Red Hat Security Advisory: Red Hat JBoss Web Server 5.5.0 Security release

Fixed packages 36

Vulnerabilities 3

• High 7.5
  CVE-2021-25122 EPSS 18%

  Apache Tomcat h2c request mix-up

  When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could…

  Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  Mar 1, 2021
• High 7.4
  CVE-2020-25638

  SQL injection in hibernate-core

  A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an…

  org.hibernate:hibernate-core libhibernate3-java libhibernate3-java Debian Ubuntu Maven
  Dec 2, 2020
• High 7.0
  CVE-2021-25329

  Incomplete fix for CVE-2020-9484

  The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CV…

  Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  Mar 1, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1881353
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1934032
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1934061
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2561.json
• report
  https://access.redhat.com/security/cve/CVE-2020-25638
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-25638
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-25638
• report
  https://access.redhat.com/security/cve/CVE-2021-25122
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-25122
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-25122
• article
  http://mail-archives.apache.org/mod_mbox/tomcat-announce/202103.mbox/%3Cb7626398-5e6d-1639-4e9e-e41b34af84de%40apache.org%3E
• article
  https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.2
• article
  https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.63
• article
  https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.43
• report
  https://access.redhat.com/security/cve/CVE-2021-25329
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-25329
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-25329
• article
  http://mail-archives.apache.org/mod_mbox/tomcat-announce/202103.mbox/%3C811bba77-e74e-9f9b-62ca-5253a09ba84f%40apache.org%3E
• article
  https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.108