Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP7 security update

Fixed packages 35

Vulnerabilities 2

• High 7.4
  CVE-2021-3450 Public exploit EPSS 18%

  CA certificate check bypass with X509_V_FLAG_X509_STRICT

  The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded e…

  OpenSSL OpenSSL openssl openssl Debian Alpine crates.io
  Mar 25, 2021
• Medium 5.9
  CVE-2021-3449 Public exploit EPSS 64%

  NULL pointer deref in signature_algorithms processing

  An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a si…

  OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine crates.io
  Mar 25, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1941547
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1941554
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1199.json
• report
  https://access.redhat.com/security/cve/CVE-2021-3449
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3449
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3449
• article
  https://www.openssl.org/news/secadv/20210325.txt
• report
  https://access.redhat.com/security/cve/CVE-2021-3450
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3450
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3450