Red Hat Security Advisory

RHSA-2021:0495

Red Hat JBoss Web Server 5.4.1 Security Update

Released 2021-02-11 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss Web Server 5

Fixes 4 records

TI-2020-13275 CVE-2020-17527 · GHSA-vvw4-rfwf-p6hx

Apache Tomcat: Request header mix-up between HTTP/2 streams

MEDIUM 60

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 c…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.24622 Published 2020-12-03 Partial fix · 10.0.0-M10, 9.0.40 +1 CWE-200

TI-2020-10919 CVE-2020-13943 · GHSA-f268-65qc-98vg

Information disclosure in Apache Tomcat

MEDIUM 58

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.52639 Published 2020-10-12 Partial fix · 10.0.0-M8, 9.0.38 +1 CWE-200

TI-2021-06414 CVE-2021-24122 · GHSA-2rvv-w9r2-rg7m

Apache Tomcat information disclosure

MEDIUM 53

When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code discl…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.22852 Published 2021-01-14 Partial fix · 10.0.0-M10, 9.0.40 +3 CWE-200

TI-2020-01890 CVE-2020-1971 · GHSA-whf2-mq76-2fhv

EDIPARTYNAME NULL pointer dereference

LOW 36

The X.509 GeneralName type is a generic type for representing different types of names.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.06994 Published 2020-12-08 Partial fix CWE-476