Red Hat Product Errata RHSA-2024:4976 - Security Advisory
Issued:
2024-08-06
Updated:
2024-10-01

RHSA-2024:4976 - Security Advisory

Synopsis

Important: Red Hat JBoss Web Server 6.0.3 release and security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Web Server 6.0.3 on Red Hat Enterprise Linux versions 8 and 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 6.0.3 serves as a replacement for Red Hat JBoss Web Server 6.0.2. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.

Security Fix(es):

  • jws6-tomcat: Improper Handling of Exceptional Conditions (CVE-2024-34750)
  • jws6-tomcat: Denial of Service in Tomcat (CVE-2024-38286)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Web Server 6 for RHEL 9 x86_64
  • JBoss Enterprise Web Server 6 for RHEL 8 x86_64

Fixes

  • BZ - 2295651 - CVE-2024-34750 tomcat: Improper Handling of Exceptional Conditions
  • BZ - 2314686 - CVE-2024-38286 tomcat: Denial of Service in Tomcat

JBoss Enterprise Web Server 6 for RHEL 9

SRPM
jws6-tomcat-10.1.8-10.redhat_00018.1.el9jws.src.rpm SHA-256: 9951cd5907e68d737c56698041046a70f77a8da8389bcaec429605450bee8c8c
x86_64
jws6-tomcat-10.1.8-10.redhat_00018.1.el9jws.noarch.rpm SHA-256: 905b13a51590db4714b0557919f1ec90f9e26fd452e1dd7a9bf7fc582fa36aad
jws6-tomcat-admin-webapps-10.1.8-10.redhat_00018.1.el9jws.noarch.rpm SHA-256: 9d829665c7eb482ed66d5e25cc16e6876d772ff9820cfe7237cbef4debab517b
jws6-tomcat-docs-webapp-10.1.8-10.redhat_00018.1.el9jws.noarch.rpm SHA-256: 93346755a01236855dd41708b2e77f9e60101d491372b938d439a2eafe3420fd
jws6-tomcat-el-5.0-api-10.1.8-10.redhat_00018.1.el9jws.noarch.rpm SHA-256: 7bbfafe40dfd2bb97940a7c1d0a2872c1c532ccbeb942aca3b4fe997cc9176ab
jws6-tomcat-javadoc-10.1.8-10.redhat_00018.1.el9jws.noarch.rpm SHA-256: 934d0c85497e00bad64842db1e7be2e2b75019a8dd77c58563f5651ca6baa40d
jws6-tomcat-jsp-3.1-api-10.1.8-10.redhat_00018.1.el9jws.noarch.rpm SHA-256: 002d6c4a84d9257acaaa0ce0932e532b89c955b496f475ec38d2dac9d0d5d50a
jws6-tomcat-lib-10.1.8-10.redhat_00018.1.el9jws.noarch.rpm SHA-256: f01fe4624c1c741dceebcc9ee955d6fa4a558fa5a65fa414925510dddb146e35
jws6-tomcat-selinux-10.1.8-10.redhat_00018.1.el9jws.noarch.rpm SHA-256: 9c9579d43392d5224dcb4a4c729ca830038e2040f4051f8c571390095210adf3
jws6-tomcat-servlet-6.0-api-10.1.8-10.redhat_00018.1.el9jws.noarch.rpm SHA-256: 668620919f651b872b901ffd5a268f0296a6627e1d2e54c08b9c80a48b0cde51
jws6-tomcat-webapps-10.1.8-10.redhat_00018.1.el9jws.noarch.rpm SHA-256: 3193a50612718374ce89f559d11f25bf90c69690a5f9ec4fea8c9adf4e632a48

JBoss Enterprise Web Server 6 for RHEL 8

SRPM
jws6-tomcat-10.1.8-10.redhat_00018.1.el8jws.src.rpm SHA-256: c0aaec220d2bf400e6ff19424d1b8fca5c39d21d67cd1d2b778d8ec3be5dc77b
x86_64
jws6-tomcat-10.1.8-10.redhat_00018.1.el8jws.noarch.rpm SHA-256: a6fb8b319f247e529288050cd473f493169793c74d05135a1f151ca6d7df82b6
jws6-tomcat-admin-webapps-10.1.8-10.redhat_00018.1.el8jws.noarch.rpm SHA-256: 9fe9779e5cc94b38e722af2069372a5d6afef98c337b096c337901c19b67eccf
jws6-tomcat-docs-webapp-10.1.8-10.redhat_00018.1.el8jws.noarch.rpm SHA-256: cf4ad201f28c21a14fec29cbe38d1789fd610160b182135fb45b08adf984f604
jws6-tomcat-el-5.0-api-10.1.8-10.redhat_00018.1.el8jws.noarch.rpm SHA-256: 8ea58461cf6882c278664675c722c71bafaf00d0d4ac8ecf0363ea70245f7a7f
jws6-tomcat-javadoc-10.1.8-10.redhat_00018.1.el8jws.noarch.rpm SHA-256: 72c66a82eebcb0d0da6a1406ba6e4247d95c30346082a0e4070cae3116a1acfa
jws6-tomcat-jsp-3.1-api-10.1.8-10.redhat_00018.1.el8jws.noarch.rpm SHA-256: 7df455d1749998de73539a1995d921b776f1e73ea3cc0c915e05ea8f1c82f4ab
jws6-tomcat-lib-10.1.8-10.redhat_00018.1.el8jws.noarch.rpm SHA-256: 93cebec1b1d4899f3ab7b959295e59911ec1044b5ec4e325afefd30f8f7b09e6
jws6-tomcat-selinux-10.1.8-10.redhat_00018.1.el8jws.noarch.rpm SHA-256: ac2929d11830ea05c510453c692254ba1fc66c95490fb7f38351791f4947cb93
jws6-tomcat-servlet-6.0-api-10.1.8-10.redhat_00018.1.el8jws.noarch.rpm SHA-256: 8679e4a782e7c1609c581b861762882d7af3a8b8536a28ca31beac045990acf1
jws6-tomcat-webapps-10.1.8-10.redhat_00018.1.el8jws.noarch.rpm SHA-256: 10d35cf601168ce99f285659bc4ca4260081ebdddc3edc66b977adffa0fb6204

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.