Red Hat Security AdvisoryRHSA-2017:3240
Red Hat JBoss Enterprise Application Platform 6.4.18 security update
Released 2017-11-16 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server httpd-2.2.26-57.ep6.el6, httpd-2.2.26-57.ep6.el6.i386, httpd-devel-2.2.26-57.ep6.el6 +16
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server httpd22-2.2.26-58.ep6.el7, httpd22-devel-2.2.26-58.ep6.el7, httpd22-manual-2.2.26-58.ep6.el7 +9
Fixes 3 records
Priority HIGH 83
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obt…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.94697 · Published 2016-09-01 · Partial fix CWE-200
Priority HIGH 77
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.94651 · Published 2017-09-18 · Partial fix CWE-416
Priority HIGH 73
In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_d…
CVSS 3.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.5677 · Published 2017-07-13 · Partial fix CWE-20