Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.23 security update

Fixed packages 79

Vulnerabilities 2

• Critical 9.8
  CVE-2020-1938 Exploited Public exploit Scanner template EPSS 99%

  Improper Privilege Management in Tomcat

  When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an atta…

  Apache Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
  Feb 24, 2020

  KEV Mar 3, 2022
• Medium 5.4
  CVE-2019-14885

  A flaw was found in the JBoss EAP Vault system in all versions before 7.2.6.GA. Confidential information of the system …

  Red Hat JBoss EAP
  Jan 23, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/6.4/index.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1700855
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1708467
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1710434
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1770615
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1772542
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1806398
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1816579
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1816629
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1819214
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2780.json
• report
  https://access.redhat.com/security/cve/CVE-2019-14885
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-14885
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-14885
• report
  https://access.redhat.com/security/cve/CVE-2020-1938
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-1938
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-1938
• article
  https://meterpreter.org/cve-2020-1938-apache-tomcat-ajp-connector-remote-code-execution-vulnerability-alert/
• article
  https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.100
• article
  https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.51
• article
  https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.31
• article
  https://www.cnvd.org.cn/webinfo/show/5415
• article
  https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487
• article
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog