You are here
Home > Preporuke > Sigurnosni nedostaci programskog paketa JBoss Core Services Pack Apache Server

Sigurnosni nedostaci programskog paketa JBoss Core Services Pack Apache Server

by - 0

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP2 security update
Advisory ID: RHSA-2020:1336-01
Product: Red Hat JBoss Core Services
Advisory URL: https://access.redhat.com/errata/RHSA-2020:1336
Issue date: 2020-04-06
CVE Names: CVE-2019-1547 CVE-2019-1549 CVE-2019-1563
CVE-2019-10081 CVE-2019-10082 CVE-2019-10092
CVE-2019-10097 CVE-2019-10098
=====================================================================

1. Summary:

Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 2 zip
release for RHEL 6, RHEL 7 and Microsoft Windows is available.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat JBoss Core Services is a set of supplementary software for Red Hat
JBoss middleware products. This software, such as Apache HTTP Server, is
common to multiple JBoss middleware products, and is packaged under Red Hat
JBoss Core Services to allow for faster distribution of updates, and for a
more consistent update experience.

This release adds the new Apache HTTP Server 2.4.37 Service Pack 2 packages
that are part of the JBoss Core Services offering.

This release serves as a replacement for Red Hat JBoss Core Services Pack
Apache Server 2.4.37 Service Pack 1 and includes bug fixes and
enhancements. Refer to the Release Notes for information on the most
significant bug fixes and enhancements included in this release.

Security Fix(es):

* openssl: side-channel weak encryption vulnerability (CVE-2019-1547)

* httpd: memory corruption on early pushes (CVE-2019-10081)

* httpd: read-after-free in h2 connection shutdown (CVE-2019-10082)

* httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)

* openssl: information disclosure in fork() (CVE-2019-1549)

* openssl: information disclosure in PKCS7_dataDecode and
CMS_decrypt_set1_pkey (CVE-2019-1563)

* httpd: limited cross-site scripting in mod_proxy error page
(CVE-2019-10092)

* httpd: mod_rewrite potential open redirect (CVE-2019-10098)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

The References section of this erratum contains a download link (you must
log in to download the update).

Before applying the update, back up your existing Red Hat JBoss Core
Services installation (including all applications and configuration files).

4. Bugs fixed (https://bugzilla.redhat.com/):

1743956 – CVE-2019-10092 httpd: limited cross-site scripting in mod_proxy error page
1743959 – CVE-2019-10098 httpd: mod_rewrite potential open redirect
1743966 – CVE-2019-10081 httpd: memory corruption on early pushes
1743974 – CVE-2019-10082 httpd: read-after-free in h2 connection shutdown
1743996 – CVE-2019-10097 httpd: null-pointer dereference in mod_remoteip
1752090 – CVE-2019-1547 openssl: side-channel weak encryption vulnerability
1752095 – CVE-2019-1549 openssl: information disclosure in fork()
1752100 – CVE-2019-1563 openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey

5. References:

https://access.redhat.com/security/cve/CVE-2019-1547
https://access.redhat.com/security/cve/CVE-2019-1549
https://access.redhat.com/security/cve/CVE-2019-1563
https://access.redhat.com/security/cve/CVE-2019-10081
https://access.redhat.com/security/cve/CVE-2019-10082
https://access.redhat.com/security/cve/CVE-2019-10092
https://access.redhat.com/security/cve/CVE-2019-10097
https://access.redhat.com/security/cve/CVE-2019-10098
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.apachehttp&downloadType=securityPatches&version=2.4.37
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.openssl&downloadType=securityPatches&version=1.1.1c
https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.37/

