Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.0 release and security update

Fixed packages 50

Vulnerabilities 2

• High 7.0
  CVE-2022-23181

  Local privilege escalation with FileStore

  The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of …

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven
  Jan 27, 2022
• Low 3.7
  CVE-2021-43980

  Apache Tomcat: Information disclosure

  The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Sep 28, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2047417
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7272.json
• report
  https://access.redhat.com/security/cve/CVE-2021-43980
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2130599
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-43980
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-43980
• report
  https://access.redhat.com/security/cve/CVE-2022-23181
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-23181
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-23181
• article
  https://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9