Red Hat Security Advisory

RHSA-2023:1664

Red Hat JBoss Web Server 5.7.2 release and security update

Released 2023-04-12 · Red Hat rating Low · View on Red Hat →

Fixed in

Red Hat JBoss Web Server 5

Fixes 2 records

TI-2022-20475 CVE-2022-42252 · GHSA-p22x-g9px-3945

Apache Tomcat request smuggling via malformed content-length

MEDIUM 42

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomca…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0178 Published 2022-11-01 Partial fix · 8.5.83, 9.0.68 +2 CWE-444

TI-2022-22218 CVE-2022-45143 · GHSA-rq2w-37h9-vg94

Apache Tomcat: JsonErrorReportValve escaping

LOW 38

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02669 Published 2023-01-03 Partial fix · 8.5.84, 9.0.69 +1 CWE-116