RHSA-2021:2471HighCVSS 8.1

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP8 security update

Published
June 17, 2021
Last Modified
August 4, 2026

🔗 CVE IDs covered (7)

CVE-2020-8284 →CVE-2020-8285 →CVE-2020-8286 →CVE-2021-22876 →CVE-2021-22890 →CVE-2021-22901 →CVE-2020-8169 →

📋 Description

CVE-2020-8169 — libcurl: partial password leak over DNS on HTTP redirect CVE-2020-8284 — curl: FTP PASV command response can cause curl to connect to arbitrary host CVE-2020-8285 — curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used CVE-2020-8286 — curl: Inferior OCSP verification CVE-2021-22876 — curl: Leak of authentication credentials in URL via automatic Referer CVE-2021-22890 — curl: TLS 1.3 session ticket mix-up with HTTPS proxy host CVE-2021-22901 — curl: Use-after-free in TLS session handling when using OpenSSL TLS backend

🎯 Affected products1

  • JBoss Core Services Apache HTTP Server 2.4.37 SP8

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link for the update. You must be logged in to download the update. Workaround: This flaw can be mitigated in curl as shipped with Red Hat Enterprise Linux and Red Hat Software Collections when using curl by passing the `--ftp-skip-pasv-ip` command line option to curl. For usage of libcurl, set `CURLOPT_FTP_SKIP_PASV_IP` to `1L`[1]. Note that these mitigations could cause problems in the uncommon instance that the server needs the client to connect back to an IP other than the control connection IP address. 1. https://curl.se/libcurl/c/CURLOPT_FTP_SKIP_PASV_IP.html Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: This issue can be avoided by using at least one of the following recommendations: * Do not enable automatic generation of Referer headers when redirects are followed. This functionality is not enabled by default. In the curl command line tool, it is enabled using the -e ';auto' or --referer ';auto' command line options. In the libcurl library, it is enabled using the CURLOPT_AUTOREFERER option. * Do not include authentication credentials in URLs (in the form of https://username:[email protected]), use other methods to provide authentication credentials to curl / libcurl. For the curl command line tool, use -u or --user command line option. For the libcurl library, use CURLOPT_USERPWD or CURLOPT_USERNAME / CURLOPT_PASSWORD options.

🔗 References (14)