Red Hat Security Advisory

RHSA-2023:4909

Red Hat JBoss Web Server 5.7.4 release and security update

Released 2023-09-04 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat-9.0.62-15.redhat_00013.1.el7jws, jws5-tomcat-admin-webapps-9.0.62-15.redhat_00013.1.el7jws, jws5-tomcat-docs-webapp-9.0.62-15.redhat_00013.1.el7jws +10
Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat-9.0.62-15.redhat_00013.1.el8jws, jws5-tomcat-admin-webapps-9.0.62-15.redhat_00013.1.el8jws, jws5-tomcat-docs-webapp-9.0.62-15.redhat_00013.1.el8jws +8
Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat-9.0.62-15.redhat_00013.1.el9jws, jws5-tomcat-admin-webapps-9.0.62-15.redhat_00013.1.el9jws, jws5-tomcat-docs-webapp-9.0.62-15.redhat_00013.1.el9jws +8

Fixes 4 records

TI-2023-10471 CVE-2023-24998 · GHSA-hfrx-6qgj-fp6c

Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

HIGH 70

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.48788 Published 2023-02-20 Partial fix · 1.5, 10.1.5 +3 CWE-770

TI-2023-13226 CVE-2023-28709 · GHSA-cx6h-86xw-9x34

Apache Tomcat: Fix for CVE-2023-24998 is incomplete

HIGH 69

The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.48031 Published 2023-05-22 Partial fix · 11.0.0-M5, 10.1.8 +2 CWE-193

TI-2022-08761 CVE-2022-24963 · GHSA-6rr3-mpxq-hv4x

Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions

MEDIUM 52

Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01472 Published 2023-01-31 Fixed CWE-190

TI-2023-13225 CVE-2023-28708 · GHSA-2c9m-w27f-53rm

Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations

LOW 24

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.01831 Published 2023-03-22 Partial fix · 11.0.0-M3, 10.1.6 +2 CWE-523