Red Hat Security Advisory 2019-0131-01 - Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector, JBoss HTTP Connector, Hibernate, and the Tomcat Native library. This release of Red Hat JBoss Web Server 3.1 Service Pack 5 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References. Issues addressed include open redirection and host name verification vulnerabilities.
d1fe1a8c5cb19911fbabc90a581032bd89b43ccfc6a45b1a54f70ec7927eac2b
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Red Hat JBoss Web Server 3.1 Service Pack 6 security and bug fix update
Advisory ID: RHSA-2019:0131-01
Product: Red Hat JBoss Web Server
Advisory URL: https://access.redhat.com/errata/RHSA-2019:0131
Issue date: 2019-01-22
CVE Names: CVE-2018-8034 CVE-2018-11784
=====================================================================
1. Summary:
An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6 and
Red Hat JBoss Web Server 3.1 for RHEL 7.
Red Hat Product Security has rated this release as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat JBoss Web Server 3.1 for RHEL 6 - i386, noarch, x86_64
Red Hat JBoss Web Server 3.1 for RHEL 7 - noarch, x86_64
3. Description:
Red Hat JBoss Web Server is a fully integrated and certified set of
components for hosting Java web applications. It is comprised of the Apache
HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector
(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat
Native library.
This release of Red Hat JBoss Web Server 3.1 Service Pack 5 serves as a
replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which
are documented in the Release Notes document linked to in the References.
Security Fix(es):
* tomcat: host name verification missing in WebSocket client
(CVE-2018-8034)
* tomcat: Open redirect in default servlet (CVE-2018-11784)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
Before applying the update, back up your existing Red Hat JBoss Web Server
installation (including all applications and configuration files).
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1607580 - CVE-2018-8034 tomcat: host name verification missing in WebSocket client
1636512 - CVE-2018-11784 tomcat: Open redirect in default servlet
6. JIRA issues fixed (https://issues.jboss.org/):
JWS-1140 - [ASF BZ 62892] tomcat-native memory leak when using Mutual authentication + OCSP
7. Package List:
Red Hat JBoss Web Server 3.1 for RHEL 6:
Source:
tomcat-native-1.2.17-18.redhat_18.ep7.el6.src.rpm
tomcat7-7.0.70-31.ep7.el6.src.rpm
tomcat8-8.0.36-35.ep7.el6.src.rpm
i386:
tomcat-native-1.2.17-18.redhat_18.ep7.el6.i686.rpm
tomcat-native-debuginfo-1.2.17-18.redhat_18.ep7.el6.i686.rpm
noarch:
tomcat7-7.0.70-31.ep7.el6.noarch.rpm
tomcat7-admin-webapps-7.0.70-31.ep7.el6.noarch.rpm
tomcat7-docs-webapp-7.0.70-31.ep7.el6.noarch.rpm
tomcat7-el-2.2-api-7.0.70-31.ep7.el6.noarch.rpm
tomcat7-javadoc-7.0.70-31.ep7.el6.noarch.rpm
tomcat7-jsp-2.2-api-7.0.70-31.ep7.el6.noarch.rpm
tomcat7-jsvc-7.0.70-31.ep7.el6.noarch.rpm
tomcat7-lib-7.0.70-31.ep7.el6.noarch.rpm
tomcat7-log4j-7.0.70-31.ep7.el6.noarch.rpm
tomcat7-selinux-7.0.70-31.ep7.el6.noarch.rpm
tomcat7-servlet-3.0-api-7.0.70-31.ep7.el6.noarch.rpm
tomcat7-webapps-7.0.70-31.ep7.el6.noarch.rpm
