Read the docs
Red Hat Security Advisory

RHSA-2021:4863

Red Hat JBoss Web Server 5.6.0 Security release

Released 2021-11-30 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 6 records

TI-2021-06204 CVE-2021-23840 · GHSA-qgm6-9472-pwq7

Integer overflow in CipherUpdate

Priority HIGH 70

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.50732 Published 2021-02-16 Partial fix · 111.14.0 CWE-190
TI-2021-12641 CVE-2021-33037 · GHSA-4vww-mc66-62m6

Incorrect Transfer-Encoding handling with HTTP/1.0

Priority HIGH 69

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.74667 Published 2021-07-12 Partial fix · 10.0.7, 9.0.48 +1 CWE-444
TI-2021-02646 CVE-2021-3712 · GHSA-q9wj-f4qw-6vfj

Read buffer overruns processing ASN.1 strings

Priority MEDIUM 63

ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.48084 Published 2021-08-24 Partial fix · 111.16.0 CWE-125
TI-2021-11031 CVE-2021-30640 · GHSA-36qh-35cm-5w2w

Auth weakness in JNDIRealm

Priority MEDIUM 47

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.09886 Published 2021-07-12 Partial fix · 10.0.5, 9.0.45 +1 CWE-116
TI-2021-18769 CVE-2021-42340 · GHSA-wph7-x527-w3h5

DoS via memory leak with WebSocket connections

Priority MEDIUM 46

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.11796 Published 2021-10-14 Partial fix · 10.1.0-M6, 10.0.12 +2 CWE-772
TI-2021-06205 CVE-2021-23841 · GHSA-84rm-qf37-fgc2

Null pointer deref in X509_issuer_and_serial_hash()

Priority LOW 37

The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.0741 Published 2021-02-16 Partial fix · 111.14.0 CWE-476