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIVAwUBXot+y9zjgjWX9erEAQg0TxAAmz55mqR/H1CrJ+yAscrw2aUjh0HQMGbe
AcmnemaluF2q5LVRQXiCSH804IRw378H8srbNWMHlHCJXqJ8voqehu+p0AL+inxj
aEJbds87mZhw495cDofuvMm8BmUNGg9kNHQ5jjLS73EoLwiD7kqVLq4H1SF+GRGG
bMBmHCcU74vmbqMIo34yftx1v6oGf6GrSuY03T4lWObdsCOyF9pBciyjZye0Qx38
2RsbA2ILqxREF6RYVVgNsc6kb1tE52C+XepoaORG1tNnYLv5ditcZ7K3/C1aNM5A
CO+bl5qMYMFrBSMsM9sk0jyrGMkvwUTKiOJRRa422NSnrdGOimtZz9shnEMhHf7i
LtNESbzu2fm6uMsgtOpBdlCCfCSxMPutspOu5cp+/gVsuhgrmIoGTTcXJpqR7QsI
/E4YwD9JOhLZrs8Zcj5t+I6Z6XzAKOT366BW9ChnhrLPJkoI4U9CPPWCGmfVLDNA
NhsX8km+8iVBAn8gMsl87QVyiezFtcaxAOvEOeMMflM4XdjSuYOzNXvgZiDb/Gss
QGhU5mXOftNcH3Q9L2u4RW+JNJKM1rXD1qU9mQVU87Evxqm5vVEwfcv/gZVOr51A
gV4flUKpXSRciL/wBS4SnuAzYL1kNxhHOH2skybg+6VJseazkpapdEP+K81Gy+UH
dnPoWHciEk4=
=G9gQ
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP2 security update
Advisory ID: RHSA-2020:1337-01
Product: Red Hat JBoss Core Services
Advisory URL: https://access.redhat.com/errata/RHSA-2020:1337
Issue date: 2020-04-06
CVE Names: CVE-2019-1547 CVE-2019-1549 CVE-2019-1563
CVE-2019-10081 CVE-2019-10082 CVE-2019-10092
CVE-2019-10097 CVE-2019-10098
=====================================================================

1. Summary:

Updated packages that provide Red Hat JBoss Core Services Pack Apache
Server 2.4.37 and fix several bugs, and add various enhancements are now
available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat JBoss Core Services on RHEL 6 Server – i386, noarch, ppc64, x86_64
Red Hat JBoss Core Services on RHEL 7 Server – noarch, ppc64, x86_64

3. Description:

This release adds the new Apache HTTP Server 2.4.37 Service Pack 2 packages
that are part of the JBoss Core Services offering.

This release serves as a replacement for Red Hat JBoss Core Services Pack
Apache Server 2.4.37 Service Pack 1 and includes bug fixes and
enhancements. Refer to the Release Notes for information on the most
significant bug fixes and enhancements included in this release.

Security Fix(es):

* openssl: side-channel weak encryption vulnerability (CVE-2019-1547)

* httpd: memory corruption on early pushes (CVE-2019-10081)

* httpd: read-after-free in h2 connection shutdown (CVE-2019-10082)

* httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)

* openssl: information disclosure in fork() (CVE-2019-1549)

* openssl: information disclosure in PKCS7_dataDecode and
CMS_decrypt_set1_pkey (CVE-2019-1563)

* httpd: limited cross-site scripting in mod_proxy error page
(CVE-2019-10092)

* httpd: mod_rewrite potential open redirect (CVE-2019-10098)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1743956 – CVE-2019-10092 httpd: limited cross-site scripting in mod_proxy error page
1743959 – CVE-2019-10098 httpd: mod_rewrite potential open redirect
1743966 – CVE-2019-10081 httpd: memory corruption on early pushes
1743974 – CVE-2019-10082 httpd: read-after-free in h2 connection shutdown
1743996 – CVE-2019-10097 httpd: null-pointer dereference in mod_remoteip
1752090 – CVE-2019-1547 openssl: side-channel weak encryption vulnerability
1752095 – CVE-2019-1549 openssl: information disclosure in fork()
1752100 – CVE-2019-1563 openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey

6. Package List:

Red Hat JBoss Core Services on RHEL 6 Server:

