Red Hat Security Advisory

RHSA-2024:2693

Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4 security update

Released 2024-05-07 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl-8.7.1-2.el7jbcs, jbcs-httpd24-httpd-2.4.57-10.el7jbcs, jbcs-httpd24-httpd-devel-2.4.57-10.el7jbcs +17
Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-curl-8.7.1-2.el8jbcs, jbcs-httpd24-httpd-2.4.57-10.el8jbcs, jbcs-httpd24-httpd-devel-2.4.57-10.el8jbcs +17

Fixes 6 records

TI-2024-18154 CVE-2024-27316 · GHSA-5qc4-82jh-h385

Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

HIGH 81

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.88755 Published 2024-04-04 Partial fix CWE-770

TI-2024-18758 CVE-2024-28182

Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

HIGH 71

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.81994 Published 2024-04-04 Partial fix · 1.61.0 CWE-770

TI-2024-02227 CVE-2024-2398 · GHSA-mq8w-c2j9-rqxc

HTTP/2 push headers memory-leak

HIGH 69

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.36081 Published 2024-03-27 Partial fix CWE-772

TI-2024-02292 CVE-2024-2466 · GHSA-9xr6-qf7m-2jv5

TLS certificate check bypass with mbedTLS

MEDIUM 62

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01453 Published 2024-03-27 Fixed CWE-297

TI-2024-02210 CVE-2024-2379 · GHSA-wr4c-gwg7-p734

QUIC certificate check bypass with wolfSSL

LOW 32

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.01863 Published 2024-03-27 Fixed CWE-295

TI-2024-01864 CVE-2024-2004 · GHSA-97xx-95pm-5qv6

Usage of disabled protocol

LOW 20

When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.01681 Published 2024-03-27 Fixed CWE-436