Read the docs
Red Hat Security Advisory

RHSA-2023:7623

Red Hat JBoss Web Server 5.7.7 release and security update

Released 2023-12-07 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 8 records

TI-2023-02479 CVE-2023-2650 · GHSA-gqxg-9vfr-p9cg

Possible DoS translating ASN.1 object identifiers

Priority HIGH 68

Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.75358 Published 2023-05-30 Partial fix · 3.1.1, 3.0.9 +2 CWE-770
TI-2023-00439 CVE-2023-0464 · GHSA-w2w6-xp88-5cvw

Excessive Resource Usage Verifying X.509 Policy Constraints

Priority MEDIUM 46

A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03985 Published 2023-03-22 Partial fix · 3.1.1, 3.0.9 +2 CWE-295
TI-2023-03220 CVE-2023-3446 · GHSA-3p3x-vg38-6g9q

Excessive time spent checking DH keys and parameters

Priority LOW 39

Issue summary: Checking excessively long DH keys or parameters may be very slow.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.06531 Published 2023-07-19 Partial fix · 3.1.2, 3.0.10 +2 CWE-606
TI-2023-21704 CVE-2023-41080 · GHSA-q3mw-pvr8-9ggc

Apache Tomcat: Open redirect with FORM authentication

Priority LOW 37

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.06459 Published 2023-08-25 Partial fix · 11.0.0-M11, 10.1.13 +2 CWE-601
TI-2023-03567 CVE-2023-3817 · GHSA-c945-cqj5-wfv6

Excessive time spent checking DH q parameter value

Priority LOW 36

Issue summary: Checking excessively long DH keys or parameters may be very slow.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03047 Published 2023-07-31 Partial fix · 3.1.2, 3.0.10 +2 CWE-606
TI-2023-00440 CVE-2023-0465 · GHSA-77f3-6546-6rj7

Invalid certificate policies in leaf certificates are silently ignored

Priority LOW 34

Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01772 Published 2023-03-28 Partial fix · 3.1.1, 3.0.9 +2 CWE-295
TI-2023-00441 CVE-2023-0466 · GHSA-pxvj-4wx4-gv6w

Certificate policy check not enabled

Priority LOW 28

The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01772 Published 2023-03-28 Partial fix · 3.1.1, 3.0.9 +2 CWE-295