RHSA-2023:7623MediumCVSS 6.5

Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.7 release and security update

Published
December 7, 2023
Last Modified
August 4, 2026

🔗 CVE IDs covered (8)

CVE-2023-0465 →CVE-2023-0466 →CVE-2023-2650 →CVE-2023-3446 →CVE-2023-3817 →CVE-2023-41080 →CVE-2023-42794 →CVE-2023-0464 →

📋 Description

CVE-2023-0464 — openssl: Denial of service by excessive resource usage in verifying X509 policy constraints CVE-2023-0465 — openssl: Invalid certificate policies in leaf certificates are silently ignored CVE-2023-0466 — openssl: Certificate policy check not enabled CVE-2023-2650 — openssl: Possible DoS translating ASN.1 object identifiers CVE-2023-3446 — openssl: Excessive time spent checking DH keys and parameters CVE-2023-3817 — OpenSSL: Excessive time spent checking DH q parameter value CVE-2023-41080 — tomcat: Open Redirect vulnerability in FORM authentication CVE-2023-42794 — tomcat: FileUpload: DoS due to accumulation of temporary files on Windows

🎯 Affected products1

  • Red Hat JBoss Web Server 5

✅ Remediation

Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files. The References section of this erratum contains a download link for the update. You must be logged in to download the update. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: No mitigation is currently available for this flaw.

🔗 References (10)