Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP11 security update

Fixed packages 112

Vulnerabilities 8

• High 8.8
  CVE-2021-3518 EPSS 22%

  Nokogiri Implements libxml2 version vulnerable to use-after-free

  There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, an…

  libxml2 libxml2 nokogiri libxml2 Debian Ubuntu Alpine RubyGems
  May 18, 2021
• High 8.6
  CVE-2021-3517 EPSS 17%

  Nokogiri contains libxml Out-of-bounds Write vulnerability

  There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds …

  qt5-qtwebengine libxml2 libxml2 nokogiri Debian Ubuntu Alpine RubyGems
  May 19, 2021
• High 7.5
  CVE-2022-0778 Public exploit EPSS 73%

  Infinite loop in BN_mod_sqrt() reachable when parsing certificates

  The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or e…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine crates.io
  Mar 15, 2022
• High 7.5
  CVE-2022-23308

  valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

  qt5-qtwebengine libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux Alpine
  Feb 26, 2022
• Medium 5.9
  CVE-2021-3537

  Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing

  A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used …

  libxml2 libxml2 nokogiri libxml2 Debian Ubuntu Alpine RubyGems
  May 14, 2021
• Unscored —
  CVE-2021-3516

  There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be p…

  libxml2 libxml2 Debian Ubuntu
  Jun 1, 2021
• Unscored —
  CVE-2021-3541

  A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechani…

  qt5-qtwebengine libxml2 libxml2 libxml2 Debian Ubuntu Alpine
  Jul 9, 2021
• Unscored —
  CVE-2022-22720 Public exploit EPSS 28%

  HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier

  Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Mar 14, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1950515
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1954225
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1954232
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1954242
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1956522
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2056913
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2062202
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2064321
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1389.json
• report
  https://access.redhat.com/security/cve/CVE-2021-3516
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3516
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3516
• report
  https://access.redhat.com/security/cve/CVE-2021-3517
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3517
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3517
• report
  https://access.redhat.com/security/cve/CVE-2021-3518
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3518
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3518
• report
  https://access.redhat.com/security/cve/CVE-2021-3537
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3537
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3537
• report
  https://access.redhat.com/security/cve/CVE-2021-3541
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3541
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3541
• report
  https://access.redhat.com/security/cve/CVE-2022-0778
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-0778
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-0778
• article
  https://www.openssl.org/news/secadv/20220315.txt
• report
  https://access.redhat.com/security/cve/CVE-2022-22720
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-22720
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-22720
• article
  https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-22720
• report
  https://access.redhat.com/security/cve/CVE-2022-23308
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-23308
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-23308