Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP2 security update

Fixed packages 52

Vulnerabilities 9

• Unscored —
  CVE-2019-10081 EPSS 14%

  HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwr…

  apache2 apache2 apache2 Debian Ubuntu Alpine
  Aug 15, 2019
• Unscored —
  CVE-2019-10082 EPSS 17%

  In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memo…

  apache2 apache2 apache2 Debian Ubuntu Alpine
  Sep 26, 2019
• Unscored —
  CVE-2019-10092 Public exploit Scanner template EPSS 81%

  In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error pag…

  apache2 apache2 apache2 Debian Ubuntu Alpine
  Sep 26, 2019
• Unscored —
  CVE-2019-10097 EPSS 53%

  In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using …

  apache2 apache2 Debian Alpine
  Sep 26, 2019
• Unscored —
  CVE-2019-10098 Public exploit Scanner template EPSS 74%

  In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential …

  apache2 apache2 apache2 Debian Ubuntu Alpine
  Sep 25, 2019
• Unscored —
  CVE-2019-1547

  ECDSA remote timing attack

  Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is p…

  OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  Sep 10, 2019
• Unscored —
  CVE-2019-1549

  Fork Protection

  OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection w…

  OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  Sep 10, 2019
• Unscored —
  CVE-2019-1563

  Padding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey

  In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine
  Sep 10, 2019
• Unscored —
  CVE-2020-1927 EPSS 57%

  In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential …

  Apache Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Apr 1, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.37/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1743956
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1743959
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1743966
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1743974
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1743996
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1752090
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1752095
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1752100
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1820761
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1337.json
• report
  https://access.redhat.com/security/cve/CVE-2019-1547
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-1547
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-1547
• report
  https://access.redhat.com/security/cve/CVE-2019-1549
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-1549
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-1549
• report
  https://access.redhat.com/security/cve/CVE-2019-1563
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-1563
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-1563
• report
  https://access.redhat.com/security/cve/CVE-2019-10081
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10081
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10081
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://access.redhat.com/security/cve/CVE-2019-10082
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10082
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10082
• report
  https://access.redhat.com/security/cve/CVE-2019-10092
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10092
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10092
• report
  https://access.redhat.com/security/cve/CVE-2019-10097
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10097
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10097
• report
  https://access.redhat.com/security/cve/CVE-2019-10098
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10098
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10098
• report
  https://access.redhat.com/security/cve/CVE-2020-1927
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-1927