RHSA-2021:4861HighCVSS 7.5

Red Hat Security Advisory: Red Hat JBoss Web Server 5.6.0 Security release

Published
November 30, 2021
Last Modified
August 4, 2026

🔗 CVE IDs covered (6)

CVE-2021-33037 →CVE-2021-42340 →CVE-2021-3712 →CVE-2021-23840 →CVE-2021-23841 →CVE-2021-30640 →

📋 Description

CVE-2021-3712 — openssl: Read buffer overruns processing ASN.1 strings CVE-2021-23840 — openssl: integer overflow in CipherUpdate CVE-2021-23841 — openssl: NULL pointer dereference in X509_issuer_and_serial_hash() CVE-2021-30640 — tomcat: JNDI realm authentication weakness CVE-2021-33037 — tomcat: HTTP request smuggling when used with a reverse proxy CVE-2021-42340 — tomcat: OutOfMemoryError caused by HTTP upgrade connection leak could lead to DoS

🎯 Affected products38

  • Red Hat JBoss Web Server 5.6 for RHEL 7 Server
  • Red Hat JBoss Web Server 5.6 for RHEL 8
  • jws5-tomcat-0:9.0.50-3.redhat_00004.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.6 for RHEL 7 Server
  • jws5-tomcat-0:9.0.50-3.redhat_00004.1.el7jws.src as a component of Red Hat JBoss Web Server 5.6 for RHEL 7 Server
  • jws5-tomcat-0:9.0.50-3.redhat_00004.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.6 for RHEL 8
  • jws5-tomcat-0:9.0.50-3.redhat_00004.1.el8jws.src as a component of Red Hat JBoss Web Server 5.6 for RHEL 8
  • jws5-tomcat-admin-webapps-0:9.0.50-3.redhat_00004.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.6 for RHEL 7 Server
  • jws5-tomcat-admin-webapps-0:9.0.50-3.redhat_00004.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.6 for RHEL 8
  • jws5-tomcat-docs-webapp-0:9.0.50-3.redhat_00004.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.6 for RHEL 7 Server
  • jws5-tomcat-docs-webapp-0:9.0.50-3.redhat_00004.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.6 for RHEL 8
  • jws5-tomcat-el-3.0-api-0:9.0.50-3.redhat_00004.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.6 for RHEL 7 Server
  • jws5-tomcat-el-3.0-api-0:9.0.50-3.redhat_00004.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.6 for RHEL 8
  • jws5-tomcat-java-jdk11-0:9.0.50-3.redhat_00004.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.6 for RHEL 7 Server
  • jws5-tomcat-java-jdk8-0:9.0.50-3.redhat_00004.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.6 for RHEL 7 Server
  • jws5-tomcat-javadoc-0:9.0.50-3.redhat_00004.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.6 for RHEL 7 Server
  • jws5-tomcat-javadoc-0:9.0.50-3.redhat_00004.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.6 for RHEL 8
  • jws5-tomcat-jsp-2.3-api-0:9.0.50-3.redhat_00004.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.6 for RHEL 7 Server
  • jws5-tomcat-jsp-2.3-api-0:9.0.50-3.redhat_00004.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.6 for RHEL 8
  • jws5-tomcat-lib-0:9.0.50-3.redhat_00004.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.6 for RHEL 7 Server
  • jws5-tomcat-lib-0:9.0.50-3.redhat_00004.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.6 for RHEL 8
  • jws5-tomcat-native-0:1.2.30-3.redhat_3.el7jws.src as a component of Red Hat JBoss Web Server 5.6 for RHEL 7 Server
  • jws5-tomcat-native-0:1.2.30-3.redhat_3.el7jws.x86_64 as a component of Red Hat JBoss Web Server 5.6 for RHEL 7 Server
  • jws5-tomcat-native-0:1.2.30-3.redhat_3.el8jws.src as a component of Red Hat JBoss Web Server 5.6 for RHEL 8
  • jws5-tomcat-native-0:1.2.30-3.redhat_3.el8jws.x86_64 as a component of Red Hat JBoss Web Server 5.6 for RHEL 8
  • jws5-tomcat-native-debuginfo-0:1.2.30-3.redhat_3.el7jws.x86_64 as a component of Red Hat JBoss Web Server 5.6 for RHEL 7 Server
  • jws5-tomcat-native-debuginfo-0:1.2.30-3.redhat_3.el8jws.x86_64 as a component of Red Hat JBoss Web Server 5.6 for RHEL 8
  • jws5-tomcat-selinux-0:9.0.50-3.redhat_00004.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.6 for RHEL 7 Server
  • jws5-tomcat-selinux-0:9.0.50-3.redhat_00004.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.6 for RHEL 8
  • jws5-tomcat-servlet-4.0-api-0:9.0.50-3.redhat_00004.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.6 for RHEL 7 Server
  • jws5-tomcat-servlet-4.0-api-0:9.0.50-3.redhat_00004.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.6 for RHEL 8
  • +8 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Customers should make an attempt to run current binaries/architectures and not rely on compatibility layers to run older binaries/architectures. In case older binaries/architectures are needed, sandboxing should be used to address such problems and guard the bug. Workaround: As per upstream "The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources."

🔗 References (6)