tomcat8-8.0.36-35.ep7.el6.noarch.rpm
tomcat8-admin-webapps-8.0.36-35.ep7.el6.noarch.rpm
tomcat8-docs-webapp-8.0.36-35.ep7.el6.noarch.rpm
tomcat8-el-2.2-api-8.0.36-35.ep7.el6.noarch.rpm
tomcat8-javadoc-8.0.36-35.ep7.el6.noarch.rpm
tomcat8-jsp-2.3-api-8.0.36-35.ep7.el6.noarch.rpm
tomcat8-jsvc-8.0.36-35.ep7.el6.noarch.rpm
tomcat8-lib-8.0.36-35.ep7.el6.noarch.rpm
tomcat8-log4j-8.0.36-35.ep7.el6.noarch.rpm
tomcat8-selinux-8.0.36-35.ep7.el6.noarch.rpm
tomcat8-servlet-3.1-api-8.0.36-35.ep7.el6.noarch.rpm
tomcat8-webapps-8.0.36-35.ep7.el6.noarch.rpm
x86_64:
tomcat-native-1.2.17-18.redhat_18.ep7.el6.x86_64.rpm
tomcat-native-debuginfo-1.2.17-18.redhat_18.ep7.el6.x86_64.rpm
Red Hat JBoss Web Server 3.1 for RHEL 7:
Source:
tomcat-native-1.2.17-18.redhat_18.ep7.el7.src.rpm
tomcat7-7.0.70-31.ep7.el7.src.rpm
tomcat8-8.0.36-35.ep7.el7.src.rpm
noarch:
tomcat7-7.0.70-31.ep7.el7.noarch.rpm
tomcat7-admin-webapps-7.0.70-31.ep7.el7.noarch.rpm
tomcat7-docs-webapp-7.0.70-31.ep7.el7.noarch.rpm
tomcat7-el-2.2-api-7.0.70-31.ep7.el7.noarch.rpm
tomcat7-javadoc-7.0.70-31.ep7.el7.noarch.rpm
tomcat7-jsp-2.2-api-7.0.70-31.ep7.el7.noarch.rpm
tomcat7-jsvc-7.0.70-31.ep7.el7.noarch.rpm
tomcat7-lib-7.0.70-31.ep7.el7.noarch.rpm
tomcat7-log4j-7.0.70-31.ep7.el7.noarch.rpm
tomcat7-selinux-7.0.70-31.ep7.el7.noarch.rpm
tomcat7-servlet-3.0-api-7.0.70-31.ep7.el7.noarch.rpm
tomcat7-webapps-7.0.70-31.ep7.el7.noarch.rpm
tomcat8-8.0.36-35.ep7.el7.noarch.rpm
tomcat8-admin-webapps-8.0.36-35.ep7.el7.noarch.rpm
tomcat8-docs-webapp-8.0.36-35.ep7.el7.noarch.rpm
tomcat8-el-2.2-api-8.0.36-35.ep7.el7.noarch.rpm
tomcat8-javadoc-8.0.36-35.ep7.el7.noarch.rpm
tomcat8-jsp-2.3-api-8.0.36-35.ep7.el7.noarch.rpm
tomcat8-jsvc-8.0.36-35.ep7.el7.noarch.rpm
tomcat8-lib-8.0.36-35.ep7.el7.noarch.rpm
tomcat8-log4j-8.0.36-35.ep7.el7.noarch.rpm
tomcat8-selinux-8.0.36-35.ep7.el7.noarch.rpm
tomcat8-servlet-3.1-api-8.0.36-35.ep7.el7.noarch.rpm
tomcat8-webapps-8.0.36-35.ep7.el7.noarch.rpm
x86_64:
tomcat-native-1.2.17-18.redhat_18.ep7.el7.x86_64.rpm
tomcat-native-debuginfo-1.2.17-18.redhat_18.ep7.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
8. References:
https://access.redhat.com/security/cve/CVE-2018-8034
https://access.redhat.com/security/cve/CVE-2018-11784
https://access.redhat.com/security/updates/classification/#moderate
9. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2019 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXEceVtzjgjWX9erEAQh3ZQ/9Gz0m/M6Egr9z5qBShsFXEK193sTqraP3
iOFiach1g8tTcZnvhd4CtrSgfcu16u4DzkGU4lo9zdbpAB32qrKczRkNK0q2DQW1
jSRnVvAPLL3Ek3deJrhU3n8Q/iGVOqhBVTNkkIsD5E2s+5CNloF5UH1tKSm9XhpZ
o6J5ztzt6RMPj5yo1YT2pU2OJYdFXwn3CyMJz13dOhcs6taeY0noeS3Spvzs9VJb
vzq2Kos7zvWdoXUPH8YY+QX9nOJWYsqVUutbgTU4XtGLRWhrEVAMLV3cIqNqCsU+
gUvIAKG6enA8bHb9YYQHFWH20CcfX1osEkO0CgEeYTU3ctwOneF/FFaENfnhLJh5
0WUMOFEnE1xPKT4Gik3P30tG76x7g/37j2TBz22vDAt30NcZlvNzUKslANzTni9A
KGBDdOTDUVF6W+vGClKrfwnJftVczb4f6bSoafXAUvsRef6bH1XAM1rIrF8/J1RD
PURnhTO9u+INIfOmdLLxvrMRgo/5HmBQb/nwFfMiByhbHb+dQl34fu62PMTkzCMZ
UC2mSRW7/BPup0XgkT6ItNGqxG0kMByWleulJycCfoQcJv30lPePx4Rs15jVQ7xA
a93R8Hu1+P3DKCGO5pfcP1vymJJ6q/jJdZc4qTWximBtl1K89MFZQ4OMurbAh0u+
TrZ80JZfxfM=
=Hksu
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce