Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP10 security update

CVE-2019-17567 — httpd: mod_proxy_wstunnel tunneling of non Upgraded connection CVE-2019-20838 — pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed quantifier greater than 1 CVE-2020-13950 — httpd: mod_proxy NULL pointer dereference CVE-2020-14155 — pcre: Integer overflow when parsing callout numeric arguments CVE-2020-35452 — httpd: Single zero byte stack overflow in mod_auth_digest CVE-2021-3688 — JBCS: URL normalization issue with dot-dot-semicolon(s) leads to information disclosure CVE-2021-3712 — openssl: Read buffer overruns processing ASN.1 strings CVE-2021-23840 — openssl: integer overflow in CipherUpdate CVE-2021-23841 — openssl: NULL pointer dereference in X509_issuer_and_serial_hash() CVE-2021-26690 — httpd: mod_session: NULL pointer dereference when parsing Cookie header CVE-2021-26691 — httpd: mod_session: Heap overflow via a crafted SessionHeader value CVE-2021-30641 — httpd: Unexpected URL matching with 'MergeSlashes OFF' CVE-2021-34798 — httpd: NULL pointer dereference via malformed requests