Skip to content
OpenAdvisories
Critical RHSA-2019:0451 2 CVEs

Red Hat Security Advisory: Red Hat JBoss Web Server 5.0 Service Pack 2 security and bug fix update

Published Sep 13, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 42

ReleasePackageFixed in
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el6 jws5-ecj 0:4.6.1-6.redhat_1.1.el6jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el6 jws5-javapackages-tools 0:3.4.1-5.15.10.el6jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el6 jws5-jboss-logging 0:3.3.1-5.Final_redhat_1.1.el6jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el6 jws5-mod_cluster 0:1.4.0-9.Final_redhat_1.1.el6jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el6 jws5-mod_cluster-tomcat 0:1.4.0-9.Final_redhat_1.1.el6jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el6 jws5-python-javapackages 0:3.4.1-5.15.10.el6jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el6 jws5-tomcat 0:9.0.7-17.redhat_16.1.el6jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el6 jws5-tomcat-admin-webapps 0:9.0.7-17.redhat_16.1.el6jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el6 jws5-tomcat-docs-webapp 0:9.0.7-17.redhat_16.1.el6jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el6 jws5-tomcat-el-3.0-api 0:9.0.7-17.redhat_16.1.el6jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el6 jws5-tomcat-javadoc 0:9.0.7-17.redhat_16.1.el6jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el6 jws5-tomcat-jsp-2.3-api 0:9.0.7-17.redhat_16.1.el6jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el6 jws5-tomcat-jsvc 0:9.0.7-17.redhat_16.1.el6jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el6 jws5-tomcat-lib 0:9.0.7-17.redhat_16.1.el6jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el6 jws5-tomcat-native 0:1.2.17-26.redhat_26.el6jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el6 jws5-tomcat-native-debuginfo 0:1.2.17-26.redhat_26.el6jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el6 jws5-tomcat-selinux 0:9.0.7-17.redhat_16.1.el6jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el6 jws5-tomcat-servlet-4.0-api 0:9.0.7-17.redhat_16.1.el6jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el6 jws5-tomcat-vault 0:1.1.7-5.Final_redhat_2.1.el6jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el6 jws5-tomcat-vault-javadoc 0:1.1.7-5.Final_redhat_2.1.el6jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el6 jws5-tomcat-webapps 0:9.0.7-17.redhat_16.1.el6jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el7 jws5-ecj 0:4.6.1-6.redhat_1.1.el7jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el7 jws5-javapackages-tools 0:3.4.1-5.15.10.el7jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el7 jws5-jboss-logging 0:3.3.1-5.Final_redhat_1.1.el7jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el7 jws5-mod_cluster 0:1.4.0-9.Final_redhat_1.1.el7jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el7 jws5-mod_cluster-tomcat 0:1.4.0-9.Final_redhat_1.1.el7jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el7 jws5-python-javapackages 0:3.4.1-5.15.10.el7jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el7 jws5-tomcat 0:9.0.7-17.redhat_16.1.el7jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el7 jws5-tomcat-admin-webapps 0:9.0.7-17.redhat_16.1.el7jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el7 jws5-tomcat-docs-webapp 0:9.0.7-17.redhat_16.1.el7jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el7 jws5-tomcat-el-3.0-api 0:9.0.7-17.redhat_16.1.el7jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el7 jws5-tomcat-javadoc 0:9.0.7-17.redhat_16.1.el7jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el7 jws5-tomcat-jsp-2.3-api 0:9.0.7-17.redhat_16.1.el7jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el7 jws5-tomcat-jsvc 0:9.0.7-17.redhat_16.1.el7jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el7 jws5-tomcat-lib 0:9.0.7-17.redhat_16.1.el7jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el7 jws5-tomcat-native 0:1.2.17-26.redhat_26.el7jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el7 jws5-tomcat-native-debuginfo 0:1.2.17-26.redhat_26.el7jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el7 jws5-tomcat-selinux 0:9.0.7-17.redhat_16.1.el7jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el7 jws5-tomcat-servlet-4.0-api 0:9.0.7-17.redhat_16.1.el7jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el7 jws5-tomcat-vault 0:1.1.7-5.Final_redhat_2.1.el7jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el7 jws5-tomcat-vault-javadoc 0:1.1.7-5.Final_redhat_2.1.el7jws
Red Hat · JBoss Web Server 5 jboss_enterprise_web_server:5.0::el7 jws5-tomcat-webapps 0:9.0.7-17.redhat_16.1.el7jws

Vulnerabilities 2

  • Critical 9.8
    CVE-2018-8014 EPSS 21%

    The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins

    The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • High 7.5
    CVE-2018-8034 EPSS 21%

    The host name verification missing in Apache Tomcat

    The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1579611
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1607580
  • article
    https://issues.redhat.com/browse/JWS-1069
  • article
    https://issues.redhat.com/browse/JWS-1070
  • article
    https://issues.redhat.com/browse/JWS-1071
  • article
    https://issues.redhat.com/browse/JWS-1072
  • article
    https://issues.redhat.com/browse/JWS-1073
  • article
    https://issues.redhat.com/browse/JWS-1074
  • article
    https://issues.redhat.com/browse/JWS-1080
  • article
    https://issues.redhat.com/browse/JWS-1122
  • article
    https://issues.redhat.com/browse/JWS-1123
  • article
    https://issues.redhat.com/browse/JWS-1153
  • article
    https://issues.redhat.com/browse/JWS-1160
  • article
    https://issues.redhat.com/browse/JWS-1164
  • article
    https://issues.redhat.com/browse/JWS-1281
  • article
    https://issues.redhat.com/browse/JWS-1286
  • article
    https://issues.redhat.com/browse/JWS-654
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0451.json
  • report
    https://access.redhat.com/security/cve/CVE-2018-8014
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-8014
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-8014
  • article
    http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.89
  • article
    http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.53
  • article
    http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.32
  • article
    http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.9
  • report
    https://access.redhat.com/security/cve/CVE-2018-8034
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-8034
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-8034