RHSA-2020:1336MediumCVSS 6.6

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP2 security update

Published
April 6, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (9)

CVE-2019-1549 →CVE-2019-10081 →CVE-2019-10097 →CVE-2019-10098 →CVE-2019-1547 →CVE-2019-1563 →CVE-2019-10082 →CVE-2019-10092 →CVE-2020-1927 →

📋 Description

CVE-2019-1547 — openssl: side-channel weak encryption vulnerability CVE-2019-1549 — openssl: information disclosure in fork() CVE-2019-1563 — openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey CVE-2019-10081 — httpd: memory corruption on early pushes CVE-2019-10082 — httpd: read-after-free in h2 connection shutdown CVE-2019-10092 — httpd: limited cross-site scripting in mod_proxy error page CVE-2019-10097 — httpd: null-pointer dereference in mod_remoteip CVE-2019-10098 — httpd: mod_rewrite potential open redirect CVE-2020-1927 — httpd: mod_rewrite configurations vulnerable to open redirect

🎯 Affected products1

  • JBoss Core Services Apache HTTP Server 2.4.37 SP2

✅ Remediation

The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Core Services installation (including all applications and configuration files). Workaround: This attack is carried out by sending a large number of messages to be decrypted by the victim. The attacker needs to receive a response from the victim if the decryption was successful or not. Therefore only if the user application compiled with openssl is designed above way, the attack will be viable. Only CMS_decrypt and PKCS7_decrypt functions are affected. Applications compiled with openssl are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Workaround: This flaw is only exploitable if Apache httpd is configured to respond to HTTP/2 requests, which is done by including "h2" or "h2c" in the "Protocols" list in a configuration file. The following command can be used to search for possible vulnerable configurations: grep -R '^\s*Protocols\>.*\<h2\>' /etc/httpd/ See https://httpd.apache.org/docs/2.4/mod/mod_http2.html Workaround: This flaw is only exploitable if Proxy* directives are used in Apache httpd configuration. The following command can be used to search for possible vulnerable configurations: grep -R '^\s*Proxy' /etc/httpd/ See https://httpd.apache.org/docs/2.4/mod/mod_proxy.html Workaround: This flaw is only exploitable if RemoteIP* directives are used in Apache httpd configuration. The following command can be used to search for possible vulnerable configurations: grep -R '^\s*RemoteIP' /etc/httpd/ See https://httpd.apache.org/docs/2.4/mod/mod_remoteip.html Workaround: This flaw requires the use of certain Rewrite configuration directives. The following command can be used to search for possible vulnerable configurations: grep -R '^\s*Rewrite' /etc/httpd/ See https://httpd.apache.org/docs/2.4/mod/mod_rewrite.html

🔗 References (15)