RHSA-2017:1801HighCVSS 9.8

Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 1 security update

Published
July 25, 2017
Last Modified
August 4, 2026

🔗 CVE IDs covered (9)

CVE-2017-5645 →CVE-2017-5647 →CVE-2016-6304 →CVE-2016-7056 →CVE-2016-8610 →CVE-2017-5648 →CVE-2017-5664 →CVE-2017-7674 →CVE-2019-17571 →

📋 Description

CVE-2016-6304 — openssl: OCSP Status Request extension unbounded memory growth CVE-2016-7056 — openssl: ECDSA P-256 timing attack key recovery CVE-2016-8610 — SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS CVE-2017-5645 — log4j: Socket receiver deserialization vulnerability CVE-2017-5647 — tomcat: Incorrect handling of pipelined requests when send file was used CVE-2017-5648 — tomcat: Calls to application listeners did not use the appropriate facade object CVE-2017-5664 — tomcat: Security constrained bypass in error page mechanism CVE-2017-7674 — tomcat: Vary header not added by CORS filter leading to cache poisoning CVE-2019-17571 — log4j: deserialization of untrusted data in SocketServer

🎯 Affected products66

  • Red Hat JBoss Web Server 3.1 for RHEL 6
  • Red Hat JBoss Web Server 3.1 for RHEL 7
  • log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7
  • log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 7
  • tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat-native-0:1.2.8-10.redhat_10.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 7
  • tomcat-native-0:1.2.8-10.redhat_10.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.1 for RHEL 7
  • tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.1 for RHEL 7
  • tomcat7-0:7.0.70-22.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat7-0:7.0.70-22.ep7.el6.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat7-0:7.0.70-22.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7
  • tomcat7-0:7.0.70-22.ep7.el7.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 7
  • tomcat7-admin-webapps-0:7.0.70-22.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat7-admin-webapps-0:7.0.70-22.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7
  • tomcat7-docs-webapp-0:7.0.70-22.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat7-docs-webapp-0:7.0.70-22.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7
  • tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7
  • tomcat7-javadoc-0:7.0.70-22.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat7-javadoc-0:7.0.70-22.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7
  • tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7
  • tomcat7-jsvc-0:7.0.70-22.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 6
  • tomcat7-jsvc-0:7.0.70-22.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.1 for RHEL 7
  • +36 more not shown

✅ Remediation

Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: The AJP connector does not support the sendfile capability. A server configured to only use the AJP connector (disable HTTP Connector) is not affected by this vulnerability. Disable the sendfile capability by setting useSendfile="false" in the HTTP connector configuration. Note: Disabling sendfile, may impact performance on large files. Workaround: If it is necessary to have the DefaultServlet property readonly=false, use a jsp error page, for example Error404.jsp rather than a static html error page. Alternatively do not specify an error-page in the Deployment Descriptor and use a custom ErrorReportValve. Workaround: Please note that the Log4j upstream strongly recommends against using the SerializedLayout with the SocketAppenders. Customers may mitigate this issue by removing the SocketServer class outright; or if they must continue to use SocketAppenders, they can modify their SocketAppender configuration from SerializedLayout to use JsonLayout instead. An example of this in log4j-server.properties might look like this: log4j.appender.file.layout=org.apache.log4j.JsonLayout

🔗 References (16)