RedHat: RHSA-2019-1711:01 Moderate: Red Hat JBoss Web Server 3.1 Service

    Date09 Jul 2019
    1042
    Posted ByLinuxSecurity Advisories
    An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6 and Red Hat JBoss Web Server 3.1 for RHEL 7. Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score,
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA256
    
    =====================================================================
                       Red Hat Security Advisory
    
    Synopsis:          Moderate: Red Hat JBoss Web Server 3.1 Service Pack 7 security and bug fix update
    Advisory ID:       RHSA-2019:1711-01
    Product:           Red Hat JBoss Web Server
    Advisory URL:      https://access.redhat.com/errata/RHSA-2019:1711
    Issue date:        2019-07-09
    CVE Names:         CVE-2018-0739 
    =====================================================================
    
    1. Summary:
    
    An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6 and
    Red Hat JBoss Web Server 3.1 for RHEL 7.
    
    Red Hat Product Security has rated this release as having a security impact
    of Moderate. A Common Vulnerability Scoring System (CVSS) base score,
    which gives a detailed severity rating, is available for each vulnerability
    from the CVE link(s) in the References section.
    
    2. Relevant releases/architectures:
    
    Red Hat JBoss Web Server 3.1 for RHEL 6 - i386, noarch, x86_64
    Red Hat JBoss Web Server 3.1 for RHEL 7 - noarch, x86_64
    
    3. Description:
    
    Red Hat JBoss Web Server is a fully integrated and certified set of
    components for hosting Java web applications. It is comprised of the Apache
    HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector
    (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat
    Native library.
    
    This release of Red Hat JBoss Web Server 3.1 Service Pack 7 serves as a
    replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which
    are documented in the Release Notes document linked to in the References.
    
    Security Fix(es):
    
    * openssl: Handling of crafted recursive ASN.1 structures can cause a stack
    overflow and resulting denial of service (CVE-2018-0739)
    
    For more details about the security issue(s), including the impact, a CVSS
    score, acknowledgments, and other related information, refer to the CVE
    page(s) listed in the References section.
    
    4. Solution:
    
    Before applying the update, back up your existing Red Hat JBoss Web Server
    installation (including all applications and configuration files).
    
    For details on how to apply this update, refer to:
    
    https://access.redhat.com/articles/11258
    
    5. Bugs fixed (https://bugzilla.redhat.com/):
    
    1561266 - CVE-2018-0739 openssl: Handling of crafted recursive ASN.1 structures can cause a stack overflow and resulting denial of service
    
    6. JIRA issues fixed (https://issues.jboss.org/):
    
    JWS-1303 - Body text property replacement fails [jws3]
    JWS-1414 - Tomcat frequently hangs at startup when Jolokia loads certificate [jws-3]
    
    7. Package List:
    
    Red Hat JBoss Web Server 3.1 for RHEL 6:
    
    Source:
    tomcat-native-1.2.17-19.redhat_19.ep7.el6.src.rpm
    tomcat7-7.0.70-34.ep7.el6.src.rpm
    tomcat8-8.0.36-39.ep7.el6.src.rpm
    
    i386:
    tomcat-native-1.2.17-19.redhat_19.ep7.el6.i686.rpm
    tomcat-native-debuginfo-1.2.17-19.redhat_19.ep7.el6.i686.rpm
    
    noarch:
    tomcat7-7.0.70-34.ep7.el6.noarch.rpm
    tomcat7-admin-webapps-7.0.70-34.ep7.el6.noarch.rpm
    tomcat7-docs-webapp-7.0.70-34.ep7.el6.noarch.rpm
    tomcat7-el-2.2-api-7.0.70-34.ep7.el6.noarch.rpm
    tomcat7-javadoc-7.0.70-34.ep7.el6.noarch.rpm
    tomcat7-jsp-2.2-api-7.0.70-34.ep7.el6.noarch.rpm
    tomcat7-jsvc-7.0.70-34.ep7.el6.noarch.rpm
    tomcat7-lib-7.0.70-34.ep7.el6.noarch.rpm
    tomcat7-log4j-7.0.70-34.ep7.el6.noarch.rpm
    tomcat7-selinux-7.0.70-34.ep7.el6.noarch.rpm
    tomcat7-servlet-3.0-api-7.0.70-34.ep7.el6.noarch.rpm
    tomcat7-webapps-7.0.70-34.ep7.el6.noarch.rpm
    tomcat8-8.0.36-39.ep7.el6.noarch.rpm
    tomcat8-admin-webapps-8.0.36-39.ep7.el6.noarch.rpm
    tomcat8-docs-webapp-8.0.36-39.ep7.el6.noarch.rpm
    tomcat8-el-2.2-api-8.0.36-39.ep7.el6.noarch.rpm
    tomcat8-javadoc-8.0.36-39.ep7.el6.noarch.rpm
    tomcat8-jsp-2.3-api-8.0.36-39.ep7.el6.noarch.rpm
    tomcat8-jsvc-8.0.36-39.ep7.el6.noarch.rpm
    tomcat8-lib-8.0.36-39.ep7.el6.noarch.rpm
    tomcat8-log4j-8.0.36-39.ep7.el6.noarch.rpm
    tomcat8-selinux-8.0.36-39.ep7.el6.noarch.rpm
    tomcat8-servlet-3.1-api-8.0.36-39.ep7.el6.noarch.rpm
    tomcat8-webapps-8.0.36-39.ep7.el6.noarch.rpm
    
    x86_64:
    tomcat-native-1.2.17-19.redhat_19.ep7.el6.x86_64.rpm
    tomcat-native-debuginfo-1.2.17-19.redhat_19.ep7.el6.x86_64.rpm
    
    Red Hat JBoss Web Server 3.1 for RHEL 7:
    
