Red Hat Security Advisory: Red Hat JBoss Web Server 6.0.3 release and security update

Fixed packages 20

Vulnerabilities 2

• High 8.6
  CVE-2024-38286

  Apache Tomcat: Denial of Service

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. The following versions were EOL at the time t…

  Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
  Nov 7, 2024
• High 7.5
  CVE-2024-34750

  Apache Tomcat: HTTP/2 excess header handling DoS

  Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 s…

  Apache Software Foundation Apache Tomcat thingsboard-tb-mqtt-transport tomcat9 Debian Ubuntu Wolfi Maven
  Jul 3, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.0/html-single/red_hat_jboss_web_server_6.0_service_pack_3_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2295651
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2314686
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4976.json
• report
  https://access.redhat.com/security/cve/CVE-2024-34750
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-34750
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-34750
• article
  https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l
• report
  https://access.redhat.com/security/cve/CVE-2024-38286
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-38286
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-38286
• article
  https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s