Source:
jbcs-httpd24-apr-1.6.3-86.jbcs.el6.src.rpm
jbcs-httpd24-brotli-1.0.6-21.jbcs.el6.src.rpm
jbcs-httpd24-httpd-2.4.37-52.jbcs.el6.src.rpm
jbcs-httpd24-mod_cluster-native-1.3.12-41.Final_redhat_2.jbcs.el6.src.rpm
jbcs-httpd24-mod_http2-1.11.3-22.jbcs.el6.src.rpm
jbcs-httpd24-openssl-1.1.1c-16.jbcs.el6.src.rpm

i386:
jbcs-httpd24-apr-1.6.3-86.jbcs.el6.i686.rpm
jbcs-httpd24-apr-debuginfo-1.6.3-86.jbcs.el6.i686.rpm
jbcs-httpd24-apr-devel-1.6.3-86.jbcs.el6.i686.rpm
jbcs-httpd24-brotli-1.0.6-21.jbcs.el6.i686.rpm
jbcs-httpd24-brotli-debuginfo-1.0.6-21.jbcs.el6.i686.rpm
jbcs-httpd24-brotli-devel-1.0.6-21.jbcs.el6.i686.rpm
jbcs-httpd24-httpd-2.4.37-52.jbcs.el6.i686.rpm
jbcs-httpd24-httpd-debuginfo-2.4.37-52.jbcs.el6.i686.rpm
jbcs-httpd24-httpd-devel-2.4.37-52.jbcs.el6.i686.rpm
jbcs-httpd24-httpd-selinux-2.4.37-52.jbcs.el6.i686.rpm
jbcs-httpd24-httpd-tools-2.4.37-52.jbcs.el6.i686.rpm
jbcs-httpd24-mod_cluster-native-1.3.12-41.Final_redhat_2.jbcs.el6.i686.rpm
jbcs-httpd24-mod_cluster-native-debuginfo-1.3.12-41.Final_redhat_2.jbcs.el6.i686.rpm
jbcs-httpd24-mod_http2-1.11.3-22.jbcs.el6.i686.rpm
jbcs-httpd24-mod_http2-debuginfo-1.11.3-22.jbcs.el6.i686.rpm
jbcs-httpd24-mod_ldap-2.4.37-52.jbcs.el6.i686.rpm
jbcs-httpd24-mod_proxy_html-2.4.37-52.jbcs.el6.i686.rpm
jbcs-httpd24-mod_session-2.4.37-52.jbcs.el6.i686.rpm
jbcs-httpd24-mod_ssl-2.4.37-52.jbcs.el6.i686.rpm
jbcs-httpd24-openssl-1.1.1c-16.jbcs.el6.i686.rpm
jbcs-httpd24-openssl-debuginfo-1.1.1c-16.jbcs.el6.i686.rpm
jbcs-httpd24-openssl-devel-1.1.1c-16.jbcs.el6.i686.rpm
jbcs-httpd24-openssl-libs-1.1.1c-16.jbcs.el6.i686.rpm
jbcs-httpd24-openssl-perl-1.1.1c-16.jbcs.el6.i686.rpm
jbcs-httpd24-openssl-static-1.1.1c-16.jbcs.el6.i686.rpm

noarch:
jbcs-httpd24-httpd-manual-2.4.37-52.jbcs.el6.noarch.rpm

ppc64:
jbcs-httpd24-brotli-1.0.6-21.jbcs.el6.ppc64.rpm
jbcs-httpd24-brotli-debuginfo-1.0.6-21.jbcs.el6.ppc64.rpm
jbcs-httpd24-brotli-devel-1.0.6-21.jbcs.el6.ppc64.rpm
jbcs-httpd24-mod_http2-1.11.3-22.jbcs.el6.ppc64.rpm
jbcs-httpd24-mod_http2-debuginfo-1.11.3-22.jbcs.el6.ppc64.rpm

