-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP3 security update Advisory ID: RHSA-2020:2646-01 Product: Red Hat JBoss Core Services Advisory URL: https://access.redhat.com/errata/RHSA-2020:2646 Issue date: 2020-06-22 CVE Names: CVE-2018-20843 CVE-2019-0196 CVE-2019-0197 CVE-2019-15903 CVE-2019-19956 CVE-2019-20388 CVE-2020-1934 CVE-2020-7595 CVE-2020-11080 ==================================================================== 1. Summary: Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 3 zip release for RHEL 6, RHEL 7 and Microsoft Windows is available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience. This release adds the new Apache HTTP Server 2.4.37 Service Pack 3 packages that are part of the JBoss Core Services offering. This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 2 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release. Security fix(es): * httpd: mod_http2: read-after-free on a string compare (CVE-2019-0196) * httpd: mod_http2: possible crash on late upgrade (CVE-2019-0197) * httpd: mod_proxy_ftp use of uninitialized value (CVE-2020-1934) * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080) * libxml2: There's a memory leak in xmlParseBalancedChunkMemoryRecover in parser.c that could result in a crash (CVE-2019-19956) * libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c (CVE-2019-20388) * libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations (CVE-2020-7595) * expat: large number of colons in input makes parser consume high amount of resources, leading to DoS (CVE-2018-20843) * expat: heap-based buffer over-read via crafted XML input (CVE-2019-15903) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link for the update. You must be logged in to download the update. 4. Bugs fixed (https://bugzilla.redhat.com/): 1695030 - CVE-2019-0196 httpd: mod_http2: read-after-free on a string compare 1695042 - CVE-2019-0197 httpd: mod_http2: possible crash on late upgrade 1723723 - CVE-2018-20843 expat: large number of colons in input makes parser consume high amount of resources, leading to DoS 1752592 - CVE-2019-15903 expat: heap-based buffer over-read via crafted XML input 1788856 - CVE-2019-19956 libxml2: There's a memory leak in xmlParseBalancedChunkMemoryRecover in parser.c that could result in a crash 1799734 - CVE-2019-20388 libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c 1799786 - CVE-2020-7595 libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations 1820772 - CVE-2020-1934 httpd: mod_proxy_ftp use of uninitialized value 1844929 - CVE-2020-11080 nghttp2: overly large SETTINGS frames can lead to DoS 5. JIRA issues fixed (https://issues.jboss.org/): JBCS-941 - Upgrade mod_cluster native to 1.3.13 6. References: https://access.redhat.com/security/cve/CVE-2018-20843 https://access.redhat.com/security/cve/CVE-2019-0196 https://access.redhat.com/security/cve/CVE-2019-0197 https://access.redhat.com/security/cve/CVE-2019-15903 https://access.redhat.com/security/cve/CVE-2019-19956 https://access.redhat.com/security/cve/CVE-2019-20388 https://access.redhat.com/security/cve/CVE-2020-1934 https://access.redhat.com/security/cve/CVE-2020-7595 https://access.redhat.com/security/cve/CVE-2020-11080 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.apachehttp&downloadType=securityPatches&version=2.4.37 https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.37/ 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXvCtftzjgjWX9erEAQi0RQ//elNlWif7YvdgM7i5dah3UaSbzJORlXa3 kEQHQBggfPGyf0VqHJNE6abbkj35lZub5q/WDXzfexJ32yHxuCKWK2iTE0tXelbM sQi3rAC5/d8sEfXzP6qte/0ebnjje3V+/gWjJbsV+gRXOWhEZ2t7UJ6BGgUiR8RD Xbs98D5fizDpjqKiZhZqhYLU4f7LTqW40LRCgida3gS6Gynk6wWJTd5n0IxaCJxM x5t4pj082/741gaKGgSmDpLz5j4rav048KoXBB7ptcAxiyk28igmlnbu9zpEQWHe rrpKfzCqV7FVOgUAp8zerYQYQ5svnQvWIS07CoW11TNQGP3SORTq3e4Ijw9OMc1W JQKeWo8HdO+sebeZ/Xo8R50tAKQA+vz9WCsCF6kjq/UdJOSQzIj4ZvEq3gXZa3fu +9pGatG5KhNeGNODQLE1K9mGMvh3oipgN654/zf/Hunr70oKGdOhVcx1l6+XgH97 pCUL0STv0GnSYPS7Vk9+wWnKlp3kUOfdXpiG2bfVfyqABRJGp252CTSjZMUyBnKu 4+tUrDvIBin6qyG5YI9koznx9wxZ8bi89ELEciTyp6Ts/aggpmKoOHsRZIwFtZzl L+MpTZAmGMIRRZyy5I7S8oZ5Mkp++frVRwW3NGDZVecT+ROADZR/0RZDKqFJHoi7 CpnvOIE/NGQžNt -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce