Red Hat Security Advisory: Red Hat JBoss Web Server 5.0 Service Pack 1 security and bug fix update

Fixed packages 22

Vulnerabilities 2

• Medium 5.9
  CVE-2018-8037 EPSS 11%

  Apache Tomcat Race Condition vulnerability

  If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NI…

  Apache Software Foundation Apache Tomcat tomcat8 org.apache.tomcat.embed:tomcat-embed-core Ubuntu Maven
  Aug 2, 2018
• Medium 4.3
  CVE-2018-11784 Public exploit Scanner template EPSS 98%

  Apache Tomcat Open Redirect vulnerability

  When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redi…

  Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  Oct 4, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1607582
• article
  https://issues.redhat.com/browse/JWS-1028
• article
  https://issues.redhat.com/browse/JWS-1064
• article
  https://issues.redhat.com/browse/JWS-1065
• article
  https://issues.redhat.com/browse/JWS-1121
• article
  https://issues.redhat.com/browse/JWS-1124
• article
  https://issues.redhat.com/browse/JWS-996
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2868.json
• report
  https://access.redhat.com/security/cve/CVE-2018-8037
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-8037
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-8037
• report
  https://access.redhat.com/security/cve/CVE-2018-11784
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1636512
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-11784
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-11784
• article
  http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.91
• article
  http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.34
• article
  http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.12