Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP5 security update

Fixed packages 110

Vulnerabilities 5

• Unscored —
  CVE-2019-1551 EPSS 14%

  rsaz_512_sqr overflow bug on x86_64

  There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect wou…

  OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  Dec 6, 2019
• Unscored —
  CVE-2019-5435

  An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.

  curl curl curl curl Debian Alpine
  May 28, 2019
• Unscored —
  CVE-2020-11984 Public exploit Scanner template EPSS 90%

  Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE

  apache2 apache2 apache2 uwsgi Debian Ubuntu Alpine
  Aug 7, 2020
• Unscored —
  CVE-2020-11993 EPSS 57%

  Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic …

  apache2 apache2 apache2 Debian Ubuntu Alpine
  Aug 7, 2020
• Unscored —
  CVE-2020-25680

  A flaw was found in JBCS httpd in version 2.4.37 SP3, where it uses a back-end worker SSL certificate with the keystore…

  Jan 7, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1710609
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1780995
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1866563
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1866564
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1892703
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4384.json
• report
  https://access.redhat.com/security/cve/CVE-2019-1551
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-1551
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-1551
• article
  https://github.com/openssl/openssl/pull/10575
• article
  https://www.openssl.org/news/secadv/20191206.txt
• report
  https://access.redhat.com/security/cve/CVE-2019-5435
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-5435
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-5435
• report
  https://access.redhat.com/security/cve/CVE-2020-11984
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-11984
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-11984
• article
  https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-11984
• report
  https://access.redhat.com/security/cve/CVE-2020-11993
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-11993
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-11993
• article
  https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-11993
• report
  https://access.redhat.com/security/cve/CVE-2020-25680
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-25680
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-25680