Skip to content
OpenAdvisories
Medium RHSA-2010:0602 39 CVEs

Red Hat Security Advisory: Red Hat Certificate System 7.3 security update

Published Sep 15, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 39

ReleasePackageFixed in
Red Hat · Certificate System 7 certificate_system:7.3 ant 0:1.6.5-1jpp_1rh
Red Hat · Certificate System 7 certificate_system:7.3 avalon-logkit 0:1.2-2jpp_4rh
Red Hat · Certificate System 7 certificate_system:7.3 axis 0:1.2.1-1jpp_3rh
Red Hat · Certificate System 7 certificate_system:7.3 classpathx-jaf 0:1.0-2jpp_6rh
Red Hat · Certificate System 7 certificate_system:7.3 classpathx-mail 0:1.1.1-2jpp_8rh
Red Hat · Certificate System 7 certificate_system:7.3 geronimo-ejb-2.1-api 0:1.0-0.M4.1jpp_10rh
Red Hat · Certificate System 7 certificate_system:7.3 geronimo-j2ee-1.4-apis 0:1.0-0.M4.1jpp_10rh
Red Hat · Certificate System 7 certificate_system:7.3 geronimo-j2ee-connector-1.5-api 0:1.0-0.M4.1jpp_10rh
Red Hat · Certificate System 7 certificate_system:7.3 geronimo-j2ee-deployment-1.1-api 0:1.0-0.M4.1jpp_10rh
Red Hat · Certificate System 7 certificate_system:7.3 geronimo-j2ee-management-1.0-api 0:1.0-0.M4.1jpp_10rh
Red Hat · Certificate System 7 certificate_system:7.3 geronimo-jms-1.1-api 0:1.0-0.M4.1jpp_10rh
Red Hat · Certificate System 7 certificate_system:7.3 geronimo-jsp-2.0-api 0:1.0-0.M4.1jpp_10rh
Red Hat · Certificate System 7 certificate_system:7.3 geronimo-jta-1.0.1B-api 0:1.0-0.M4.1jpp_10rh
Red Hat · Certificate System 7 certificate_system:7.3 geronimo-servlet-2.4-api 0:1.0-0.M4.1jpp_10rh
Red Hat · Certificate System 7 certificate_system:7.3 geronimo-specs 0:1.0-0.M4.1jpp_10rh
Red Hat · Certificate System 7 certificate_system:7.3 geronimo-specs-javadoc 0:1.0-0.M4.1jpp_10rh
Red Hat · Certificate System 7 certificate_system:7.3 jakarta-commons-modeler 0:2.0-3jpp_2rh
Red Hat · Certificate System 7 certificate_system:7.3 log4j 0:1.2.12-1jpp_1rh
Red Hat · Certificate System 7 certificate_system:7.3 mx4j 1:3.0.1-1jpp_4rh
Red Hat · Certificate System 7 certificate_system:7.3 pcsc-lite 0:1.3.3-3.el4
Red Hat · Certificate System 7 certificate_system:7.3 pcsc-lite-debuginfo 0:1.3.3-3.el4
Red Hat · Certificate System 7 certificate_system:7.3 pcsc-lite-doc 0:1.3.3-3.el4
Red Hat · Certificate System 7 certificate_system:7.3 pcsc-lite-libs 0:1.3.3-3.el4
Red Hat · Certificate System 7 certificate_system:7.3 rhpki-ca 0:7.3.0-20.el4
Red Hat · Certificate System 7 certificate_system:7.3 rhpki-java-tools 0:7.3.0-10.el4
Red Hat · Certificate System 7 certificate_system:7.3 rhpki-kra 0:7.3.0-14.el4
Red Hat · Certificate System 7 certificate_system:7.3 rhpki-manage 0:7.3.0-19.el4
Red Hat · Certificate System 7 certificate_system:7.3 rhpki-native-tools 0:7.3.0-6.el4
Red Hat · Certificate System 7 certificate_system:7.3 rhpki-ocsp 0:7.3.0-13.el4
Red Hat · Certificate System 7 certificate_system:7.3 rhpki-tks 0:7.3.0-13.el4
Red Hat · Certificate System 7 certificate_system:7.3 tomcat5 0:5.5.23-0jpp_4rh.16
Red Hat · Certificate System 7 certificate_system:7.3 tomcat5-common-lib 0:5.5.23-0jpp_4rh.16
Red Hat · Certificate System 7 certificate_system:7.3 tomcat5-jasper 0:5.5.23-0jpp_4rh.16
Red Hat · Certificate System 7 certificate_system:7.3 tomcat5-jsp-2.0-api 0:5.5.23-0jpp_4rh.16
Red Hat · Certificate System 7 certificate_system:7.3 tomcat5-server-lib 0:5.5.23-0jpp_4rh.16
Red Hat · Certificate System 7 certificate_system:7.3 tomcat5-servlet-2.4-api 0:5.5.23-0jpp_4rh.16
Red Hat · Certificate System 7 certificate_system:7.3 xerces-j2 0:2.7.1-1jpp_1rh
Red Hat · Certificate System 7 certificate_system:7.3 xml-commons 0:1.3.02-2jpp_1rh
Red Hat · Certificate System 7 certificate_system:7.3 xml-commons-apis 0:1.3.02-2jpp_1rh

