Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 4 security and bug fix update

Fixed packages 52

Vulnerabilities 3

• Critical 9.8
  CVE-2018-8014 EPSS 21%

  The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins

  The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have…

  Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  May 16, 2018
• Unscored —
  CVE-2018-8019

  When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid…

  Apache Software Foundation Apache Tomcat Native tomcat-native tomcat-native Debian Ubuntu
  Jul 31, 2018
• Unscored —
  CVE-2018-8020

  Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced res…

  Apache Software Foundation Apache Tomcat Native tomcat-native tomcat-native Debian Ubuntu
  Jul 31, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/3.1/html-single/red_hat_jboss_web_server_3.1_service_pack_4_release_notes/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1579611
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1581569
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1583998
• article
  https://issues.redhat.com/browse/JWS-1042
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2469.json
• report
  https://access.redhat.com/security/cve/CVE-2018-8014
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-8014
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-8014
• article
  http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.89
• article
  http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.53
• article
  http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.32
• article
  http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.9
• report
  https://access.redhat.com/security/cve/CVE-2018-8019
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-8019
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-8019
• article
  http://mail-archives.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180721095943.GA24320%40minotaur.apache.org%3E
• article
  http://tomcat.apache.org/security-native.html#Fixed_in_Apache_Tomcat_Native_Connector_1.2.17
• report
  https://access.redhat.com/security/cve/CVE-2018-8020
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-8020
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-8020