Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Red Hat: RHSA-2020-2644-01 Important: Apache Server 2.4.37 Security Fix

red hat
Calendar Grey June 22, 2020
Dist Redhat Esm H88
Revamped JBoss Core Services featuring vital upgrades for RHEL 6 and 7, tackling security vulnerabilities and boosting reliability.
Updated packages that provide Red Hat JBoss Core Services Pack Apache Server 2.4.37 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linu...

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Summary

This release adds the new Apache HTTP Server 2.4.37 Service Pack 3 packages that are part of the JBoss Core Services offering.
This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 2 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.
Security fix(es):
* httpd: mod_http2: read-after-free on a string compare (CVE-2019-0196) * httpd: mod_http2: possible crash on late upgrade (CVE-2019-0197) * httpd: mod_proxy_ftp use of uninitialized value (CVE-2020-1934) * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080) * libxml2: There's a memory leak in xmlParseBalancedChunkMemoryRecover in parser.c that could result in a crash (CVE-2019-19956) * libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c (CVE-2019-20388) * libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations (CVE-2020-7595) * expat: large number of colons in input makes parser consume high amount of resources, leading to DoS (CVE-2018-20843) * expat: heap-based buffer over-read via crafted XML input (CVE-2019-15903)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory Red Hat bug fix security impact Apache JBoss DoS vulnerability

References

https://access.redhat.com/security/cve/CVE-2018-20843 https://access.redhat.com/security/cve/CVE-2019-0196 https://access.redhat.com/security/cve/CVE-2019-0197 https://access.redhat.com/security/cve/CVE-2019-15903 https://access.redhat.com/security/cve/CVE-2019-19956 https://access.redhat.com/security/cve/CVE-2019-20388 https://access.redhat.com/security/cve/CVE-2020-1934 https://access.redhat.com/security/cve/CVE-2020-7595 https://access.redhat.com/security/cve/CVE-2020-11080 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat JBoss Core Services on RHEL 6 Server:
Source: jbcs-httpd24-curl-7.64.1-36.jbcs.el6.src.rpm jbcs-httpd24-httpd-2.4.37-57.jbcs.el6.src.rpm jbcs-httpd24-mod_cluster-native-1.3.14-4.Final_redhat_2.jbcs.el6.src.rpm jbcs-httpd24-mod_http2-1.15.7-3.jbcs.el6.src.rpm jbcs-httpd24-mod_jk-1.2.48-4.redhat_1.jbcs.el6.src.rpm jbcs-httpd24-mod_md-2.0.8-24.jbcs.el6.src.rpm jbcs-httpd24-mod_security-2.9.2-51.GA.jbcs.el6.src.rpm jbcs-httpd24-nghttp2-1.39.2-25.jbcs.el6.src.rpm
i386: jbcs-httpd24-curl-7.64.1-36.jbcs.el6.i686.rpm jbcs-httpd24-curl-debuginfo-7.64.1-36.jbcs.el6.i686.rpm jbcs-httpd24-httpd-2.4.37-57.jbcs.el6.i686.rpm jbcs-httpd24-httpd-debuginfo-2.4.37-57.jbcs.el6.i686.rpm jbcs-httpd24-httpd-devel-2.4.37-57.jbcs.el6.i686.rpm jbcs-httpd24-httpd-selinux-2.4.37-57.jbcs.el6.i686.rpm jbcs-httpd24-httpd-tools-2.4.37-57.jbcs.el6.i686.rpm jbcs-httpd24-libcurl-7.64.1-36.jbcs.el6.i686.rpm jbcs-httpd24-libcurl-devel-7.64.1-36.jbcs.el6.i686.rpm jbcs-httpd24-mod_cluster-native-1.3.14-4.Final_redhat_2.jbcs.el6.i686.rpm jbcs-httpd24-mod_cluster-native-debuginfo-1.3.14-4.Final_redhat_2.jbcs.el6.i686.rpm jbcs-httpd24-mod_http2-1.15.7-3.jbcs.el6.i686.rpm jbcs-httpd24-mod_http2-debuginfo-1.15.7-3.jbcs.el6.i686.rpm jbcs-httpd24-mod_jk-ap24-1.2.48-4.redhat_1.jbcs.el6.i686.rpm

Read the Full Advisory


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2020:2644-01
Product: Red Hat JBoss Core Services
Advisory URL: https://access.redhat.com/errata/RHSA-2020:2644
Issue date: 2020-06-22

Topic

Updated packages that provide Red Hat JBoss Core Services Pack ApacheServer 2.4.37 and fix several bugs, and add various enhancements are nowavailable for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory Red Hat bug fix security impact Apache JBoss DoS vulnerability

Relevant Releases Architectures

Red Hat JBoss Core Services on RHEL 6 Server - i386, noarch, ppc64, x86_64

Red Hat JBoss Core Services on RHEL 7 Server - noarch, ppc64, x86_64

Bugs Fixed

1695030 - CVE-2019-0196 httpd: mod_http2: read-after-free on a string compare

1695042 - CVE-2019-0197 httpd: mod_http2: possible crash on late upgrade

1723723 - CVE-2018-20843 expat: large number of colons in input makes parser consume high amount of resources, leading to DoS

1752592 - CVE-2019-15903 expat: heap-based buffer over-read via crafted XML input

1788856 - CVE-2019-19956 libxml2: There's a memory leak in xmlParseBalancedChunkMemoryRecover in parser.c that could result in a crash

1799734 - CVE-2019-20388 libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c

1799786 - CVE-2020-7595 libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations

1820772 - CVE-2020-1934 httpd: mod_proxy_ftp use of uninitialized value

1844929 - CVE-2020-11080 nghttp2: overly large SETTINGS frames can lead to DoS

6. JIRA issues fixed (https://issues.redhat.com/):

JBCS-941 - Upgrade mod_cluster native to 1.3.13

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here