Red Hat Security Advisory

RHSA-2021:2561

Red Hat JBoss Web Server 5.5.0 Security release

Released 2021-06-29 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss Web Server 5.5 for RHEL 7 Server jws5-ecj-4.12.0-3.redhat_2.2.el7jws, jws5-mod_cluster-1.4.3-2.Final_redhat_00002.1.el7jws, jws5-mod_cluster-tomcat-1.4.3-2.Final_redhat_00002.1.el7jws +15
Red Hat JBoss Web Server 5.5 for RHEL 8 jws5-ecj-4.12.0-3.redhat_2.2.el8jws, jws5-mod_cluster-1.4.3-2.Final_redhat_00002.1.el8jws, jws5-mod_cluster-tomcat-1.4.3-2.Final_redhat_00002.1.el8jws +13

Fixes 3 records

TI-2021-07400 CVE-2021-25122 · GHSA-j39c-c8hj-x4j3

Apache Tomcat h2c request mix-up

MEDIUM 56

When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.18114 Published 2021-03-01 Partial fix · 10.0.2, 9.0.42 +3 CWE-200

TI-2021-07568 CVE-2021-25329 · GHSA-jgwr-3qm3-26f3

Incomplete fix for CVE-2020-9484

MEDIUM 45

The fix for CVE-2020-9484 was incomplete.

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.09491 Published 2021-03-01 Partial fix · 10.0.0, 9.0.41 +4 CWE-502

TI-2020-15656 CVE-2020-25638 · GHSA-j8jw-g6fq-mp7h

SQL injection in hibernate-core

MEDIUM 40

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.02929 Published 2020-12-02 Partial fix · 5.4.24.Final, 5.3.20.Final CWE-89