Read the docs
Red Hat Security Advisory

RHSA-2020:1337

Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP2 security update

Released 2020-04-06 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 9 records

TI-2019-07417 CVE-2019-10092 · GHSA-qrr6-fpf4-x3v4

Cross-site scripting in Apache HTTP Server

Priority HIGH 68

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.81466 Published 2019-09-26 Partial fix CWE-79
TI-2019-07422 CVE-2019-10098 · GHSA-hm8m-x559-v4fw

Open redirect in Apache HTTP Server

Priority HIGH 66

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.73981 Published 2019-09-25 Partial fix CWE-601
TI-2019-07421 CVE-2019-10097 · GHSA-x7xg-9vq9-q8xh

NULL pointer dereference in Apache HTTP Server

Priority MEDIUM 64

In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.52873 Published 2019-09-26 Partial fix CWE-476
TI-2020-01851 CVE-2020-1927 · GHSA-h8gj-rgqf-fpq3

Open redirect in Apache HTTP Server

Priority MEDIUM 61

In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request U…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.56691 Published 2020-04-01 Fixed CWE-601
TI-2019-07407 CVE-2019-10082 · GHSA-28c2-r3qq-82vj

Use after free in Apache HTTP Server

Priority MEDIUM 56

In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.16549 Published 2019-09-26 Partial fix CWE-416
TI-2019-07406 CVE-2019-10081 · GHSA-c2vp-q2q2-hm8m

Out-of-bounds write in Apache HTTP Server

Priority MEDIUM 48

HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.14563 Published 2019-08-15 Partial fix CWE-787
TI-2019-01187 CVE-2019-1549 · GHSA-xmjp-8ccm-cf6h

Fork Protection

Priority LOW 33

OpenSSL 1.1.1 introduced a rewritten random number generator (RNG).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.06182 Published 2019-09-10 Partial fix CWE-330
TI-2019-01191 CVE-2019-1563 · GHSA-rv3r-f48w-6vvh

Padding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey

Priority LOW 30

In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transp…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.03838 Published 2019-09-10 Partial fix CWE-203
TI-2019-01186 CVE-2019-1547 · GHSA-q2qv-648h-wcqp

ECDSA remote timing attack

Priority LOW 24

Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths.

CVSS 3.1MEDIUM 4.7 Local Low privileges No interaction EPSS 0.01129 Published 2019-09-10 Partial fix