x86_64:
jbcs-httpd24-apr-1.6.3-86.jbcs.el6.x86_64.rpm
jbcs-httpd24-apr-debuginfo-1.6.3-86.jbcs.el6.x86_64.rpm
jbcs-httpd24-apr-devel-1.6.3-86.jbcs.el6.x86_64.rpm
jbcs-httpd24-brotli-1.0.6-21.jbcs.el6.x86_64.rpm
jbcs-httpd24-brotli-debuginfo-1.0.6-21.jbcs.el6.x86_64.rpm
jbcs-httpd24-brotli-devel-1.0.6-21.jbcs.el6.x86_64.rpm
jbcs-httpd24-httpd-2.4.37-52.jbcs.el6.x86_64.rpm
jbcs-httpd24-httpd-debuginfo-2.4.37-52.jbcs.el6.x86_64.rpm
jbcs-httpd24-httpd-devel-2.4.37-52.jbcs.el6.x86_64.rpm
jbcs-httpd24-httpd-selinux-2.4.37-52.jbcs.el6.x86_64.rpm
jbcs-httpd24-httpd-tools-2.4.37-52.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_cluster-native-1.3.12-41.Final_redhat_2.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_cluster-native-debuginfo-1.3.12-41.Final_redhat_2.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_http2-1.11.3-22.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_http2-debuginfo-1.11.3-22.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_ldap-2.4.37-52.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_proxy_html-2.4.37-52.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_session-2.4.37-52.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_ssl-2.4.37-52.jbcs.el6.x86_64.rpm
jbcs-httpd24-openssl-1.1.1c-16.jbcs.el6.x86_64.rpm
jbcs-httpd24-openssl-debuginfo-1.1.1c-16.jbcs.el6.x86_64.rpm
jbcs-httpd24-openssl-devel-1.1.1c-16.jbcs.el6.x86_64.rpm
jbcs-httpd24-openssl-libs-1.1.1c-16.jbcs.el6.x86_64.rpm
jbcs-httpd24-openssl-perl-1.1.1c-16.jbcs.el6.x86_64.rpm
jbcs-httpd24-openssl-static-1.1.1c-16.jbcs.el6.x86_64.rpm

Red Hat JBoss Core Services on RHEL 7 Server:

Source:
jbcs-httpd24-apr-1.6.3-86.jbcs.el7.src.rpm
jbcs-httpd24-brotli-1.0.6-21.jbcs.el7.src.rpm
jbcs-httpd24-httpd-2.4.37-52.jbcs.el7.src.rpm
jbcs-httpd24-mod_cluster-native-1.3.12-41.Final_redhat_2.jbcs.el7.src.rpm
jbcs-httpd24-mod_http2-1.11.3-22.jbcs.el7.src.rpm
jbcs-httpd24-openssl-1.1.1c-16.jbcs.el7.src.rpm

noarch:
jbcs-httpd24-httpd-manual-2.4.37-52.jbcs.el7.noarch.rpm

ppc64:
jbcs-httpd24-brotli-1.0.6-21.jbcs.el7.ppc64.rpm
jbcs-httpd24-brotli-debuginfo-1.0.6-21.jbcs.el7.ppc64.rpm
jbcs-httpd24-brotli-devel-1.0.6-21.jbcs.el7.ppc64.rpm
jbcs-httpd24-mod_http2-1.11.3-22.jbcs.el7.ppc64.rpm
jbcs-httpd24-mod_http2-debuginfo-1.11.3-22.jbcs.el7.ppc64.rpm

