Red Hat Security AdvisoryRHSA-2018:2469
Red Hat JBoss Web Server 3.1.0 Service Pack 4 security and bug fix update
Released 2018-08-16 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Web Server 3.1 for RHEL 6 tomcat-native-1.2.17-17.redhat_17.ep7.el6, tomcat7-7.0.70-27.ep7.el6, tomcat7-admin-webapps-7.0.70-27.ep7.el6 +22
- Red Hat JBoss Web Server 3.1 for RHEL 7 tomcat-native-1.2.17-17.redhat_17.ep7.el7, tomcat7-7.0.70-27.ep7.el7, tomcat7-admin-webapps-7.0.70-27.ep7.el7 +22
Fixes 3 records
Priority MEDIUM 61
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.20942 · Published 2018-05-16 · Partial fix · 9.0.9, 8.5.32 +2 CWE-1188
Priority LOW 39
Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate statuses.
CVSS 3.0HIGH 7.4· Network · No auth · No interaction · EPSS 0.0418 · Published 2018-07-31 · Partial fix CWE-295
Priority LOW 39
When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses.
CVSS 3.0HIGH 7.4· Network · No auth · No interaction · EPSS 0.0405 · Published 2018-07-31 · Partial fix CWE-295
