RHSA-2023:3355HighCVSS 9.8

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP2 security update

Published
June 5, 2023
Last Modified
August 4, 2026

🔗 CVE IDs covered (15)

CVE-2023-27533 →CVE-2023-27534 →CVE-2022-43552 →CVE-2023-23914 →CVE-2023-25690 →CVE-2023-23915 →CVE-2006-20001 →CVE-2022-43551 →CVE-2023-0286 →CVE-2022-4304 →CVE-2022-4450 →CVE-2022-25147 →CVE-2022-43680 →CVE-2023-0215 →CVE-2023-23916 →

📋 Description

CVE-2006-20001 — httpd: mod_dav: out-of-bounds read/write of zero byte CVE-2022-4304 — openssl: timing attack in RSA Decryption implementation CVE-2022-4450 — openssl: double free after calling PEM_read_bio_ex CVE-2022-25147 — apr-util: out-of-bounds writes in the apr_base64 CVE-2022-43551 — curl: HSTS bypass via IDN CVE-2022-43552 — curl: Use-after-free triggered by an HTTP proxy deny response CVE-2022-43680 — expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate CVE-2023-0215 — openssl: use-after-free following BIO_new_NDEF CVE-2023-0286 — openssl: X.400 address type confusion in X.509 GeneralName CVE-2023-23914 — curl: HSTS ignored on multiple requests CVE-2023-23915 — curl: HSTS amnesia with --parallel CVE-2023-23916 — curl: HTTP multi-header compression denial of service CVE-2023-25690 — httpd: HTTP request splitting with mod_rewrite and mod_proxy CVE-2023-27533 — curl: TELNET option IAC injection CVE-2023-27534 — curl: SFTP path ~ resolving discrepancy

🎯 Affected products1

  • JBCS httpd 2.4.51.sp2

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Disabling mod_dav and restarting httpd will mitigate this flaw. Workaround: Avoid using the SMB and TELNET protocols. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (18)