Skip to content
OpenAdvisories
High RHSA-2020:3303 2 CVEs

Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 10 security update

Published Sep 13, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 48

ReleasePackageFixed in
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat7 0:7.0.70-41.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat7-admin-webapps 0:7.0.70-41.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat7-docs-webapp 0:7.0.70-41.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat7-el-2.2-api 0:7.0.70-41.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat7-javadoc 0:7.0.70-41.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat7-jsp-2.2-api 0:7.0.70-41.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat7-jsvc 0:7.0.70-41.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat7-lib 0:7.0.70-41.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat7-log4j 0:7.0.70-41.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat7-selinux 0:7.0.70-41.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat7-servlet-3.0-api 0:7.0.70-41.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat7-webapps 0:7.0.70-41.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat8 0:8.0.36-45.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat8-admin-webapps 0:8.0.36-45.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat8-docs-webapp 0:8.0.36-45.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat8-el-2.2-api 0:8.0.36-45.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat8-javadoc 0:8.0.36-45.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat8-jsp-2.3-api 0:8.0.36-45.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat8-jsvc 0:8.0.36-45.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat8-lib 0:8.0.36-45.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat8-log4j 0:8.0.36-45.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat8-selinux 0:8.0.36-45.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat8-servlet-3.1-api 0:8.0.36-45.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el6 tomcat8-webapps 0:8.0.36-45.ep7.el6
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7 0:7.0.70-41.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-admin-webapps 0:7.0.70-41.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-docs-webapp 0:7.0.70-41.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-el-2.2-api 0:7.0.70-41.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-javadoc 0:7.0.70-41.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-jsp-2.2-api 0:7.0.70-41.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-jsvc 0:7.0.70-41.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-lib 0:7.0.70-41.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-log4j 0:7.0.70-41.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-selinux 0:7.0.70-41.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-servlet-3.0-api 0:7.0.70-41.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat7-webapps 0:7.0.70-41.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8 0:8.0.36-45.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-admin-webapps 0:8.0.36-45.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-docs-webapp 0:8.0.36-45.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-el-2.2-api 0:8.0.36-45.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-javadoc 0:8.0.36-45.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-jsp-2.3-api 0:8.0.36-45.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-jsvc 0:8.0.36-45.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-lib 0:8.0.36-45.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-log4j 0:8.0.36-45.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-selinux 0:8.0.36-45.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-servlet-3.1-api 0:8.0.36-45.ep7.el7
Red Hat · JBoss Web Server 3 jboss_enterprise_web_server:3.1::el7 tomcat8-webapps 0:8.0.36-45.ep7.el7

Vulnerabilities 2

  • High 7.5
    CVE-2020-13935 Public exploit EPSS 87%

    Infinite Loop in Apache Tomcat

    The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payl…

    org.apache.tomcat:tomcat tomcat8 tomcat9 tomcat9 Debian Ubuntu Maven
  • Medium 4.8
    CVE-2020-1935

    Potential HTTP request smuggling in Apache Tomcat

    In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if …

    Apache Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1806835
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1857024
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3303.json
  • report
    https://access.redhat.com/security/cve/CVE-2020-1935
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-1935
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-1935
  • article
    https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.100
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.51
  • article
    https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.31
  • report
    https://access.redhat.com/security/cve/CVE-2020-13935
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-13935
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-13935
  • article
    http://mail-archives.apache.org/mod_mbox/tomcat-announce/202007.mbox/%3C39e4200c-6f4e-b85d-fe4b-a9c2bd5fdc3d%40apache.org%3E
  • article
    http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M7
  • article
    http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.105
  • article
    http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.57
  • article
    http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.37