Red Hat Security AdvisoryRHSA-2019:2946
Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP3 security update
Released 2019-10-01 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-httpd-2.4.29-41.jbcs.el6, jbcs-httpd24-httpd-devel-2.4.29-41.jbcs.el6, jbcs-httpd24-httpd-manual-2.4.29-41.jbcs.el6 +8
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-httpd-2.4.29-41.jbcs.el7, jbcs-httpd24-httpd-devel-2.4.29-41.jbcs.el7, jbcs-httpd24-httpd-manual-2.4.29-41.jbcs.el7 +8
Fixes 4 records
Priority HIGH 73
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.81556 · Published 2019-08-13 · Partial fix CWE-400
Priority HIGH 67
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.59547 · Published 2019-08-13 · Partial fix CWE-400
Priority MEDIUM 62
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.57461 · Published 2019-08-13 · Partial fix CWE-400
Priority MEDIUM 55
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.27004 · Published 2019-08-13 · Partial fix CWE-400
THREATIST.IORead the docs