RHSA-2021:0488LowCVSS 5.9
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP6 security update
🔗 CVE IDs covered (1)
📋 Description
CVE-2020-1971 — openssl: EDIPARTYNAME NULL pointer de-reference
🎯 Affected products1
- JBCS 2.4.37 SP6
✅ Remediation
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link for the update. You must be logged in to download the update. Workaround: Applications not using the GENERAL_NAME_cmp of openssl are not vulnerable to this flaw. Even when this function is used, if the attacker can control both the arguments of this function, only then the attacker could trigger a crash.
🔗 References (7)
- selfhttps://access.redhat.com/errata/RHSA-2021:0488
- externalhttps://access.redhat.com/security/updates/classification/#low
- externalhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.apachehttp&downloadType=securityPatches&version=2.4.37
- externalhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.openssl&downloadType=securityPatches&version=1.1.1c
- externalhttps://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.37/
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1903409
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0488.json