Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP3 security update

Fixed packages 51

Vulnerabilities 5

• Medium 6.5
  CVE-2023-46218

  This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than …

  curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi
  Dec 7, 2023
• Medium 5.4
  CVE-2023-6710 Public exploit

  Mod_cluster/mod_proxy_cluster: stored cross site scripting

  A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter…

  Red Hat Red Hat Enterprise Linux 9 Red Hat JBoss Core Services JBoss Core Services for RHEL 8 Linux
  Dec 12, 2023
• Medium 5.3
  CVE-2023-46219

  When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requ…

  curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi
  Dec 12, 2023
• Medium 5.3
  CVE-2023-5678

  Excessive time spent in DH check / generation with large Q parameter value

  Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. L…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Nov 6, 2023
• Unscored —
  CVE-2023-31122

  Apache HTTP Server: mod_macro buffer over-read

  Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Oct 23, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.57/html/red_hat_jboss_core_services_apache_http_server_2.4.57_service_pack_3_release_notes
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2245332
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2248616
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2252030
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2252034
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2254128
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1316.json
• report
  https://access.redhat.com/security/cve/CVE-2023-5678
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-5678
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-5678
• article
  https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=34efaef6c103d636ab507a0cc34dca4d3aecc055
• article
  https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=710fee740904b6290fef0dd5536fbcedbc38ff0c
• article
  https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db925ae2e65d0d925adef429afc37f75bd1c2017
• article
  https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6
• article
  https://www.openssl.org/news/secadv/20231106.txt
• report
  https://access.redhat.com/security/cve/CVE-2023-6710
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6710
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6710
• report
  https://access.redhat.com/security/cve/CVE-2023-31122
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-31122
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-31122
• article
  https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2023-31122
• report
  https://access.redhat.com/security/cve/CVE-2023-46218
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-46218
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-46218
• article
  https://curl.se/docs/CVE-2023-46218.html
• report
  https://access.redhat.com/security/cve/CVE-2023-46219
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-46219
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-46219
• article
  https://curl.se/docs/CVE-2023-46219.html