Red Hat Product Errata RHSA-2024:5024 - Security Advisory
Issued:
2024-08-06
Updated:
2024-10-01

RHSA-2024:5024 - Security Advisory

Synopsis

Important: Red Hat JBoss Web Server 5.8.1 release and security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Web Server 5.8 on Red Hat Enterprise Linux versions 7, 8, and 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 5.8.1 serves as a replacement for Red Hat JBoss Web Server 5.8.0. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.

Security Fix(es):

  • jws5-tomcat: Improper Handling of Exceptional Conditions (CVE-2024-34750)
  • jws5-tomcat: Denial of Service in Tomcat (CVE-2024-38286)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Web Server 5 for RHEL 9 x86_64
  • JBoss Enterprise Web Server 5 for RHEL 8 x86_64
  • JBoss Enterprise Web Server 5 for RHEL 7 x86_64

Fixes

  • BZ - 2295651 - CVE-2024-34750 tomcat: Improper Handling of Exceptional Conditions
  • BZ - 2314686 - CVE-2024-38286 tomcat: Denial of Service in Tomcat

JBoss Enterprise Web Server 5 for RHEL 9

SRPM
jws5-tomcat-9.0.87-5.redhat_00005.1.el9jws.src.rpm SHA-256: a887f7088614334317e7df50da276dc41605179a6b802475b144bf02b5bb6def
x86_64
jws5-tomcat-9.0.87-5.redhat_00005.1.el9jws.noarch.rpm SHA-256: 13e2ac11455d4b20a487ecae027ac9a15d7da29906334e88ba329487efec0903
jws5-tomcat-admin-webapps-9.0.87-5.redhat_00005.1.el9jws.noarch.rpm SHA-256: 4ae3a1365e896fb6e7809bed66987b59fc15ee225aa5ef03b0bc18cbdd006fca
jws5-tomcat-docs-webapp-9.0.87-5.redhat_00005.1.el9jws.noarch.rpm SHA-256: 15b711a453e85c0c12d57330ce708e46019ce15b010808d62d4b3723e41b267a
jws5-tomcat-el-3.0-api-9.0.87-5.redhat_00005.1.el9jws.noarch.rpm SHA-256: 6e3a640b90177b7934030408c5d4f4f671afdd75d52c812e90f1d0bbca73049c
jws5-tomcat-javadoc-9.0.87-5.redhat_00005.1.el9jws.noarch.rpm SHA-256: ac42477fda098b99fdf50a1607a6372b2485535d7c898e06e61f9735e4cfd5a5
jws5-tomcat-jsp-2.3-api-9.0.87-5.redhat_00005.1.el9jws.noarch.rpm SHA-256: 700f9c4b4ab9f5067ed2e52c4cc3a42cb4b0f97452b067b30e5694bc6ffedd5c
jws5-tomcat-lib-9.0.87-5.redhat_00005.1.el9jws.noarch.rpm SHA-256: 58d0385fdb6f14cc9fcab0474b819e961fc8a27573fbf32da73704ed7b9048c8
jws5-tomcat-selinux-9.0.87-5.redhat_00005.1.el9jws.noarch.rpm SHA-256: 9697bc856195ebdb5053815998e20e28e15ba64bfaccad0516afd7f035cb65fe
jws5-tomcat-servlet-4.0-api-9.0.87-5.redhat_00005.1.el9jws.noarch.rpm SHA-256: b8c1105f854feff2c5473343ff7ec6fbaa1fd9520869ad440bca4667f7734313
jws5-tomcat-webapps-9.0.87-5.redhat_00005.1.el9jws.noarch.rpm SHA-256: df330f48dc25cecbd0972ea51ee984853e1472d12778e620d8d153cd11c8cbf5

