Red Hat Security Advisory: Red Hat JBoss Web Server security and bug fix update

Fixed packages 74

Vulnerabilities 5

• High 8.1
  CVE-2017-12615 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server

  When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could th…

  Apache Software Foundation Apache Tomcat org.apache.tomcat.embed:tomcat-embed-core Maven
  Sep 19, 2017

  KEV Mar 25, 2022
• High 8.1
  CVE-2017-12617 Exploited Public exploit Scanner template EPSS 100%

  Unrestricted Upload of File with Dangerous Type Apache Tomcat

  When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP fil…

  Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  Oct 3, 2017

  KEV Mar 25, 2022
• High 7.5
  CVE-2016-2183 Public exploit EPSS 95%

  The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a b…

  openjdk-8 openssl openjdk-7 openssl Ubuntu Alpine
  Sep 1, 2016
• Unscored —
  CVE-2017-9788 EPSS 57%

  In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type '…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu
  Jul 13, 2017
• Unscored —
  CVE-2017-9798 Public exploit EPSS 95%

  Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a use…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Sep 18, 2017

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/articles/3227901
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1369383
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1470748
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1490344
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1493075
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1493220
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1494283
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3113.json
• report
  https://access.redhat.com/security/cve/CVE-2016-2183
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-2183
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-2183
• article
  https://access.redhat.com/articles/2548661
• article
  https://access.redhat.com/errata/RHSA-2016:1940
• article
  https://sweet32.info/
• report
  https://access.redhat.com/security/cve/CVE-2017-9788
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-9788
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-9788
• article
  https://httpd.apache.org/security/vulnerabilities_22.html#2.2.34
• article
  https://httpd.apache.org/security/vulnerabilities_24.html#2.4.27
• report
  https://access.redhat.com/security/cve/CVE-2017-9798
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-9798
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-9798
• article
  https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html
• report
  https://access.redhat.com/security/cve/CVE-2017-12615
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-12615
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-12615
• article
  https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.81
• article
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• report
  https://access.redhat.com/security/cve/CVE-2017-12617
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-12617
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-12617
• article
  https://tomcat.apache.org/security-7.html
• article
  https://tomcat.apache.org/security-8.html