Skip to content
OpenAdvisories
Critical 1 exploited CVE RHSA-2017:0456 11 CVEs

Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 security and enhancement update

Published Sep 29, 2024 · Updated Oct 8, 2026

Ecosystem: Red Hat

Fixed packages 39

ReleasePackageFixed in
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 hibernate4-c3p0-eap6 0:4.2.23-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 hibernate4-core-eap6 0:4.2.23-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 hibernate4-eap6 0:4.2.23-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 hibernate4-entitymanager-eap6 0:4.2.23-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 hibernate4-envers-eap6 0:4.2.23-1.Final_redhat_1.1.ep6.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 jbcs-httpd24-apache-commons-daemon 0:1.0.15-1.redhat_2.1.jbcs.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 jbcs-httpd24-apache-commons-daemon-jsvc 1:1.0.15-17.redhat_2.jbcs.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo 1:1.0.15-17.redhat_2.jbcs.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 jbcs-httpd24-runtime 0:1-3.jbcs.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 mod_cluster 0:1.3.5-2.Final_redhat_2.1.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 mod_cluster-tomcat7 0:1.3.5-2.Final_redhat_2.1.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 mod_cluster-tomcat8 0:1.3.5-2.Final_redhat_2.1.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat-native 0:1.2.8-9.redhat_9.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat-native-debuginfo 0:1.2.8-9.redhat_9.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat-vault 0:1.0.8-9.Final_redhat_2.1.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7 0:7.0.70-16.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-admin-webapps 0:7.0.70-16.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-docs-webapp 0:7.0.70-16.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-el-2.2-api 0:7.0.70-16.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-javadoc 0:7.0.70-16.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-jsp-2.2-api 0:7.0.70-16.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-jsvc 0:7.0.70-16.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-lib 0:7.0.70-16.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-log4j 0:7.0.70-16.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-selinux 0:7.0.70-16.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-servlet-3.0-api 0:7.0.70-16.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-webapps 0:7.0.70-16.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8 0:8.0.36-17.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-admin-webapps 0:8.0.36-17.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-docs-webapp 0:8.0.36-17.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-el-2.2-api 0:8.0.36-17.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-javadoc 0:8.0.36-17.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-jsp-2.3-api 0:8.0.36-17.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-jsvc 0:8.0.36-17.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-lib 0:8.0.36-17.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-log4j 0:8.0.36-17.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-selinux 0:8.0.36-17.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-servlet-3.1-api 0:8.0.36-17.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-webapps 0:8.0.36-17.ep7.el7

Vulnerabilities 11

  • Critical 9.8
    CVE-2016-8735 Exploited EPSS 90%

    Apache Tomcat Improper Access Control vulnerability

    Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this lis…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
    KEV May 12, 2023
  • Critical 9.1
    CVE-2016-5018 EPSS 10%

    Authentication Bypass Using an Alternate Path or Channel in Apache Tomcat

    In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • High 7.5
    CVE-2016-3092 EPSS 37%

    High severity vulnerability that affects commons-fileupload:commons-fileupload

    The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consu…

    tomcat8 tomcat7 tomcat6 libcommons-fileupload-java Debian Ubuntu Maven
  • High 7.5
    CVE-2016-6796

    Apache Tomcat vulnerable to SecurityManager bypass

    A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Se…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven
  • High 7.5
    CVE-2016-6797

    Incorrect Authorization in Apache Tomcat

    The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the we…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven
  • High 7.5
    CVE-2016-8745 EPSS 16%

    Concurrent Execution using Shared Resource with Improper Synchronization in Apache Tomcat

    A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processo…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • High 7.1
    CVE-2016-6816 Public exploit EPSS 40%

    Improper Input Validation in Apache Tomcat

    The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • Medium 5.9
    CVE-2016-0762

    Observable Discrepancy in Apache Tomcat

    The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possibl…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven
  • Medium 5.3
    CVE-2016-6794

    System Property Disclosure in Apache Tomcat

    When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system pr…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven
  • Unscored —
    CVE-2016-1240 Public exploit

    The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debi…

    tomcat8 tomcat7 tomcat6 Ubuntu
  • Unscored —
    CVE-2016-6325

    The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak perm…

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1349468
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1367447
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1376712
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1390493
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1390515
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1390520
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1390525
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1390526
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1397484
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1397485
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1403824
  • article
    https://issues.redhat.com/browse/JWS-268
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0456.json
  • report
    https://access.redhat.com/security/cve/CVE-2016-0762
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-0762
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-0762
  • article
    https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.47
  • article
    https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.72
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37
  • report
    https://access.redhat.com/security/cve/CVE-2016-1240
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-1240
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-1240
  • article
    http://legalhackers.com/advisories/Tomcat-DebPkgs-Root-Privilege-Escalation-Exploit-CVE-2016-1240.txt
  • report
    https://access.redhat.com/security/cve/CVE-2016-3092
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-3092
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-3092
  • article
    http://tomcat.apache.org/security-7.html
  • article
    http://tomcat.apache.org/security-8.html
  • report
    https://access.redhat.com/security/cve/CVE-2016-5018
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-5018
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-5018
  • report
    https://access.redhat.com/security/cve/CVE-2016-6325
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-6325
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-6325
  • report
    https://access.redhat.com/security/cve/CVE-2016-6794
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-6794
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-6794
  • report
    https://access.redhat.com/security/cve/CVE-2016-6796