Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP3 security update

Fixed packages 60

Vulnerabilities 9

• High 7.5
  CVE-2018-20843

  In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the X…

  insighttoolkit4 expat matanza vtk Debian Ubuntu Alpine
  Jun 24, 2019
• High 7.5
  CVE-2019-19956

  xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.

  libxml2 libxml2 libxml2 Debian Ubuntu Alpine
  Dec 24, 2019
• High 7.5
  CVE-2019-20388

  xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.

  libxml2 libxml2 libxml2 Debian Ubuntu Alpine
  Jan 21, 2020
• High 7.5
  CVE-2020-7595

  libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation

  xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

  libxml2 libxml2 nokogiri libxml2 Debian Ubuntu Alpine RubyGems
  Jan 21, 2020
• Medium 6.5
  CVE-2019-15903

  In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing to…

  chromium-browser thunderbird firefox thunderbird Debian Ubuntu Alpine
  Sep 4, 2019
• Low 3.7
  CVE-2020-11080

  Denial of service in nghttp2

  In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) o…

  nghttp2 nghttp2 nodejs nodejs Debian Ubuntu Alpine
  Jun 3, 2020
• Unscored —
  CVE-2019-0196 EPSS 19%

  A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handli…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Jun 11, 2019
• Unscored —
  CVE-2019-0197

  A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Jun 11, 2019
• Unscored —
  CVE-2020-1934 EPSS 52%

  In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP serv…

  Apache Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Apr 1, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1695030
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1695042
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1723723
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1752592
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1788856
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1799734
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1799786
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1820772
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1844929
• article
  https://issues.redhat.com/browse/JBCS-941
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2644.json
• report
  https://access.redhat.com/security/cve/CVE-2018-20843
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-20843
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-20843
• article
  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931031
• report
  https://access.redhat.com/security/cve/CVE-2019-0196
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-0196
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-0196
• article
  http://www.apache.org/dist/httpd/CHANGES_2.4
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://access.redhat.com/security/cve/CVE-2019-0197
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-0197
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-0197
• report
  https://access.redhat.com/security/cve/CVE-2019-15903
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-15903
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-15903
• report
  https://access.redhat.com/security/cve/CVE-2019-19956
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-19956
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-19956
• report
  https://access.redhat.com/security/cve/CVE-2019-20388
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-20388
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-20388
• report
  https://access.redhat.com/security/cve/CVE-2020-1934
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-1934
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-1934
• report
  https://access.redhat.com/security/cve/CVE-2020-7595
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-7595
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-7595