Red Hat Security Advisory

RHSA-2024:1325

Red Hat JBoss Web Server 6.0.1 release and security update

Released 2024-03-18 · Red Hat rating Important · View on Red Hat →

Fixed in

JWS 6.0.1

Fixes 4 records

TI-2024-16171 CVE-2024-24549 · GHSA-7w75-32cg-r6g2

Apache Tomcat: HTTP/2 header handling DoS

MEDIUM 53

Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.23072 Published 2024-03-13 Partial fix · 11.0.0-M17, 10.1.19 +2 CWE-20

TI-2023-25099 CVE-2023-46589 · GHSA-fccv-jmmp-qg76

Apache Tomcat: HTTP request smuggling via malformed trailer headers

MEDIUM 44

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP t…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02651 Published 2023-11-28 Partial fix · 11.0.0-M11, 10.1.16 +2 CWE-444

TI-2023-05221 CVE-2023-5678 · GHSA-2cj7-mg3x-9mhq

Excessive time spent in DH check / generation with large Q parameter value

LOW 38

Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.05091 Published 2023-11-06 Partial fix · 1.0.2zj, 1.1.1x +2 CWE-606

TI-2023-21704 CVE-2023-41080 · GHSA-q3mw-pvr8-9ggc

Apache Tomcat: Open redirect with FORM authentication

LOW 37

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.06459 Published 2023-08-25 Partial fix · 11.0.0-M11, 10.1.13 +2 CWE-601