md-2.4.24-6.el8jbcs.src.rpm SHA-256: c4cfdf5b48abeb781fbb54acb0cbcb0118dccf021cbcb26ac91392cd2938ebb6
jbcs-httpd24-mod_proxy_cluster-1.3.20-4.el8jbcs.src.rpm SHA-256: bd92102b857b1b9b47263a41e0473bcdcecb3af1fb36c23a5570a3200636a125
jbcs-httpd24-mod_security-2.9.3-36.el8jbcs.src.rpm SHA-256: b42bfd1aaf3582d84a84d7850d319f3a39daac3a8dc27e2a118a093e6426668d
jbcs-httpd24-nghttp2-1.43.0-13.el8jbcs.src.rpm SHA-256: 9553b3d184ae65820ca82129a7e2a730a2614629b491e312ce1019574c3907ce
x86_64
jbcs-httpd24-curl-8.7.1-2.el8jbcs.x86_64.rpm SHA-256: ca0ce1624dd3a2a1ab8a2b7c0680323b001f303e79227741511b7305300f9360
jbcs-httpd24-curl-debuginfo-8.7.1-2.el8jbcs.x86_64.rpm SHA-256: 2a0968ea3d5bb49d75a39a8d9ff05167d14a6e6b426ae439bd9f8e6fdf808b23
jbcs-httpd24-httpd-2.4.57-10.el8jbcs.x86_64.rpm SHA-256: a77b6a808f790a563ecdd6493c28143cadb99a6b439ae5fa42e6d9f28130415d
jbcs-httpd24-httpd-debuginfo-2.4.57-10.el8jbcs.x86_64.rpm SHA-256: ad725bd0754ba7f4aa5907db6af271c6c736953cb6c9e950223249526a779b87
jbcs-httpd24-httpd-devel-2.4.57-10.el8jbcs.x86_64.rpm SHA-256: 00c64ffa8c2167dc258f186e85eb21056fbfab87723b154b78ed33da73079ace
jbcs-httpd24-httpd-manual-2.4.57-10.el8jbcs.noarch.rpm SHA-256: 64af7411c9dc84f81967bd8a67cc4b636b9560f959bb4a4c466e161129d9ad64
jbcs-httpd24-httpd-selinux-2.4.57-10.el8jbcs.x86_64.rpm SHA-256: e74e44f625051a093121986ffece447de3919d9ea9839b4582add90037706be4
jbcs-httpd24-httpd-tools-2.4.57-10.el8jbcs.x86_64.rpm SHA-256: 112f783194b77a7edc0ae5e22d6fcc9372970b2cad5657b0555bfbafc5d5f036
jbcs-httpd24-httpd-tools-debuginfo-2.4.57-10.el8jbcs.x86_64.rpm SHA-256: abaac4668c98aaaa599881292b68dd1f403afd9e0bd175371024287081769c91
jbcs-httpd24-libcurl-8.7.1-2.el8jbcs.x86_64.rpm SHA-256: 6b80a0a6b37cb8c47391db4d04963e12799a66825f8cee38b8ff0daea163bfcf
jbcs-httpd24-libcurl-debuginfo-8.7.1-2.el8jbcs.x86_64.rpm SHA-256: 9834279f69d460555a80ab1783997d333d1756e1baf8cc7978d8dd0d4fa38384
jbcs-httpd24-libcurl-devel-8.7.1-2.el8jbcs.x86_64.rpm SHA-256: 769e7782eeaafdff75e73b48007efa8018c25825d36a74cb286b5a025db537f4
jbcs-httpd24-mod_http2-1.15.19-37.el8jbcs.x86_64.rpm SHA-256: 738fcb5fe7f9ae298639891e4359f99a012facc09497b6e90cdafe63a28b1cf9
jbcs-httpd24-mod_http2-debuginfo-1.15.19-37.el8jbcs.x86_64.rpm SHA-256: afc6124bd2f0131eb6ed607f05ad46b894ae2d274896254d55e6a5a778e02294
