Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 security update

Fixed packages 35

Vulnerabilities 3

• Critical 9.1
  CVE-2024-5535 Public exploit

  SSL_select_next_proto buffer overread

  Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences suc…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 27, 2024
• Medium 6.3
  CVE-2024-24795

  Apache HTTP Server: HTTP Response Splitting in multiple modules

  HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixe…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Apr 4, 2024
• Medium 5.4
  CVE-2024-36387

  Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2

  Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jul 1, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#low
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_core_services/2.4.62/html/red_hat_jboss_core_services_apache_http_server_2.4.62_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2273499
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2294581
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2295006
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3452.json
• report
  https://access.redhat.com/security/cve/CVE-2024-5535
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-5535
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-5535
• article
  https://www.oracle.com/security-alerts/cpuoct2024.html#AppendixMSQL
• report
  https://access.redhat.com/security/cve/CVE-2024-24795
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-24795
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-24795
• article
  https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2024-24795
• report
  https://access.redhat.com/security/cve/CVE-2024-36387
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-36387
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-36387
• article
  https://httpd.apache.org/security/vulnerabilities_24.html