RHSA-2020:4383MediumCVSS 9.8

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP5 security update

Published
October 28, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (4)

CVE-2019-1551 →CVE-2019-5435 →CVE-2020-11984 →CVE-2020-11993 →

📋 Description

CVE-2019-1551 — openssl: Integer overflow in RSAZ modular exponentiation on x86_64 CVE-2019-5435 — curl: Integer overflows in curl_url_set() function CVE-2020-11984 — httpd: mod_proxy_uwsgi buffer overflow CVE-2020-11993 — httpd: mod_http2 concurrent pool usage

🎯 Affected products1

  • Text-Only JBCS

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link for the update. You must be logged in to download the update. Workaround: For Red Hat Enterprise Linux 7, 512 bit DH is already disabled. As this bug is about leakage of the private key to the attacker, it should be fully sufficient to just not use 1024 bit RSA keys or 1024 bit DSA keys. These keys are not secure enough anyway. 3-prime RSA keys are not supported on RHEL-7. For Red Hat Enterprise 8, The DEFAULT crypto policy already disables all these key sizes. Also applications compiled with openssl which use the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME, other users of this API are not affected by this flaw. Workaround: This flaw only affects specific httpd configurations which use the uwsgi protocol. It does not manifest itself when uwsgi protocol is not used. Commenting out "LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so" in /etc/httpd/conf.modules.d/00-proxy.conf will disable the loading of the vulnerable module.

🔗 References (7)