jbcs-httpd24-mod_jk-ap24-1.2.49-6.redhat_1.el8jbcs.x86_64.rpm SHA-256: 39679d02eaf822237d8563f517c725bdb214c27765361bd43027733e72262968
jbcs-httpd24-mod_jk-ap24-debuginfo-1.2.49-6.redhat_1.el8jbcs.x86_64.rpm SHA-256: 665dc2e35eac339faa7edaaf7f53e114af918ebb8128910651ccaa9343cae565
jbcs-httpd24-mod_ldap-2.4.57-10.el8jbcs.x86_64.rpm SHA-256: dd909f386cf06f87765b238adbe9ab6077d3bfc5a7badebc9575aa4e059275d3
jbcs-httpd24-mod_ldap-debuginfo-2.4.57-10.el8jbcs.x86_64.rpm SHA-256: b9154de38082443cfa178f936f31574fbb23e72f842dd0588f3b37e059e5c6bf
jbcs-httpd24-mod_md-2.4.24-6.el8jbcs.x86_64.rpm SHA-256: 9fda097547e74e463ae3221112b345a8a484bbd8a17ccb470ba3a50ff4a15f1a
jbcs-httpd24-mod_md-debuginfo-2.4.24-6.el8jbcs.x86_64.rpm SHA-256: 1de68e3d521403ec86c9ac2af52f7ee90bd02db3cb03f7fc34d61de6fb133104
jbcs-httpd24-mod_proxy_cluster-1.3.20-4.el8jbcs.x86_64.rpm SHA-256: aa50f87da09d2b0e84118ffbc4b9bff86f282696aef9b96b45529af3b16fc92d
jbcs-httpd24-mod_proxy_cluster-debuginfo-1.3.20-4.el8jbcs.x86_64.rpm SHA-256: a217c4dc3c9fbdd8477b592b4b5ad9709d25c6c78a57f6c0e2818552c4c40519
jbcs-httpd24-mod_proxy_html-2.4.57-10.el8jbcs.x86_64.rpm SHA-256: f11c49e9f982405e3eaca419dbe6e67055345116ca59b77b1f888cce5dfd7e1e
jbcs-httpd24-mod_proxy_html-debuginfo-2.4.57-10.el8jbcs.x86_64.rpm SHA-256: 428744f8ad604dc10ffc9e0c07b12e1a0078a5a544788b421df04f9b7e2ad8f2
jbcs-httpd24-mod_security-2.9.3-36.el8jbcs.x86_64.rpm SHA-256: 34f2c28ffdd8d08b040c4382cc8b16a59e061014c2c0f8ab6589d17a9c6845b1
jbcs-httpd24-mod_security-debuginfo-2.9.3-36.el8jbcs.x86_64.rpm SHA-256: 91cb2ff4a9fb6b3ea8b900b1c88ca9b3e58b77bd68507492c78d068dd7d68751
jbcs-httpd24-mod_session-2.4.57-10.el8jbcs.x86_64.rpm SHA-256: 0a3fa42021826c96ae2fcec098c4fb499d69017bad2e130500354de9a9577194
jbcs-httpd24-mod_session-debuginfo-2.4.57-10.el8jbcs.x86_64.rpm SHA-256: 18e987f3373e9e48b317c8273be073708690b08861e3f1aa9e9823532f6d42d5
jbcs-httpd24-mod_ssl-2.4.57-10.el8jbcs.x86_64.rpm SHA-256: cdc4b5cec821d480db14a5b9fa544fe9161618cc68eeb5138c16416ccb18a04f
jbcs-httpd24-mod_ssl-debuginfo-2.4.57-10.el8jbcs.x86_64.rpm SHA-256: 934c204fa52d4ac5f91221c25f5f5e187650b549a3b9a68b376bc6f6cf675ab4
jbcs-httpd24-nghttp2-1.43.0-13.el8jbcs.x86_64.rpm SHA-256: 420f75cb5559c8298613a8e1013aeffdfe080a7ddca720af93cd4709eed772b4
jbcs-httpd24-nghttp2-debuginfo-1.43.0-13.el8jbcs.x86_64.rpm SHA-256: 6ffdf3dac1e04856c9744eeed1042a5cd1f04f896e4724cc107216d13033e509
