Red Hat Security AdvisoryRHSA-2020:5170
Red Hat JBoss Web Server 5.4 security release
Released 2020-11-23 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat JBoss Web Server 5.4 for RHEL 6 Server jws5-jboss-logging-3.4.1-1.Final_redhat_00001.1.el6jws, jws5-mod_cluster-1.4.2-7.Final_redhat_00002.2.el6jws, jws5-mod_cluster-tomcat-1.4.2-7.Final_redhat_00002.2.el6jws +11
- Red Hat JBoss Web Server 5.4 for RHEL 7 Server jws5-jboss-logging-3.4.1-1.Final_redhat_00001.1.el7jws, jws5-mod_cluster-1.4.2-7.Final_redhat_00002.2.el7jws, jws5-mod_cluster-tomcat-1.4.2-7.Final_redhat_00002.2.el7jws +11
- Red Hat JBoss Web Server 5.4 for RHEL 8 jws5-jboss-logging-3.4.1-1.Final_redhat_00001.1.el8jws, jws5-mod_cluster-1.4.2-7.Final_redhat_00002.2.el8jws, jws5-mod_cluster-tomcat-1.4.2-7.Final_redhat_00002.2.el8jws +11
Fixes 1 record
Priority MEDIUM 61
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.26699 · Published 2020-06-26 · Partial fix · 10.0.0-M5, 9.0.35 +1 CWE-400
