Linux Security
    Linux Security
    Linux Security

    RedHat: RHSA-2020-5173:01 Moderate: Red Hat JBoss Web Server 5.4 security

    Date 23 Nov 2020
    297
    Posted By LinuxSecurity Advisories
    Red Hat JBoss Web Server 5.4.0 zip release for RHEL 6, RHEL 7, RHEL 8 and Microsoft Windows is available. Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA256
    
    =====================================================================
                       Red Hat Security Advisory
    
    Synopsis:          Moderate: Red Hat JBoss Web Server 5.4 security release
    Advisory ID:       RHSA-2020:5173-01
    Product:           Red Hat JBoss Web Server
    Advisory URL:      https://access.redhat.com/errata/RHSA-2020:5173
    Issue date:        2020-11-23
    CVE Names:         CVE-2020-11996 
    =====================================================================
    
    1. Summary:
    
    Red Hat JBoss Web Server 5.4.0 zip release for RHEL 6, RHEL 7, RHEL 8 and
    Microsoft Windows is available.
    
    Red Hat Product Security has rated this release as having a security impact
    of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
    gives a detailed severity rating, is available for each vulnerability from
    the CVE link(s) in the References section.
    
    2. Description:
    
    Red Hat JBoss Web Server is a fully integrated and certified set of
    components for hosting Java web applications. It is comprised of the Apache
    Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the
    PicketLink Vault extension for Apache Tomcat, and the Tomcat Native
    library.
    
    This release of Red Hat JBoss Web Server 5.4 serves as a replacement for
    Red Hat JBoss Web Server 5.3, and includes bug fixes, enhancements, and
    component upgrades, which are documented in the Release Notes, linked to in
    the References.
    
    Security Fix(es):
    
    * tomcat: specially crafted sequence of HTTP/2 requests can lead to DoS
    (CVE-2020-11996)
    
    For more details about the security issue(s), including the impact, a CVSS
    score, acknowledgments, and other related information, refer to the CVE
    page(s) listed in the References section.
    
    3. Solution:
    
    Before applying the update, back up your existing installation, including
    all applications, configuration files, databases and database settings, and
    so on.
    
    The References section of this erratum contains a download link for the
    update. You must be logged in to download the update.
    
    4. Bugs fixed (https://bugzilla.redhat.com/):
    
    1851420 - CVE-2020-11996 tomcat: specially crafted sequence of HTTP/2 requests can lead to DoS
    
    5. References:
    
    https://access.redhat.com/security/cve/CVE-2020-11996
    https://access.redhat.com/security/updates/classification/#moderate
    https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver&downloadType=distributions&version=5.4
    https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/5.4
    
    6. Contact:
    
    The Red Hat security contact is . More contact
    details at https://access.redhat.com/security/team/contact/
    
    Copyright 2020 Red Hat, Inc.
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1
    
    iQIVAwUBX7ul9dzjgjWX9erEAQgqxQ//SfGSZr9GwK+yquxYuoMPbAdrTcKNgL3X
    iPiuaM0fqhPxN5MB3C/E9IF2pEXs3ZyxdgCDk4oMkvbI8MiSxRIuDNw0ZSOx8zze
    ew3inZJSeQ7QcMQkiHUnWEsm4L61zp+ua1UFIEV9Ts/WfYJ45k0NCXtXFalJYN4Y
    +NYTrgKGYKMPemY9NO0/AaGRtVnL8ZVpAELPEHR9rqpzrclSLwx/de5G09foRu2L
    dDE74wMpEx2zwaBSIC2lYZaQkLCQFt4FEZ3EkVeKn5b1S33JOwo/u1VkeB4FvTKG
    FA3R9Ac0dukzfwF4Fce6j0JFy9lCmBWoeXUYK6jsF+ETadk3vhSgXBZhzXCVPWLS
    tnXYJZ/hQnun8KJUNO9bHxTb6nveoj8or+9uvlsUsd8Bc7izJvdJoWF9QT9uIBkm
    m0D+UJ3UUW2fvOwitFnocTF0i7Cl1qAOSorspfOMu5w7J50rPTLwlZWNTmbo6qEX
    wNv6qcgeVVwf7jYaRHXCh5dtTUxstt0v/j6LI+YuB5OxBr4ETdefcVnOf7eICtrW
    Zrg/8Q0ZW9SXgFcAFlTbQI0nb3CTpr3by6UCZmMgL4Xrxkn91THCxtId1JU77SBb
    Y0g+Q39pyasF7VCOLTmkJJGVSescbpoNCXQDoF9qEefK97lZFRPEvfNuTAfpMWnq
    nPbesFehzNs=
    =aLTD
    -----END PGP SIGNATURE-----
    
    --
    RHSA-announce mailing list
    This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.redhat.com/mailman/listinfo/rhsa-announce
    

    LinuxSecurity Poll

    'Tis the season of giving! How have you given back to the open-source community?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/49-tis-the-season-of-giving-how-have-you-given-back-to-the-open-source-community?task=poll.vote&format=json
    49
    radio
    [{"id":"171","title":"I've contributed to the development of an open-source project.","votes":"12","type":"x","order":"1","pct":36.36,"resources":[]},{"id":"172","title":"I've reviewed open-source code for security bugs.","votes":"6","type":"x","order":"2","pct":18.18,"resources":[]},{"id":"173","title":"I've made a donation to an open-source project.","votes":"15","type":"x","order":"3","pct":45.45,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350

    Please vote first in order to view vote results.


    VIEW MORE POLLS

    bottom 200

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.