Red Hat Security Advisory: Red Hat JBoss Web Server 2 security update

Fixed packages 56

Vulnerabilities 4

• High 7.5
  CVE-2017-5647 EPSS 17%

  Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

  A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing …

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven
  Apr 17, 2017
• High 7.5
  CVE-2017-5664 EPSS 17%

  Improper Handling of Exceptional Conditions in Apache Tomcat

  The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is prese…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven
  Jun 6, 2017
• Unscored —
  CVE-2016-6304 EPSS 63%

  Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote a…

  openssl openssl openssl Debian Ubuntu Alpine
  Sep 26, 2016
• Unscored —
  CVE-2016-8610 Public exploit EPSS 40%

  A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL prot…

  OpenSSL OpenSSL openssl openssl Debian Ubuntu
  Nov 13, 2017

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/articles/3155411
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1377600
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1384743
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1441205
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1459158
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2493.json
• report
  https://access.redhat.com/security/cve/CVE-2016-6304
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-6304
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-6304
• article
  https://www.openssl.org/news/secadv/20160922.txt
• report
  https://access.redhat.com/security/cve/CVE-2016-8610
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-8610
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-8610
• article
  http://security.360.cn/cve/CVE-2016-8610
• report
  https://access.redhat.com/security/cve/CVE-2017-5647
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5647
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5647
• report
  https://access.redhat.com/security/cve/CVE-2017-5664
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5664
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5664
• article
  https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.78
• article
  https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.44
• article
  https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.15