Red Hat Security AdvisoryRHSA-2020:2644
Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP3 security update
Released 2020-06-22 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-curl-7.64.1-36.jbcs.el6, jbcs-httpd24-httpd-2.4.37-57.jbcs.el6, jbcs-httpd24-httpd-devel-2.4.37-57.jbcs.el6 +18
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl-7.64.1-36.jbcs.el7, jbcs-httpd24-httpd-2.4.37-57.jbcs.el7, jbcs-httpd24-httpd-devel-2.4.37-57.jbcs.el7 +19
Fixes 9 records
Priority HIGH 74
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.07836 · Published 2020-01-21 · Partial fix · 1.10.8 CWE-835
Priority MEDIUM 56
In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.51951 · Published 2020-04-01 · Partial fix CWE-908
Priority MEDIUM 49
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for de…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.07107 · Published 2019-06-24 · Partial fix CWE-611
Priority MEDIUM 47
xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.05626 · Published 2019-12-24 · Partial fix CWE-772
Priority MEDIUM 45
xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03183 · Published 2020-01-21 · Partial fix CWE-401
Priority MEDIUM 42
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.06643 · Published 2019-09-04 · Partial fix CWE-125
Priority MEDIUM 42
A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38.
CVSS 3.0MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.193 · Published 2019-06-11 · Partial fix CWE-416
Priority MEDIUM 41
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.05316 · Published 2020-06-03 · Fixed in 1.41.0 CWE-707
Priority LOW 31
A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38.
CVSS 3.1MEDIUM 4.2· Network · Low privileges · No interaction · EPSS 0.08289 · Published 2019-06-11 · Partial fix CWE-444
THREATIST.IORead the docs