Linux Security
Linux Security
Linux Security

RedHat: RHSA-2021-1202:01 Important: Red Hat JBoss Web Server 3.1 Service

Date 14 Apr 2021
245
Posted By LinuxSecurity Advisories
An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 7. Red Hat Product Security has rated this release as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat JBoss Web Server 3.1 Service Pack 12 security update
Advisory ID:       RHSA-2021:1202-01
Product:           Red Hat JBoss Web Server
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:1202
Issue date:        2021-04-14
CVE Names:         CVE-2021-3449 CVE-2021-3450 
=====================================================================

1. Summary:

An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 7.

Red Hat Product Security has rated this release as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat JBoss Web Server 3.1 for RHEL 7 - x86_64

3. Description:

Red Hat JBoss Web Server is a fully integrated and certified set of
components for hosting Java web applications. It is comprised of the Apache
HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector
(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat
Native library.

This release of Red Hat JBoss Web Server 3.1 Service Pack 12 serves as a
replacement for Red Hat JBoss Web Server 3.1.11, and includes bug fixes,
which are documented in the Release Notes document linked to in the
References.

Security Fix(es):

* openssl: NULL pointer dereference in signature_algorithms processing
(CVE-2021-3449)
* openssl: CA certificate check bypass with X509_V_FLAG_X509_STRICT
(CVE-2021-3450)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1941547 - CVE-2021-3450 openssl: CA certificate check bypass with X509_V_FLAG_X509_STRICT
1941554 - CVE-2021-3449 openssl: NULL pointer dereference in signature_algorithms processing

6. Package List:

Red Hat JBoss Web Server 3.1 for RHEL 7:

Source:
tomcat-native-1.2.23-24.redhat_24.ep7.el7.src.rpm

x86_64:
tomcat-native-1.2.23-24.redhat_24.ep7.el7.x86_64.rpm
tomcat-native-debuginfo-1.2.23-24.redhat_24.ep7.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-3449
https://access.redhat.com/security/cve/CVE-2021-3450
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYHctstzjgjWX9erEAQgp5g/+PmVzCLWS2x+IBEanPp+efKJpDq5Gej3E
PFB9uJ0WKIH4qtznGfI/i5mtrIjy1BrbrlBJrFF72+a2pEyP8EL9DcJubIlLu9MH
QgwsB5XVwC8+6aRVAN3blKPKPLC8CjHK3Ef+4cSq8vZocRHRKsx4Jz8dk1m1U36p
/be1EBKaTrm9rGHgT+UYuKSeYrRq2QSEmoLKjyBQwDADHJzSRXuSv6AlaUHx9RvB
xvRp+A9JErjaweOo2Ndo1KGhyHAQRUWTWym0M5QNbvBwBGNEShNjlezMhNVvC7UH
fM5kLpcCxk4gtPuMGtg26fBSYZyzKiijl7zkkHiEt9jLqonik7QKRDaucPch8UgA
5Ic+bkN65+SlPpVYoCq65aUKmlQNJuL5FmXVXGV2OToyiOctojTYglvZI/zgcEOf
0vpZGeZ/duupuN7OHQ4YTYY44Li5CVKIojLlE8cMRJRkmH3X76xW2DCooFRx7viI
cKiNBFSu2z47B3EZkKN2X5Zz/c7tWA/qD4cx3aP9bL1ucT6c0QFhi95we9vmwRaj
TFC9RjmvzWeacI2ZfsEFv10wmSkF71idLr7zXFJ/e2vGKYVUQ+TKLf2cdXcHLW76
9wG9fy3SMjhDGmaJPEn9Ii42Ntu8Sj1BoxuBydJ2Wxf9I7cpMh62B9Hc1s4/SJHR
CVXTbuaHHtI=
=bubg
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
This email address is being protected from spambots. You need JavaScript enabled to view it.
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Advisories

LinuxSecurity Poll

How frequently do you patch/update your system?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum 0 answer(s) and maximum 3 answer(s).
/main-polls/52-how-frequently-do-you-patch-update-your-system?task=poll.vote&format=json
52
radio
[{"id":"179","title":"As soon as patches\/updates are released - I track advisories for my distro(s) diligently","votes":"66","type":"x","order":"1","pct":75.86,"resources":[]},{"id":"180","title":"Every so often, when I think of it","votes":"14","type":"x","order":"2","pct":16.09,"resources":[]},{"id":"181","title":"Hardly ever","votes":"7","type":"x","order":"3","pct":8.05,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350

Please vote first in order to view vote results.

VOTE ON THE POLL PAGE


VIEW MORE POLLS

bottom 200

Please enable / Bitte aktiviere JavaScript!
Veuillez activer / Por favor activa el Javascript![ ? ]

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.