Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4 security update

Fixed packages 62

Vulnerabilities 6

• High 8.6
  CVE-2024-2398 EPSS 36%

  HTTP/2 push headers memory-leak

  When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the prev…

  curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 27, 2024
• High 7.5
  CVE-2024-27316 Public exploit EPSS 89%

  Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

  HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Apr 4, 2024
• Medium 6.5
  CVE-2024-2466

  TLS certificate check bypass with mbedTLS

  libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore…

  curl curl curl curl Debian Azure Linux Alpine Wolfi
  Mar 27, 2024
• Medium 6.3
  CVE-2024-2379

  QUIC certificate check bypass with wolfSSL

  libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certifica…

  curl curl curl curl Debian Azure Linux Alpine Wolfi
  Mar 27, 2024
• Medium 5.3
  CVE-2024-28182 EPSS 82%

  Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

  nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This cause…

  nghttp2 nghttp2 rust nodejs Debian Ubuntu Azure Linux Wolfi
  Apr 4, 2024
• Low 3.5
  CVE-2024-2004

  Usage of disabled protocol

  When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se wi…

  curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 27, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.57/html/red_hat_jboss_core_services_apache_http_server_2.4.57_service_pack_4_release_notes
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268277
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268639
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2270497
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2270498
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2270499
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2270500
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2693.json
• report
  https://access.redhat.com/security/cve/CVE-2024-2004
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-2004
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-2004
• article
  https://curl.se/docs/CVE-2024-2004.html
• report
  https://access.redhat.com/security/cve/CVE-2024-2379
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-2379
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-2379
• article
  https://curl.se/docs/CVE-2024-2379.html
• report
  https://access.redhat.com/security/cve/CVE-2024-2398
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-2398
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-2398
• article
  https://curl.se/docs/CVE-2024-2398.html
• report
  https://access.redhat.com/security/cve/CVE-2024-2466
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-2466
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-2466
• article
  https://curl.se/docs/CVE-2024-2466.html
• report
  https://access.redhat.com/security/cve/CVE-2024-27316
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-27316
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-27316
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• article
  https://nowotarski.info/http2-continuation-flood/
• advisory
  https://www.kb.cert.org/vuls/id/421644
• report
  https://access.redhat.com/security/cve/CVE-2024-28182
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-28182
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-28182
• article
  https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q