Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP10 security update

Fixed packages 118

Vulnerabilities 13

• High 7.5
  CVE-2021-23840 Public exploit EPSS 51%

  Integer overflow in CipherUpdate

  Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the …

  OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io
  Feb 16, 2021
• High 7.4
  CVE-2021-3712 Public exploit EPSS 48%

  Read buffer overruns processing ASN.1 strings

  ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string dat…

  OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io
  Aug 24, 2021
• Medium 5.9
  CVE-2021-23841 Public exploit

  Null pointer deref in X509_issuer_and_serial_hash()

  The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing …

  OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io
  Feb 16, 2021
• Unscored —
  CVE-2019-17567 EPSS 60%

  mod_proxy_wstunnel tunneling of non Upgraded connections

  Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass throu…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux
  Jun 10, 2021
• Unscored —
  CVE-2019-20838

  libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than o…

  pcre3 pcre3 Debian Ubuntu
  Jun 15, 2020
• Unscored —
  CVE-2020-13950 EPSS 50%

  mod_proxy_http NULL pointer dereference

  Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 10, 2021
• Unscored —
  CVE-2020-14155

  libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

  pcre3 pcre3 pcre Debian Ubuntu Alpine
  Jun 15, 2020
• Unscored —
  CVE-2020-35452 EPSS 53%

  mod_auth_digest possible stack overflow by one nul byte

  Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compile…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 10, 2021
• Unscored —
  CVE-2021-26690 Public exploit EPSS 65%

  mod_session NULL pointer dereference

  Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 10, 2021
• Unscored —
  CVE-2021-26691 EPSS 68%

  Apache HTTP Server mod_session response handling heap overflow

  In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 10, 2021
• Unscored —
  CVE-2021-30641 EPSS 52%

  Unexpected URL matching with 'MergeSlashes OFF'

  Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 10, 2021
• Unscored —
  CVE-2021-34798 EPSS 65%

  NULL pointer dereference in httpd core

  Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Sep 16, 2021
• Unscored —
  CVE-2021-3688

  A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the p…

  Aug 26, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1848436
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1848444
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1930310
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1930324
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1966724
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1966729
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1966732
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1966738
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1966740
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1966743
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1995634
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4614.json
• report
  https://access.redhat.com/security/cve/CVE-2019-17567
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-17567
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-17567
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://access.redhat.com/security/cve/CVE-2019-20838
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-20838
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-20838
• report
  https://access.redhat.com/security/cve/CVE-2020-13950
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-13950
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-13950
• report
  https://access.redhat.com/security/cve/CVE-2020-14155
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-14155
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-14155
• report
  https://access.redhat.com/security/cve/CVE-2020-35452
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-35452
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-35452
• report
  https://access.redhat.com/security/cve/CVE-2021-3688
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1990252
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3688
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3688
• report
  https://access.redhat.com/security/cve/CVE-2021-3712
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3712
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3712
• article
  https://www.openssl.org/news/secadv/20210824.txt
• report
  https://access.redhat.com/security/cve/CVE-2021-23840
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-23840