Red Hat Security Advisory

RHSA-2017:2494

Red Hat JBoss Web Server 2 security update

Released 2017-08-21 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Web Server 2.1

Fixes 4 records

TI-2016-05397 CVE-2016-6304 · GHSA-7c6f-r892-6p89

Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and…

HIGH 68

Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.63029 Published 2016-09-26 Partial fix CWE-401

TI-2016-07072 CVE-2016-8610 · GHSA-v2q2-jxh8-m5h8

Uncontrolled resource consumption in OpenSSL

MEDIUM 60

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.39919 Published 2017-11-13 Partial fix CWE-400

TI-2017-03664 CVE-2017-5664 · GHSA-jmvv-524f-hj5j

Improper handling of exceptional conditions in Apache Tomcat

MEDIUM 56

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error pag…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.16567 Published 2017-06-06 Partial fix · 9.0.0.M21, 8.5.15 +2 CWE-755

TI-2017-03647 CVE-2017-5647 · GHSA-3gv7-3h64-78cm

Information disclosure in Apache Tomcat

MEDIUM 50

A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined reques…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.1684 Published 2017-04-17 Partial fix · 9.0.0.M19, 8.5.13 +3 CWE-200