-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 for RHEL 7
Advisory ID:       RHSA-2017:1413-01
Product:           Red Hat JBoss Core Services
Advisory URL:      https://access.redhat.com/errata/RHSA-2017:1413
Issue date:        2017-06-07
CVE Names:         CVE-2016-0736 CVE-2016-2161 CVE-2016-6304 
                   CVE-2016-7056 CVE-2016-8610 CVE-2016-8740 
                   CVE-2016-8743 
=====================================================================

1. Summary:

An update is now available for Red Hat JBoss Core Services on RHEL 7.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat JBoss Core Services on RHEL 7 Server - noarch, ppc64, x86_64

3. Description:

Red Hat JBoss Core Services is a set of supplementary software for Red Hat
JBoss middleware products. This software, such as Apache HTTP Server, is
common to multiple JBoss middleware products, and is packaged under Red Hat
JBoss Core Services to allow for faster distribution of updates, and for a
more consistent update experience.

This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23
Service Pack 1 serves as a replacement for Red Hat JBoss Core Services
Apache HTTP Server 2.4.23, and includes bug fixes, which are documented in
the Release Notes document linked to in the References.

Security Fix(es):

* A memory leak flaw was found in the way OpenSSL handled TLS status
request extension data during session renegotiation. A remote attacker
could cause a TLS server using OpenSSL to consume an excessive amount of
memory and, possibly, exit unexpectedly after exhausting all available
memory, if it enabled OCSP stapling support. (CVE-2016-6304)

* It was discovered that the mod_session_crypto module of httpd did not use
any mechanisms to verify integrity of the encrypted session data stored in
the user's browser. A remote attacker could use this flaw to decrypt and
modify session data using a padding oracle attack. (CVE-2016-0736)

* It was discovered that the mod_auth_digest module of httpd did not
properly check for memory allocation failures. A remote attacker could use
this flaw to cause httpd child processes to repeatedly crash if the server
used HTTP digest authentication. (CVE-2016-2161)

* A timing attack flaw was found in OpenSSL that could allow a malicious
user with local access to recover ECDSA P-256 private keys. (CVE-2016-7056)

* A denial of service flaw was found in the way the TLS/SSL protocol
defined processing of ALERT packets during a connection handshake. A remote
attacker could use this flaw to make a TLS/SSL server consume an excessive
amount of CPU and fail to accept connections from other clients.
(CVE-2016-8610)

* It was discovered that the HTTP parser in httpd incorrectly allowed
certain characters not permitted by the HTTP protocol specification to
appear unencoded in HTTP request headers. If httpd was used in conjunction
with a proxy or backend server that interpreted those characters
differently, a remote attacker could possibly use this flaw to inject data
into HTTP responses, resulting in proxy cache poisoning. (CVE-2016-8743)

* A vulnerability was found in httpd's handling of the LimitRequestFields
directive in mod_http2, affecting servers with HTTP/2 enabled. An attacker
could send crafted requests with headers larger than the server's available
memory, causing httpd to crash. (CVE-2016-8740)

Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6304
and Shi Lei (Gear Team of Qihoo 360 Inc.) for reporting CVE-2016-8610.
Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original
reporter of CVE-2016-6304.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all services linked to the OpenSSL library
must be restarted, or the system rebooted. After installing the updated
packages, the httpd daemon will be restarted automatically.

5. Bugs fixed (https://bugzilla.redhat.com/):

1377600 - CVE-2016-6304 openssl: OCSP Status Request extension unbounded memory growth
1384743 - CVE-2016-8610 SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS
1401528 - CVE-2016-8740 httpd: Incomplete handling of LimitRequestFields directive in mod_http2
1406744 - CVE-2016-0736 httpd: Padding Oracle in Apache mod_session_crypto
1406753 - CVE-2016-2161 httpd: DoS vulnerability in mod_auth_digest
1406822 - CVE-2016-8743 httpd: Apache HTTP Request Parsing Whitespace Defects
1412120 - CVE-2016-7056 openssl: ECDSA P-256 timing attack key recovery

6. JIRA issues fixed (https://issues.jboss.org/):

JBCS-319 - Errata for httpd 2.4.23 SP1 RHEL 7

7. Package List:

Red Hat JBoss Core Services on RHEL 7 Server:

