RHSA-2021:0494MediumCVSS 7.5

Red Hat Security Advisory: Red Hat JBoss Web Server 5.4.1 Security Update

Published
February 11, 2021
Last Modified
August 4, 2026

🔗 CVE IDs covered (4)

CVE-2020-17527 →CVE-2021-24122 →CVE-2020-1971 →CVE-2020-13943 →

📋 Description

CVE-2020-1971 — openssl: EDIPARTYNAME NULL pointer de-reference CVE-2020-13943 — tomcat: Apache Tomcat HTTP/2 Request mix-up CVE-2020-17527 — tomcat: HTTP/2 request header mix-up CVE-2021-24122 — tomcat: Information disclosure when using NTFS file system

🎯 Affected products30

  • Red Hat JBoss Web Server 5.4 for RHEL 7 Server
  • Red Hat JBoss Web Server 5.4 for RHEL 8
  • jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server
  • jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server
  • jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8
  • jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src as a component of Red Hat JBoss Web Server 5.4 for RHEL 8
  • jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server
  • jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8
  • jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server
  • jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8
  • jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server
  • jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8
  • jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server
  • jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8
  • jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server
  • jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8
  • jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server
  • jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8
  • jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server
  • jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64 as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server
  • jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src as a component of Red Hat JBoss Web Server 5.4 for RHEL 8
  • jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64 as a component of Red Hat JBoss Web Server 5.4 for RHEL 8
  • jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64 as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server
  • jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64 as a component of Red Hat JBoss Web Server 5.4 for RHEL 8
  • jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server
  • jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8
  • jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server
  • jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8
  • jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server
  • jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Applications not using the GENERAL_NAME_cmp of openssl are not vulnerable to this flaw. Even when this function is used, if the attacker can control both the arguments of this function, only then the attacker could trigger a crash.

🔗 References (7)