x86_64:
jbcs-httpd24-apr-1.6.3-86.jbcs.el7.x86_64.rpm
jbcs-httpd24-apr-debuginfo-1.6.3-86.jbcs.el7.x86_64.rpm
jbcs-httpd24-apr-devel-1.6.3-86.jbcs.el7.x86_64.rpm
jbcs-httpd24-brotli-1.0.6-21.jbcs.el7.x86_64.rpm
jbcs-httpd24-brotli-debuginfo-1.0.6-21.jbcs.el7.x86_64.rpm
jbcs-httpd24-brotli-devel-1.0.6-21.jbcs.el7.x86_64.rpm
jbcs-httpd24-httpd-2.4.37-52.jbcs.el7.x86_64.rpm
jbcs-httpd24-httpd-debuginfo-2.4.37-52.jbcs.el7.x86_64.rpm
jbcs-httpd24-httpd-devel-2.4.37-52.jbcs.el7.x86_64.rpm
jbcs-httpd24-httpd-selinux-2.4.37-52.jbcs.el7.x86_64.rpm
jbcs-httpd24-httpd-tools-2.4.37-52.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_cluster-native-1.3.12-41.Final_redhat_2.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_cluster-native-debuginfo-1.3.12-41.Final_redhat_2.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_http2-1.11.3-22.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_http2-debuginfo-1.11.3-22.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_ldap-2.4.37-52.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_proxy_html-2.4.37-52.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_session-2.4.37-52.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_ssl-2.4.37-52.jbcs.el7.x86_64.rpm
jbcs-httpd24-openssl-1.1.1c-16.jbcs.el7.x86_64.rpm
jbcs-httpd24-openssl-debuginfo-1.1.1c-16.jbcs.el7.x86_64.rpm
jbcs-httpd24-openssl-devel-1.1.1c-16.jbcs.el7.x86_64.rpm
jbcs-httpd24-openssl-libs-1.1.1c-16.jbcs.el7.x86_64.rpm
jbcs-httpd24-openssl-perl-1.1.1c-16.jbcs.el7.x86_64.rpm
jbcs-httpd24-openssl-static-1.1.1c-16.jbcs.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-1547
https://access.redhat.com/security/cve/CVE-2019-1549
https://access.redhat.com/security/cve/CVE-2019-1563
https://access.redhat.com/security/cve/CVE-2019-10081
https://access.redhat.com/security/cve/CVE-2019-10082
https://access.redhat.com/security/cve/CVE-2019-10092
https://access.redhat.com/security/cve/CVE-2019-10097
https://access.redhat.com/security/cve/CVE-2019-10098
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.37/

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIVAwUBXouCx9zjgjWX9erEAQg57RAAni5W7SYIMdXwBveY7LVVU8HUzHhrOSH0
H6dPGPAhcfR2XehGfODuqax7Ma94mZKE2PXxujpmxlA1Scg+IvpG9Mrj4QllKgEU
v+Gsq8Hs3LtZS7B1sytl2vIKUOuUhjR8W+61Zh5X8oG5POhQbaavjTakGjPHt8AU
mXWraZevjvIzHWKitg9dhAbCerEy+aaf4yhgrXadqv5kwT1ud2TNqDqR4ayAx4Gm
UjOTvhg04eMExzTIUjabpN1khA70tMljxWWTwwejj2uCXeGEggImkL4hM882FwVZ
Z9FTyQjY92r8S8jbxmQxo7MC7bSoZGrl//Dg+4EA+60j1p7OjXISLKXBZYoQcrtr
c+CZXbUVPXH8vBcGF5TixrfbpZnF2GYq4S0XajhhXWJ0kskAR4zAjTmD5w8vVIBr
PJ/yPeAYSFjkDuKaKnbvrXN8YS4hLfcW5EbwsSD5GXF1bgC9pftdpJJ321ElSYIW
zdqujswl6NbMozTXBPbxF3lmNY+DpDeJZ9FZy5nfDxpGNNzkk9kdkrQlUZ5Uy/78
1/kEmhhAnr0s19WPsbhAk4mdzFr+pcRYZcJTtsOVTH3CoVO2+g9icZOLmmkk3lx3
L4GcquyY7qYsn2frT5HuGME/iXpkKjlJlY0EjUEjvPCO9IzLWlGMWDvKXNG/Ma7L
i1VWpzjNjpU=
=uXCZ
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

Top
More in Preporuke
Sigurnosni nedostatak programskog paketa ipmitool

Otkriven je sigurnosni nedostatak u programskom paketu ipmitool za operacijski sustav RHEL. Otkriveni nedostatak potencijalnim napadačima omogućuje izvršavanje proizvoljnog programskog...

Close