Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.7 release and security update

Fixed packages 38

Vulnerabilities 7

• High 7.5
  CVE-2023-0464 Public exploit

  Excessive Resource Usage Verifying X.509 Policy Constraints

  A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate …

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 22, 2023
• Medium 6.5
  CVE-2023-2650 EPSS 75%

  Possible DoS translating ASN.1 object identifiers

  Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with …

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  May 30, 2023
• Medium 6.1
  CVE-2023-41080 Public exploit

  Apache Tomcat: Open redirect with FORM authentication

  URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 thr…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven
  Aug 25, 2023
• Medium 5.3
  CVE-2023-0465

  Invalid certificate policies in leaf certificates are silently ignored

  Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate pol…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 28, 2023
• Medium 5.3
  CVE-2023-0466

  Certificate policy check not enabled

  The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or in…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine
  Mar 28, 2023
• Medium 5.3
  CVE-2023-3446

  Excessive time spent checking DH keys and parameters

  Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the k…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 19, 2023
• Medium 5.3
  CVE-2023-3817

  Excessive time spent checking DH q parameter value

  Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the k…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 31, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2181082
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2182561
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2182565
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2207947
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2224962
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2227852
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2235370
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7622.json
• report
  https://access.redhat.com/security/cve/CVE-2023-0464
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-0464
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-0464
• article
  https://www.openssl.org/news/secadv/20230322.txt
• report
  https://access.redhat.com/security/cve/CVE-2023-0465
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-0465
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-0465
• article
  https://www.openssl.org/news/secadv/20230328.txt
• report
  https://access.redhat.com/security/cve/CVE-2023-0466
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-0466
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-0466
• report
  https://access.redhat.com/security/cve/CVE-2023-2650
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-2650
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-2650
• article
  https://www.openssl.org/news/secadv/20230530.txt
• report
  https://access.redhat.com/security/cve/CVE-2023-3446
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-3446
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-3446
• article
  https://www.openssl.org/news/secadv/20230719.txt
• report
  https://access.redhat.com/security/cve/CVE-2023-3817
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-3817
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-3817
• article
  https://www.openssl.org/news/secadv/20230731.txt
• report
  https://access.redhat.com/security/cve/CVE-2023-41080
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-41080
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-41080
• article
  https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f