RHSA-2020:2644HighCVSS 7.5

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP3 security update

Published
June 22, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (9)

CVE-2019-15903 →CVE-2019-20388 →CVE-2018-20843 →CVE-2019-0197 →CVE-2019-19956 →CVE-2020-1934 →CVE-2020-7595 →CVE-2020-11080 →CVE-2019-0196 →

📋 Description

CVE-2018-20843 — expat: large number of colons in input makes parser consume high amount of resources, leading to DoS CVE-2019-0196 — httpd: mod_http2: read-after-free on a string compare CVE-2019-0197 — httpd: mod_http2: possible crash on late upgrade CVE-2019-15903 — expat: heap-based buffer over-read via crafted XML input CVE-2019-19956 — libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c CVE-2019-20388 — libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c CVE-2020-1934 — httpd: mod_proxy_ftp use of uninitialized value CVE-2020-7595 — libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations CVE-2020-11080 — nghttp2: overly large SETTINGS frames can lead to DoS

🎯 Affected products104

  • Red Hat JBoss Core Services on RHEL 6 Server
  • Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-curl-0:7.64.1-36.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-curl-0:7.64.1-36.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-curl-0:7.64.1-36.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-curl-0:7.64.1-36.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-curl-0:7.64.1-36.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-curl-debuginfo-0:7.64.1-36.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-curl-debuginfo-0:7.64.1-36.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-curl-debuginfo-0:7.64.1-36.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-0:2.4.37-57.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-httpd-0:2.4.37-57.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-httpd-0:2.4.37-57.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-httpd-0:2.4.37-57.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-0:2.4.37-57.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-debuginfo-0:2.4.37-57.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-httpd-debuginfo-0:2.4.37-57.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-httpd-debuginfo-0:2.4.37-57.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-devel-0:2.4.37-57.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-httpd-devel-0:2.4.37-57.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-httpd-devel-0:2.4.37-57.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-manual-0:2.4.37-57.jbcs.el6.noarch as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-httpd-manual-0:2.4.37-57.jbcs.el7.noarch as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-selinux-0:2.4.37-57.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-httpd-selinux-0:2.4.37-57.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-httpd-selinux-0:2.4.37-57.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-tools-0:2.4.37-57.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-httpd-tools-0:2.4.37-57.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-httpd-tools-0:2.4.37-57.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-libcurl-0:7.64.1-36.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • +74 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (13)