jbcs-httpd24-nghttp2-devel-1.43.0-13.el8jbcs.x86_64.rpm SHA-256: 7a3b431d5d0bb972ffeee5f8552f9eb9ecee50c6321a7ba268bb18e3c8e3659c

Red Hat JBoss Core Services 1 for RHEL 7

SRPM
jbcs-httpd24-curl-8.7.1-2.el7jbcs.src.rpm SHA-256: ad0b6ba417b84768f1ac94133030ec9bf740f8ddc0008617e464464ba05ec980
jbcs-httpd24-httpd-2.4.57-10.el7jbcs.src.rpm SHA-256: d8548bebdd22079eaf321b26f4c2025811445aa504a2333b5ebb6b9375f64383
jbcs-httpd24-mod_http2-1.15.19-37.el7jbcs.src.rpm SHA-256: 63ea88328fc6e8c59c99adcce65698f7d16ffa48b4d298916b8f15754dcdced8
jbcs-httpd24-mod_jk-1.2.49-6.redhat_1.el7jbcs.src.rpm SHA-256: 7be69f437ca378afe46319921a30428baf7d4585c16319cd305261cf7990d2f1
jbcs-httpd24-mod_md-2.4.24-6.el7jbcs.src.rpm SHA-256: 820d436d113cd8ea5c32ffd78ea9aff272df485be488daa855b406012ec94c70
jbcs-httpd24-mod_proxy_cluster-1.3.20-4.el7jbcs.src.rpm SHA-256: 343b1089e2d108c31483d9681be151164548603be7c7cdb429299e174f734e26
jbcs-httpd24-mod_security-2.9.3-36.el7jbcs.src.rpm SHA-256: 2ee651a900b92f555c7bcf7a8677423d20746b8833615118d39a8424743e16ef
jbcs-httpd24-nghttp2-1.43.0-13.el7jbcs.src.rpm SHA-256: 16d890cfc6b2274022b2e56893537a8068811f1dfef5c297bd921a594bf87d75
x86_64
jbcs-httpd24-curl-8.7.1-2.el7jbcs.x86_64.rpm SHA-256: 4e968fd7d087000ab11c720f80897a3a1fd516c21821edeca8b5e40f3b723751
jbcs-httpd24-curl-debuginfo-8.7.1-2.el7jbcs.x86_64.rpm SHA-256: d1367d1f91bec417a018ccd64af49de8061d7abe0a9d2c95f6ea19a1929e1e5c
jbcs-httpd24-httpd-2.4.57-10.el7jbcs.x86_64.rpm SHA-256: 18570950132fa7566f2f2a25406af4d50229c109b3f028a69a461ecf542b2316
jbcs-httpd24-httpd-debuginfo-2.4.57-10.el7jbcs.x86_64.rpm SHA-256: 90d2d336401cac19ef91dcd52e5da8543dbae02cc2ddce449b2ecb359ef3beae
jbcs-httpd24-httpd-devel-2.4.57-10.el7jbcs.x86_64.rpm SHA-256: cc2fdbdd47ef05768dcd62295151841316370a051a63492bfc0e485f321e5cc0
jbcs-httpd24-httpd-manual-2.4.57-10.el7jbcs.noarch.rpm SHA-256: d43adc105e5a6a98a2c3c486338986d07757a03fd2bf7614377a37271938d011
jbcs-httpd24-httpd-selinux-2.4.57-10.el7jbcs.x86_64.rpm SHA-256: d33ab662a3cb55630e56708619cd956b911eda7fdfefe1d08436fe7a14470172
jbcs-httpd24-httpd-tools-2.4.57-10.el7jbcs.x86_64.rpm SHA-256: 275fcfba1a0101afa5a43c1ec16fe0aa276b9a31869fa04d7dbc20ab95bea7d2
jbcs-httpd24-libcurl-8.7.1-2.el7jbcs.x86_64.rpm SHA-256: 76dbd73c885306b4e9d60f093aac5dbd43f59d4b823e499efb454d838e85418f
jbcs-httpd24-libcurl-devel-8.7.1-2.el7jbcs.x86_64.rpm SHA-256: 16da241b11c7f22c35422728abf2c765769a469ca3a355f2177e53c0d8da068e
