Description
mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of = (equals) characters after a legitimate element.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 2 | httpd +3 | 2.2.26-54.ep6.el6 | RHSA-2016:1649 |
| Red Hat JBoss Web Server 2 | httpd22 +3 | 2.2.26-56.ep6.el7 | RHSA-2016:1648 |
| Red Hat JBoss Web Server 2 | jbcs-httpd24 +1 | 1-3.jbcs.el6 | RHSA-2016:1649, RHSA-2016:1648 |
| Red Hat JBoss Web Server 2 | jbcs-httpd24-openssl +4 | 1:1.0.2h-4.jbcs.el6 | RHSA-2016:1649, RHSA-2016:1648 |
| Red Hat JBoss Web Server 2 | mod_cluster +2 | 1.2.13-1.Final_redhat_1.1.ep6.el6 | RHSA-2016:1649, RHSA-2016:1648 |
| Red Hat JBoss Web Server 2 | mod_cluster-native | 1.2.13-3.Final_redhat_2.ep6.el6 | RHSA-2016:1649, RHSA-2016:1648 |
| Red Hat JBoss Web Server 2 | mod_jk +2 | 1.2.41-2.redhat_3.ep6.el6 | RHSA-2016:1649, RHSA-2016:1648 |
| Red Hat JBoss Web Server 2 | mod_ssl | 1:2.2.26-54.ep6.el6 | RHSA-2016:1649 |
| Red Hat JBoss Web Server 2 | mod_ssl22 | 1:2.2.26-56.ep6.el7 | RHSA-2016:1648 |
| Red Hat JBoss Web Server 2 | tomcat-native | 1.1.34-5.redhat_1.ep6.el6 | RHSA-2016:1649, RHSA-2016:1648 |
| Red Hat JBoss EAP 6 | hornetq-native +1 | 2.3.25-4.SP11_redhat_1.ep6.el6 | RHSA-2016:2055, RHSA-2016:2054 |
| Red Hat JBoss EAP 6 | httpd +4 | 2.2.26-54.ep6.el6 | RHSA-2016:2055 |
| Red Hat JBoss EAP 6 | httpd22 +4 | 2.2.26-56.ep6.el7 | RHSA-2016:2054 |
| Red Hat JBoss EAP 6 | jbcs-httpd24 +1 | 1-3.jbcs.el6 | RHSA-2016:2055, RHSA-2016:2054 |
| Red Hat JBoss EAP 6 | jbcs-httpd24-openssl +4 | 1:1.0.2h-4.jbcs.el6 | RHSA-2016:2055, RHSA-2016:2054 |
| Red Hat JBoss EAP 6 | mod_cluster-native | 1.2.13-3.Final_redhat_2.ep6.el6 | RHSA-2016:2055, RHSA-2016:2054 |
| Red Hat JBoss EAP 6 | mod_jk +1 | 1.2.41-2.redhat_4.ep6.el6 | RHSA-2016:2055, RHSA-2016:2054 |
| Red Hat JBoss EAP 6 | mod_ssl | 1:2.2.26-54.ep6.el6 | RHSA-2016:2055 |
| Red Hat JBoss EAP 6 | mod_ssl22 | 1:2.2.26-56.ep6.el7 | RHSA-2016:2054 |
| Red Hat JBoss EAP 6 | tomcat-native +1 | 1.1.34-5.redhat_1.ep6.el6 | RHSA-2016:2055, RHSA-2016:2054 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jboss.mod_cluster:mod_cluster-parent | < 1.3.3.Final | 1.3.3.Final | GHSA-68qq-3phh-53j7 |
Advisories 4
- RHSA-2016:2055 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.10 natives update on RHEL 6 Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2016:2054 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.10 natives update on RHEL 7 Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2016:1648 Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.1 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2016:1649 Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.1 security update on RHEL 6 Red Hat Security Advisories (RHSA) · Sep 21, 2026
References
- RHSA-2016:2056 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1326320
- RHSA-2016:1648 vendor-advisory
- 92584 vdb-entry
- RHSA-2016:2055 vendor-advisory
- RHSA-2016:1649 vendor-advisory
- RHSA-2016:1650 vendor-advisory
- RHSA-2016:2054 vendor-advisory
- FEDORA-2019-3877efca99 vendor-advisory
- FEDORA-2019-7813edd5a2 vendor-advisory
- FEDORA-2019-17556e2ad6 vendor-advisory