Red Hat Security Advisory

RHSA-2022:1389

Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP11 security update

Released 2022-04-20 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-util-1.6.1-91.jbcs.el7, jbcs-httpd24-apr-util-devel-1.6.1-91.jbcs.el7, jbcs-httpd24-apr-util-ldap-1.6.1-91.jbcs.el7 +34
Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-apr-util-1.6.1-91.el8jbcs, jbcs-httpd24-apr-util-devel-1.6.1-91.el8jbcs, jbcs-httpd24-apr-util-ldap-1.6.1-91.el8jbcs +34

Fixes 8 records

TI-2022-00687 CVE-2022-0778 · GHSA-x3mh-jvjw-3xwx

Infinite loop in BN_mod_sqrt() reachable when parsing certificates

HIGH 77

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.73188 Published 2022-03-15 Partial fix · 300.0.5, 111.18.0 CWE-835

TI-2022-06970 CVE-2022-22720 · GHSA-2hwm-6xjf-3xmx

HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier

HIGH 65

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.28189 Published 2022-03-14 Partial fix CWE-444

TI-2021-02476 CVE-2021-3517 · GHSA-jw9f-hh49-cvp9

Out-of-bounds write in libxml2

MEDIUM 60

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.16986 Published 2021-05-19 Partial fix · 1.11.4 CWE-787

TI-2021-02477 CVE-2021-3518 · GHSA-v4f8-2847-rwm7

Use after free in libxml2

MEDIUM 58

There's a flaw in libxml2 in versions before 2.9.11.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.21859 Published 2021-05-18 Partial fix · 1.11.4 CWE-416

TI-2022-07430 CVE-2022-23308 · GHSA-8v47-xfh7-92fh

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

MEDIUM 47

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0512 Published 2022-02-26 Partial fix CWE-416

TI-2021-02475 CVE-2021-3516 · GHSA-cfj9-6cq4-25vj

Use after free in libxml2

LOW 38

There's a flaw in libxml2's xmllint in versions before 2.9.11.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.02043 Published 2021-06-01 Partial fix CWE-416

TI-2021-02495 CVE-2021-3541 · GHSA-wcgr-63g6-pj93

A flaw was found in libxml2.

LOW 33

A flaw was found in libxml2.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02065 Published 2021-07-09 Partial fix CWE-776

TI-2021-02491 CVE-2021-3537 · GHSA-286v-pcf5-25rc

NULL pointer dereference in libxml2

LOW 33

A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.03596 Published 2021-05-14 Partial fix · 1.11.4 CWE-476