jbcs-httpd24-mod_http2-1.15.19-37.el7jbcs.x86_64.rpm SHA-256: ea99077d0f7a5b3a27706c4a30af0cbac15248d34cd5544ea9995e07b5139569
jbcs-httpd24-mod_http2-debuginfo-1.15.19-37.el7jbcs.x86_64.rpm SHA-256: ddb8d0d320ba7884eb8672941e00b17ab763e3afc9de5cf9cc1a89995f95b621
jbcs-httpd24-mod_jk-ap24-1.2.49-6.redhat_1.el7jbcs.x86_64.rpm SHA-256: 578f7acd750d73fc2ebbde3b6f3fc6a3f5675528b131e2e794579b7aa9452f03
jbcs-httpd24-mod_jk-debuginfo-1.2.49-6.redhat_1.el7jbcs.x86_64.rpm SHA-256: 915ff7770c7918e84947d5c543f049197c5497db548e1eb13f67a88b117810a2
jbcs-httpd24-mod_ldap-2.4.57-10.el7jbcs.x86_64.rpm SHA-256: 07555c948719be70e958f565f26a97c188be7a6f178f163eb62faa4861db157b
jbcs-httpd24-mod_md-2.4.24-6.el7jbcs.x86_64.rpm SHA-256: db01542185c39722f7a1716a0d9e602e8104e79f2e69865294db9153300a4b0b
jbcs-httpd24-mod_md-debuginfo-2.4.24-6.el7jbcs.x86_64.rpm SHA-256: 7930573cf9e462c37be671b59c54ff5b3a1322f76e74520f21d1fed0fbfa5fba
jbcs-httpd24-mod_proxy_cluster-1.3.20-4.el7jbcs.x86_64.rpm SHA-256: 5f25f7c74992f326fa8f28af0455eeda4869cf7eb92dcd98e0c66c90eaad78fa
jbcs-httpd24-mod_proxy_cluster-debuginfo-1.3.20-4.el7jbcs.x86_64.rpm SHA-256: 23fab3e58f13f7c66641e6a6e663adb71d98073ec91086df01d7ab844505a816
jbcs-httpd24-mod_proxy_html-2.4.57-10.el7jbcs.x86_64.rpm SHA-256: 3e1c32b0931af9112586925b768f09be892c53f0f5616224ca8caef01819cbd1
jbcs-httpd24-mod_security-2.9.3-36.el7jbcs.x86_64.rpm SHA-256: f5876b9286370f32442870b9fd397861ee2ba1b2d4b2e59978a5cfc27067b91d
jbcs-httpd24-mod_security-debuginfo-2.9.3-36.el7jbcs.x86_64.rpm SHA-256: 70cf42706a9856bb4f029533d52b11b0690c28a32ab11a0c4779f4df70d0a6d0
jbcs-httpd24-mod_session-2.4.57-10.el7jbcs.x86_64.rpm SHA-256: 2f68f04dd70675f290d07be03caeea833e6c9acce983a6d146ec6d7981c42ceb
jbcs-httpd24-mod_ssl-2.4.57-10.el7jbcs.x86_64.rpm SHA-256: 282016071412329836d4e837849b56dd3b0a61d5638b7cd29767d382f65bbf09
jbcs-httpd24-nghttp2-1.43.0-13.el7jbcs.x86_64.rpm SHA-256: 6d04722b4c4141de406dc96c7eaf93a6c027f36a8febfd1abf4a35873f03f9ac
jbcs-httpd24-nghttp2-debuginfo-1.43.0-13.el7jbcs.x86_64.rpm SHA-256: b6ecc4c20d7e4d31d9298b1431edb8393af37a2b08d78a63f168b93ff3a2d845
jbcs-httpd24-nghttp2-devel-1.43.0-13.el7jbcs.x86_64.rpm SHA-256: 446d6683f8eb4051b3cb8b73a74e8434254175c27f80c6e033620d0d8eb0abac

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.