Vulnerabilities 39

  • Medium 6.1
    CVE-2007-4465 EPSS 26%

    Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on…

    apache2 Debian
  • Medium 5.3
    CVE-2008-5515 EPSS 19%

    Directory Traversal in Apache Tomcat

    Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass int…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2005-2090 EPSS 26%

    Tomcat Vulnerable to Web Cache Poisoning

    Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Co…

    org.apache.tomcat:tomcat Maven
  • High —
    CVE-2005-3510

    Apache Tomcat Vulnerable to Denial of Service (DoS) via Simultaneous Requests

    Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2006-3835 Public exploit EPSS 48%

    Apache Tomcat Reveals Directories

    Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2006-3918 Public exploit EPSS 95%

    http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 befor…

    apache2 Debian
  • Unscored —
    CVE-2006-5752 EPSS 28%

    Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when E…

    apache2 Debian
  • Medium —
    CVE-2007-0450 Public exploit EPSS 91%

    Apache Tomcat Directory Traversal

    Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with com…

    org.apache.tomcat:tomcat apache2 Wolfi Maven
  • Unscored —
    CVE-2007-1349 EPSS 10%

    PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO be…

    libapache2-mod-perl2 Debian
  • Low —
    CVE-2007-1358 EPSS 20%

    Apache Tomcat XSS In Accept-Language Headers

    Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 26…

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2007-1863 EPSS 12%

    cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Proces…

    apache2 Debian
  • Unscored —
    CVE-2007-3304

    Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by …

    apache2 Debian
  • Medium —
    CVE-2007-3382 Public exploit EPSS 37%

    Apache Tomcat treats single quotes as delimiters in cookies

    Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to cond…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2007-3385 EPSS 17%

    Apache Tomcat Mishandles Character Sequence in Cookies

    Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attacke…

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2007-3847 EPSS 13%

    The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows rem…

    apache2 Debian
  • Unscored —
    CVE-2007-5000 EPSS 47%

    Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and …

    apache2 Debian
  • Unscored —
    CVE-2007-5116

    Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows conte…

    perl Debian
  • Medium —
    CVE-2007-5333 Public exploit EPSS 63%

    Exposure of Sensitive Information in Apache Tomcat

    Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs…

    org.apache.tomcat:tomcat Maven
  • Low —
    CVE-2007-5461 Public exploit EPSS 40%

    Apache Tomcat Path Traversal Vulnerability

    Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that s…

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2007-6388 EPSS 76%

    Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.…

    apache2 Debian
  • Unscored —
    CVE-2008-0005 EPSS 15%

    mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a …

    apache2 Debian
  • Unscored —
    CVE-2008-0128 Public exploit EPSS 20%

    The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the…

  • Medium —
    CVE-2008-1232 Public exploit EPSS 76%

    Apache Tomcat Cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the Http…

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2008-1927

    Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corrupt…

    perl Debian
  • Unscored —
    CVE-2008-2364 EPSS 13%

    The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.6…

    apache2 Debian
  • Medium —
    CVE-2008-2370 Public exploit EPSS 53%

    Apache Tomcat Path Traversal Vulnerability

    Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attac…

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2008-2939 EPSS 39%

    Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and m…

    apache2 Debian
  • Unscored —
    CVE-2009-0023

    The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers…

    apr-util Debian
  • Medium —
    CVE-2009-0033 EPSS 10%

    Apache Tomcat Denial of Service via Malformed Request Headers

    Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid he…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2009-0580 Public exploit EPSS 94%

    Exposure of Sensitive Information in Apache Tomcat

    Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to i…

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2009-1891 EPSS 17%

    The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associ…

    apache2 Debian
  • Unscored —
    CVE-2009-1955 Public exploit EPSS 53%

    The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_da…

    apr-util Debian
  • Unscored —
    CVE-2009-1956 EPSS 12%

    Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows rem…

    apr-util Debian
  • Unscored —
    CVE-2009-2412 EPSS 14%

    Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka AP…

    apr-util apr Debian
  • Unscored —
    CVE-2009-3094

    The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Apache HTTP Server 2.…

    apache2 Debian
  • Unscored —
    CVE-2009-3095 EPSS 14%

    The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and s…

    apache2 Debian
  • Unscored —
    CVE-2009-4901

    The MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite bef…

  • Unscored —
    CVE-2010-0407

    Multiple buffer overflows in the MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka P…

    pcsc-lite Debian
  • Unscored —
    CVE-2010-0434 EPSS 18%

    The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded M…

    apache2 Debian

References

  • article
    http://www.redhat.com/security/updates/classification/#moderate
  • article
    http://www.redhat.com/docs/manuals/cert-system/7.3/html/Administration_Guide/Administration_Guide-Updating_Certificate_System_Packages-Updating_a_Solaris_9_system_using_pkgrm_and_pkgadd.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=200732
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=237079
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=237080
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=237084
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=237085
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=240423
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=244658
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=244803
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=245111
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=245112
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=247972
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=247976
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=250731
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=289511
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=323571
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=333791
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=419931
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=427228
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=427739
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=427766
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=429821
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=443928
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=451615
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=457597
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=457934
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=458250
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=493381
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=503928
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=503978
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=504390
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=504555
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=504753
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=509125
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=515698
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=521619
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=522209
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=570171