Red Hat Security AdvisoryRHSA-2019:3929
Red Hat JBoss Web Server 5.2 security release
Released 2019-11-20 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Web Server 5.2 for RHEL 6 Server jws5-ecj-4.12.0-1.redhat_1.1.el6jws, jws5-javapackages-tools-3.4.1-5.15.11.el6jws, jws5-jboss-logging-3.3.2-1.Final_redhat_00001.1.el6jws +16
- Red Hat JBoss Web Server 5.2 for RHEL 7 Server jws5-ecj-4.12.0-1.redhat_1.1.el7jws, jws5-javapackages-tools-3.4.1-5.15.11.el7jws, jws5-jboss-logging-3.3.2-1.Final_redhat_00001.1.el7jws +16
- Red Hat JBoss Web Server 5.2 for RHEL 8 jws5-ecj-4.12.0-1.redhat_1.1.el8jws, jws5-javapackages-tools-3.4.1-5.15.11.el8jws, jws5-jboss-logging-3.3.2-1.Final_redhat_00001.1.el8jws +16
Fixes 6 records
Priority HIGH 82
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE…
CVSS 3.0HIGH 8.1· Network · No auth · No interaction · EPSS 0.99923 · Published 2019-04-15 · Partial fix · 9.0.17, 8.5.40 +1 CWE-78
Priority HIGH 71
The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 .
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.72988 · Published 2019-06-21 · Partial fix · 9.0.20, 8.5.41 CWE-667
Priority HIGH 71
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.72855 · Published 2019-04-10 · Partial fix · 9.0.16, 8.5.38 CWE-400
Priority MEDIUM 61
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.59194 · Published 2019-05-28 · Partial fix · 9.0.17, 8.5.40 +1 CWE-79
Priority MEDIUM 43
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte r…
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.17139 · Published 2019-02-27 · Partial fix CWE-203
Priority LOW 28
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.
CVSS 3.1MEDIUM 4.7· Local · Low privileges · No interaction · EPSS 0.03418 · Published 2018-11-15 · Partial fix CWE-200
THREATIST.IORead the docs