Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 for RHEL 7

Fixed packages 19

Vulnerabilities 7

• Medium 5.5
  CVE-2016-7056

  A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to reco…

  The OpenSSL Project openssl openssl openssl Debian Ubuntu
  Sep 10, 2018
• Unscored —
  CVE-2016-0736 Public exploit EPSS 49%

  In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured …

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu
  Jul 27, 2017
• Unscored —
  CVE-2016-2161 EPSS 21%

  In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and e…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu
  Jul 27, 2017
• Unscored —
  CVE-2016-6304 EPSS 63%

  Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote a…

  openssl openssl openssl Debian Ubuntu Alpine
  Sep 26, 2016
• Unscored —
  CVE-2016-8610 Public exploit EPSS 40%

  A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL prot…

  OpenSSL OpenSSL openssl openssl Debian Ubuntu
  Nov 13, 2017
• Unscored —
  CVE-2016-8740 Public exploit EPSS 79%

  The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h…

  Apache Software Foundation Apache HTTP Server apache2 Debian
  Dec 5, 2016
• Unscored —
  CVE-2016-8743 EPSS 13%

  Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests an…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu
  Jul 27, 2017

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en/red-hat-jboss-core-services/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1377600
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1384743
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1401528
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1406744
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1406753
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1406822
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1412120
• article
  https://issues.redhat.com/browse/JBCS-319
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1413.json
• report
  https://access.redhat.com/security/cve/CVE-2016-0736
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-0736
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-0736
• article
  https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25
• article
  https://www.redteam-pentesting.de/advisories/rt-sa-2016-001.txt
• report
  https://access.redhat.com/security/cve/CVE-2016-2161
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-2161
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-2161
• report
  https://access.redhat.com/security/cve/CVE-2016-6304
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-6304
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-6304
• article
  https://www.openssl.org/news/secadv/20160922.txt
• report
  https://access.redhat.com/security/cve/CVE-2016-7056
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-7056
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-7056
• report
  https://access.redhat.com/security/cve/CVE-2016-8610
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-8610
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-8610
• article
  http://security.360.cn/cve/CVE-2016-8610
• report
  https://access.redhat.com/security/cve/CVE-2016-8740
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-8740
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-8740
• article
  http://seclists.org/bugtraq/2016/Dec/3
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://access.redhat.com/security/cve/CVE-2016-8743
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-8743
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-8743