Source:
jbcs-httpd24-httpd-2.4.23-120.jbcs.el7.src.rpm
jbcs-httpd24-mod_security-2.9.1-19.GA.jbcs.el7.src.rpm
jbcs-httpd24-openssl-1.0.2h-13.jbcs.el7.src.rpm

noarch:
jbcs-httpd24-httpd-manual-2.4.23-120.jbcs.el7.noarch.rpm

ppc64:
jbcs-httpd24-httpd-2.4.23-120.jbcs.el7.ppc64.rpm
jbcs-httpd24-httpd-debuginfo-2.4.23-120.jbcs.el7.ppc64.rpm
jbcs-httpd24-httpd-devel-2.4.23-120.jbcs.el7.ppc64.rpm
jbcs-httpd24-httpd-libs-2.4.23-120.jbcs.el7.ppc64.rpm
jbcs-httpd24-httpd-selinux-2.4.23-120.jbcs.el7.ppc64.rpm
jbcs-httpd24-httpd-tools-2.4.23-120.jbcs.el7.ppc64.rpm
jbcs-httpd24-mod_ldap-2.4.23-120.jbcs.el7.ppc64.rpm
jbcs-httpd24-mod_proxy_html-2.4.23-120.jbcs.el7.ppc64.rpm
jbcs-httpd24-mod_security-2.9.1-19.GA.jbcs.el7.ppc64.rpm
jbcs-httpd24-mod_security-debuginfo-2.9.1-19.GA.jbcs.el7.ppc64.rpm
jbcs-httpd24-mod_session-2.4.23-120.jbcs.el7.ppc64.rpm
jbcs-httpd24-mod_ssl-2.4.23-120.jbcs.el7.ppc64.rpm
jbcs-httpd24-openssl-1.0.2h-13.jbcs.el7.ppc64.rpm
jbcs-httpd24-openssl-debuginfo-1.0.2h-13.jbcs.el7.ppc64.rpm
jbcs-httpd24-openssl-devel-1.0.2h-13.jbcs.el7.ppc64.rpm
jbcs-httpd24-openssl-libs-1.0.2h-13.jbcs.el7.ppc64.rpm
jbcs-httpd24-openssl-perl-1.0.2h-13.jbcs.el7.ppc64.rpm
jbcs-httpd24-openssl-static-1.0.2h-13.jbcs.el7.ppc64.rpm

x86_64:
jbcs-httpd24-httpd-2.4.23-120.jbcs.el7.x86_64.rpm
jbcs-httpd24-httpd-debuginfo-2.4.23-120.jbcs.el7.x86_64.rpm
jbcs-httpd24-httpd-devel-2.4.23-120.jbcs.el7.x86_64.rpm
jbcs-httpd24-httpd-libs-2.4.23-120.jbcs.el7.x86_64.rpm
jbcs-httpd24-httpd-selinux-2.4.23-120.jbcs.el7.x86_64.rpm
jbcs-httpd24-httpd-tools-2.4.23-120.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_ldap-2.4.23-120.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_proxy_html-2.4.23-120.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_security-2.9.1-19.GA.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_security-debuginfo-2.9.1-19.GA.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_session-2.4.23-120.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_ssl-2.4.23-120.jbcs.el7.x86_64.rpm
jbcs-httpd24-openssl-1.0.2h-13.jbcs.el7.x86_64.rpm
jbcs-httpd24-openssl-debuginfo-1.0.2h-13.jbcs.el7.x86_64.rpm
jbcs-httpd24-openssl-devel-1.0.2h-13.jbcs.el7.x86_64.rpm
jbcs-httpd24-openssl-libs-1.0.2h-13.jbcs.el7.x86_64.rpm
jbcs-httpd24-openssl-perl-1.0.2h-13.jbcs.el7.x86_64.rpm
jbcs-httpd24-openssl-static-1.0.2h-13.jbcs.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

8. References:

https://access.redhat.com/security/cve/CVE-2016-0736
https://access.redhat.com/security/cve/CVE-2016-2161
https://access.redhat.com/security/cve/CVE-2016-6304
https://access.redhat.com/security/cve/CVE-2016-7056
https://access.redhat.com/security/cve/CVE-2016-8610
https://access.redhat.com/security/cve/CVE-2016-8740
https://access.redhat.com/security/cve/CVE-2016-8743
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/documentation/en/red-hat-jboss-core-services/

9. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2017 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFZOEFDXlSAg2UNWIIRAkmJAJ4vtOF2J+v5N45Dg4fckgqFa+L96wCfVBp2
JFT0GtD56HPD72nOXhIXyG8=
=7n2G
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce