Red Hat Security Advisory

RHSA-2023:6206

Red Hat JBoss Web Server 5.7.6 release and security update

Released 2023-10-31 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat-9.0.62-18.redhat_00016.1.el7jws, jws5-tomcat-admin-webapps-9.0.62-18.redhat_00016.1.el7jws, jws5-tomcat-docs-webapp-9.0.62-18.redhat_00016.1.el7jws +9
Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat-9.0.62-18.redhat_00016.1.el8jws, jws5-tomcat-admin-webapps-9.0.62-18.redhat_00016.1.el8jws, jws5-tomcat-docs-webapp-9.0.62-18.redhat_00016.1.el8jws +7
Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat-9.0.62-18.redhat_00016.1.el9jws, jws5-tomcat-admin-webapps-9.0.62-18.redhat_00016.1.el9jws, jws5-tomcat-docs-webapp-9.0.62-18.redhat_00016.1.el9jws +7

Fixes 2 records

TI-2023-24449 CVE-2023-45648 · GHSA-r6j3-px5g-cq3x

Apache Tomcat: Trailer header parsing too lenient

LOW 39

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP t…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.05883 Published 2023-10-10 Partial fix · 11.0.0-M12, 10.1.14 +2 CWE-20

TI-2023-22886 CVE-2023-42795 · GHSA-g8pj-r55q-5c2v

Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests

LOW 35

Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 th…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02515 Published 2023-10-10 Partial fix · 11.0.0-M12, 10.1.14 +2 CWE-459