Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.0 update

Fixed packages 55

Vulnerabilities 6

• Medium —
  CVE-2013-4590

  Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

  Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document c…

  org.apache.tomcat:tomcat Maven
  Feb 26, 2014
• Unscored —
  CVE-2014-0118 EPSS 37%

  The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when…

  apache2 apache2 Debian Ubuntu
  Jul 20, 2014
• Medium —
  CVE-2014-0119

  Missing XML Validation in Apache Tomcat

  Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web applicatio…

  org.apache.tomcat:tomcat tomcat7 tomcat6 org.apache.tomcat:tomcat-catalina Ubuntu Maven
  May 31, 2014
• Unscored —
  CVE-2014-0226 Public exploit EPSS 86%

  Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a deni…

  apache2 apache2 Debian Ubuntu
  Jul 20, 2014
• Medium —
  CVE-2014-0227 EPSS 21%

  Improper Input Validation in Apache Tomcat

  java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to …

  org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  Feb 16, 2015
• Unscored —
  CVE-2014-0231 EPSS 45%

  The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote atta…

  apache2 apache2 Debian Ubuntu
  Jul 20, 2014

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Web_Server/2.1/html/2.1.0_Release_Notes/index.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1069911
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1102038
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1120596
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1120601
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1120603
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1088.json
• report
  https://access.redhat.com/security/cve/CVE-2013-4590
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-4590
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-4590
• report
  https://access.redhat.com/security/cve/CVE-2014-0118
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-0118
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-0118
• article
  http://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://access.redhat.com/security/cve/CVE-2014-0119
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-0119
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-0119
• report
  https://access.redhat.com/security/cve/CVE-2014-0226
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-0226
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-0226
• report
  https://access.redhat.com/security/cve/CVE-2014-0227
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1109196
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-0227
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-0227
• article
  https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43
• article
  https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55
• report
  https://access.redhat.com/security/cve/CVE-2014-0231
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-0231
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-0231