Red Hat Security AdvisoryRHSA-2020:3303
Red Hat JBoss Web Server 3.1 Service Pack 10 security update
Released 2020-08-04 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Web Server 3.1 for RHEL 6 tomcat7-7.0.70-41.ep7.el6, tomcat7-admin-webapps-7.0.70-41.ep7.el6, tomcat7-docs-webapp-7.0.70-41.ep7.el6 +21
- Red Hat JBoss Web Server 3.1 for RHEL 7 tomcat7-7.0.70-41.ep7.el7, tomcat7-admin-webapps-7.0.70-41.ep7.el7, tomcat7-docs-webapp-7.0.70-41.ep7.el7 +21
Fixes 2 records
Priority HIGH 81
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.86608 · Published 2020-07-14 · Partial fix · 10.0.0-M7, 9.0.37 +2 CWE-835
Priority MEDIUM 40
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid.
CVSS 3.1MEDIUM 4.8· Network · No auth · No interaction · EPSS 0.09386 · Published 2020-02-24 · Partial fix · 7.0.100, 8.5.51 +1 CWE-444