    Source:
    tomcat-native-1.2.17-19.redhat_19.ep7.el7.src.rpm
    tomcat7-7.0.70-34.ep7.el7.src.rpm
    tomcat8-8.0.36-39.ep7.el7.src.rpm
    
    noarch:
    tomcat7-7.0.70-34.ep7.el7.noarch.rpm
    tomcat7-admin-webapps-7.0.70-34.ep7.el7.noarch.rpm
    tomcat7-docs-webapp-7.0.70-34.ep7.el7.noarch.rpm
    tomcat7-el-2.2-api-7.0.70-34.ep7.el7.noarch.rpm
    tomcat7-javadoc-7.0.70-34.ep7.el7.noarch.rpm
    tomcat7-jsp-2.2-api-7.0.70-34.ep7.el7.noarch.rpm
    tomcat7-jsvc-7.0.70-34.ep7.el7.noarch.rpm
    tomcat7-lib-7.0.70-34.ep7.el7.noarch.rpm
    tomcat7-log4j-7.0.70-34.ep7.el7.noarch.rpm
    tomcat7-selinux-7.0.70-34.ep7.el7.noarch.rpm
    tomcat7-servlet-3.0-api-7.0.70-34.ep7.el7.noarch.rpm
    tomcat7-webapps-7.0.70-34.ep7.el7.noarch.rpm
    tomcat8-8.0.36-39.ep7.el7.noarch.rpm
    tomcat8-admin-webapps-8.0.36-39.ep7.el7.noarch.rpm
    tomcat8-docs-webapp-8.0.36-39.ep7.el7.noarch.rpm
    tomcat8-el-2.2-api-8.0.36-39.ep7.el7.noarch.rpm
    tomcat8-javadoc-8.0.36-39.ep7.el7.noarch.rpm
    tomcat8-jsp-2.3-api-8.0.36-39.ep7.el7.noarch.rpm
    tomcat8-jsvc-8.0.36-39.ep7.el7.noarch.rpm
    tomcat8-lib-8.0.36-39.ep7.el7.noarch.rpm
    tomcat8-log4j-8.0.36-39.ep7.el7.noarch.rpm
    tomcat8-selinux-8.0.36-39.ep7.el7.noarch.rpm
    tomcat8-servlet-3.1-api-8.0.36-39.ep7.el7.noarch.rpm
    tomcat8-webapps-8.0.36-39.ep7.el7.noarch.rpm
    
    x86_64:
    tomcat-native-1.2.17-19.redhat_19.ep7.el7.x86_64.rpm
    tomcat-native-debuginfo-1.2.17-19.redhat_19.ep7.el7.x86_64.rpm
    
    These packages are GPG signed by Red Hat for security.  Our key and
    details on how to verify the signature are available from
    https://access.redhat.com/security/team/key/
    
    8. References:
    
    https://access.redhat.com/security/cve/CVE-2018-0739
    https://access.redhat.com/security/updates/classification/#moderate
    https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/3.1/html/3.1.0_release_notes/index
    
    9. Contact:
    
    The Red Hat security contact is . More contact
    details at https://access.redhat.com/security/team/contact/
    
    Copyright 2019 Red Hat, Inc.
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1
    
    iQIVAwUBXSSO5tzjgjWX9erEAQi9txAAgVqrOrvIK7O1M+toA/c+8SXVb6mjL/As
    q8DHXbcca4gxxMTrgw8Q65gVqWRbmTXskZMs2nprnl0DJUQlT0GxTXH9DBJcoyDW
    aABX586dopqZTVQ+RnlE5Y64BFZ77IrjtI+CjMNCnqouh+jwQbsqeyUm7Y7cjFF6
    4d0PDw5wZFHgRGYpIqJxIKppmuLME6TRGP6Cyl1tS99TuCYJ4I/pP8WAP6WZVhHU
    BceXq0xLImPDldWGt5jZsLHZnJVVn+f26TVwWVmGKiyqgf9ACBnHnUgvsud4xtP3
    2e2oZxW7QlFDDEI+1CYPBpT6sz1ae5bV1Nr9IhhZFb1XI4ZHVOB1CAQXu15KgQgH
    Cs2ZAbeoyEfFCujV0J3qN2OomVWqtYoWb1F9Axa7qKfdbAW5Y/svgYHIvUXKFBoE
    a8+XhG1+CUID8MDd5bhATmnsfA6iYZQI8HvVEJiMyB5vhkGysTH0Wffp6K0zpfh2
    RnsNE2u+eC38v+gWB6uVVXYaIQolE5cHgqbR2/PsQzoLCQXjzGOZXpfNH+5XbQ8t
    X6+bBQY6w/ZdpsAG+xxd3GoAdWMsJ7+p6Fv+xU2NLUZc6C3oy5W/SCVImi13zweO
    ckAd5Hi2gqMriHZm7Zc+nWy3c1aRfq2dXiLbZBxLREXzNj2yaQFRJq3s9VrdLy1B
    s/v0TmHXGfM=
    =hM4+
    -----END PGP SIGNATURE-----
    
    --
    RHSA-announce mailing list
    This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.redhat.com/mailman/listinfo/rhsa-announce
    

    LinuxSecurity Poll

    What do you think of the LinuxSecurity Privacy news articles?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/25-what-do-you-think-of-the-linuxsecurity-privacy-news-articles?task=poll.vote&format=json
    25
    radio
    [{"id":"90","title":"Love them!","votes":"90","type":"x","order":"1","pct":78.95,"resources":[]},{"id":"91","title":"I'm indifferent","votes":"18","type":"x","order":"2","pct":15.79,"resources":[]},{"id":"92","title":"Not interested in this topic","votes":"6","type":"x","order":"3","pct":5.26,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.