JBoss Enterprise Web Server 5 for RHEL 8

SRPM
jws5-tomcat-9.0.87-5.redhat_00005.1.el8jws.src.rpm SHA-256: 57125114a7195559a4063fc8ac51af266cce8fef155ca371a13dd20ab5ac0bb9
x86_64
jws5-tomcat-9.0.87-5.redhat_00005.1.el8jws.noarch.rpm SHA-256: 99fb4e884524c3442a5be65d29f38faf3e89b6389e83903a83d9f969f6125b99
jws5-tomcat-admin-webapps-9.0.87-5.redhat_00005.1.el8jws.noarch.rpm SHA-256: 19f52f3c12333873181b673d04912321ab32e3dd438a29b974def34fdeaa046e
jws5-tomcat-docs-webapp-9.0.87-5.redhat_00005.1.el8jws.noarch.rpm SHA-256: dc6d432ff9ff6e5fae11514bf1c2d9e5ec7c52c96b8f39be38135d34e78e97ee
jws5-tomcat-el-3.0-api-9.0.87-5.redhat_00005.1.el8jws.noarch.rpm SHA-256: d67a1b62a63f820626454573d0c0ccca89c7595bd1c92d91a29b09ae743bb2bb
jws5-tomcat-javadoc-9.0.87-5.redhat_00005.1.el8jws.noarch.rpm SHA-256: a137030d8896ce3fb473508b0acbc16b64d02d9c2478b01fddd8ee422dab2557
jws5-tomcat-jsp-2.3-api-9.0.87-5.redhat_00005.1.el8jws.noarch.rpm SHA-256: 2f2e5d2e22c7cf9012a65d09f43c5a20d6b6fe6fc6c5ec17effe37af4540d63c
jws5-tomcat-lib-9.0.87-5.redhat_00005.1.el8jws.noarch.rpm SHA-256: 9959e7ab614689510904444a47994d433f2004683fe0477d871ba2f7889b05c8
jws5-tomcat-selinux-9.0.87-5.redhat_00005.1.el8jws.noarch.rpm SHA-256: 1da2f3ba0bf9d68921212aa4f1bac3ab5b65d05c7b84e60d8409787d5fe93861
jws5-tomcat-servlet-4.0-api-9.0.87-5.redhat_00005.1.el8jws.noarch.rpm SHA-256: 7bfd8669454ea482865d54edd836d8aa64d852de27895da6b513aa649632666c
jws5-tomcat-webapps-9.0.87-5.redhat_00005.1.el8jws.noarch.rpm SHA-256: 2073556f37f99dc056a9f979ae8eeff1b16cbdf418224e70f08604624f858cc0

JBoss Enterprise Web Server 5 for RHEL 7

SRPM
jws5-tomcat-9.0.87-5.redhat_00005.1.el7jws.src.rpm SHA-256: 749d370b0bc1c5e5a56e4af12356a9718d34e12230656234dabcdd0852de74ab
x86_64
jws5-tomcat-9.0.87-5.redhat_00005.1.el7jws.noarch.rpm SHA-256: 267d88c3b0f5d16b5da5783276633da79450d40cdf88a5a9a8c3c3c362f59a26
jws5-tomcat-admin-webapps-9.0.87-5.redhat_00005.1.el7jws.noarch.rpm SHA-256: b8393efc70ac8c602f8377b6ea5d6ef0edc8f88e46d1ca936e5499fcc9f7694d
jws5-tomcat-docs-webapp-9.0.87-5.redhat_00005.1.el7jws.noarch.rpm SHA-256: 02a36ec1d5ccbd34b9376f34eeb0d2c735f7e8d07c24a7ff597d064f38a714ec
jws5-tomcat-el-3.0-api-9.0.87-5.redhat_00005.1.el7jws.noarch.rpm SHA-256: 49155009eeb1c38ee31f4bab7b858ef67ee28d4d31d50c2a31efe99d6673da3b
jws5-tomcat-java-jdk11-9.0.87-5.redhat_00005.1.el7jws.noarch.rpm SHA-256: 123b9db9a86d679b6f4c939b97c049232912302eabd2e96b2ff95ae483a462c9
jws5-tomcat-java-jdk8-9.0.87-5.redhat_00005.1.el7jws.noarch.rpm SHA-256: 34b6b4f21160681b37feb69a777bf48cd084f49b2c95ae5cbc139e1ef8209f86
jws5-tomcat-javadoc-9.0.87-5.redhat_00005.1.el7jws.noarch.rpm SHA-256: 55bc961e7142ceda3df6116a67f053113b90db418c49c25976b10bba4a577ee8
jws5-tomcat-jsp-2.3-api-9.0.87-5.redhat_00005.1.el7jws.noarch.rpm SHA-256: f42fea91caefac2a65df71ea078c5d336998ea55baa059d97fedc230898e5969
jws5-tomcat-lib-9.0.87-5.redhat_00005.1.el7jws.noarch.rpm SHA-256: f0aca71d7c093e071b8f46f5194aad879af9bed19468300bcb18cb682bfc017e
jws5-tomcat-selinux-9.0.87-5.redhat_00005.1.el7jws.noarch.rpm SHA-256: 179151d951bb826ed0d627c2cd79fa9b5a956437fd7c8fcf920ccf10ca0598bc
jws5-tomcat-servlet-4.0-api-9.0.87-5.redhat_00005.1.el7jws.noarch.rpm SHA-256: 27692fd9540e36bac5f8c92e8066083fb1c43a8610d4e4d56fe031b89450fe82
jws5-tomcat-webapps-9.0.87-5.redhat_00005.1.el7jws.noarch.rpm SHA-256: 1b2260d5cba1cce7e475eb3b4d577141d505ea04e6d6a1b4725faa2d4b2451bb

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.