RHSA-2017:2708HighCVSS 7.5

Red Hat Security Advisory: Red Hat JBoss Core Services security update

Published
September 13, 2017
Last Modified
October 23, 2026

🔗 CVE IDs covered (3)

CVE-2015-3185 →CVE-2016-2183 →CVE-2017-9788 →

📋 Description

CVE-2015-3185 — httpd: ap_some_auth_required() does not properly indicate authenticated request in 2.4 CVE-2016-2183 — SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32) CVE-2017-9788 — httpd: Uninitialized memory reflection in mod_auth_digest

🎯 Affected products1

  • Red Hat JBoss Core Services

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: 1.SSL/TLS configurations should prefer AES over DES. Versions of OpenSSL shipped with Red Hat Enterprise Linux 6 and 7 already do so. In the version of OpenSSL shipped with Red Hat Enterprise Linux 5, 3DES is listed below the AES-256 cipher and above the AES-128 cipher, therefore AES-256 based ciphersuite should not be disabled on the server. 2. Servers using OpenSSL, should not disable AES-128 and AES-256 ciphersuites. Versions of Apache shipped with Red Hat Enterprise Linux use the default cipher string, in which AES is preferred over DES/3DES based ciphersuites. For JBoss Middleware, and Java mitigations, please review this knowledge base article: https://access.redhat.com/articles/2598471 This can be mitigated on OpenShift Container Platform (OCP) by disabling the vulnerable TLS cipher suite in the applicable component. TLS configuration options for OCP are described here: https://access.redhat.com/articles/5348961 Workaround: If you do not use digest authentication, do not load the "auth_digest_module". For example, on RHEL 7, this can be done by commenting out or removing the "LoadModule auth_digest_module modules/mod_auth_digest.so" line within the /etc/httpd/conf.modules.d/00-base.conf configuration file and restarting the service. You can then use the "httpd -t -D DUMP_MODULES" command to verify that the module is no longer loaded.

🔗 References (9)