Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 Service Pack 1 security update

Fixed packages 29

Vulnerabilities 2

• High 8.1
  CVE-2016-5388 EPSS 51%

  Improper Access Control in Apache Tomcat

  Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might…

  tomcat8 tomcat7 tomcat6 org.apache.tomcat:tomcat-catalina Ubuntu Maven
  Jul 19, 2016
• Unscored —
  CVE-2016-5387 EPSS 56%

  The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from …

  apache2 apache2 apache2 Debian Ubuntu Alpine
  Jul 19, 2016

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/3/html-single/3.0.3_Release_Notes/index.html
• article
  https://access.redhat.com/security/vulnerabilities/httpoxy
• article
  https://access.redhat.com/solutions/2435491
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1353755
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1353809
• article
  https://issues.redhat.com/browse/JWS-483
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1636.json
• report
  https://access.redhat.com/security/cve/CVE-2016-5387
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-5387
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-5387
• article
  https://httpoxy.org/
• article
  https://www.apache.org/security/asf-httpoxy-response.txt
• report
  https://access.redhat.com/security/cve/CVE-2016-5388
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-5388
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-5388