Headline
Red Hat Security Advisory 2023-1663-01
Red Hat Security Advisory 2023-1663-01 - Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector, the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library. This release of Red Hat JBoss Web Server 5.7.2 serves as a replacement for Red Hat JBoss Web Server 5.7.1. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes, linked to in the References.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Low: Red Hat JBoss Web Server 5.7.2 release and security update
Advisory ID: RHSA-2023:1663-01
Product: Red Hat JBoss Web Server
Advisory URL: https://access.redhat.com/errata/RHSA-2023:1663
Issue date: 2023-04-12
CVE Names: CVE-2022-42252 CVE-2022-45143
=====================================================================
- Summary:
An update is now available for Red Hat JBoss Web Server 5.7.2 on Red Hat
Enterprise Linux versions 7, 8, and 9.
Red Hat Product Security has rated this update as having a security impact
of Low. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat JBoss Web Server 5.7 for RHEL 7 Server - noarch
Red Hat JBoss Web Server 5.7 for RHEL 8 - noarch
Red Hat JBoss Web Server 5.7 for RHEL 9 - noarch
- Description:
Red Hat JBoss Web Server is a fully integrated and certified set of
components for hosting Java web applications. It is comprised of the Apache
Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the
PicketLink Vault extension for Apache Tomcat, and the Tomcat Native
library.
This release of Red Hat JBoss Web Server 5.7.2 serves as a replacement for
Red Hat JBoss Web Server 5.7.1. This release includes bug fixes,
enhancements and component upgrades, which are documented in the Release
Notes, linked to in the References.
Security Fix(es):
jws5-tomcat: tomcat: request smuggling (CVE-2022-42252)
jws5-tomcat: tomcat: JsonErrorReportValve injection (CVE-2022-45143)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
- Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
2141329 - CVE-2022-42252 tomcat: request smuggling
2158695 - CVE-2022-45143 tomcat: JsonErrorReportValve injection
- Package List:
Red Hat JBoss Web Server 5.7 for RHEL 7 Server:
Source:
jws5-tomcat-9.0.62-13.redhat_00011.1.el7jws.src.rpm
noarch:
jws5-tomcat-9.0.62-13.redhat_00011.1.el7jws.noarch.rpm
jws5-tomcat-admin-webapps-9.0.62-13.redhat_00011.1.el7jws.noarch.rpm
jws5-tomcat-docs-webapp-9.0.62-13.redhat_00011.1.el7jws.noarch.rpm
jws5-tomcat-el-3.0-api-9.0.62-13.redhat_00011.1.el7jws.noarch.rpm
jws5-tomcat-java-jdk11-9.0.62-13.redhat_00011.1.el7jws.noarch.rpm
jws5-tomcat-java-jdk8-9.0.62-13.redhat_00011.1.el7jws.noarch.rpm
jws5-tomcat-javadoc-9.0.62-13.redhat_00011.1.el7jws.noarch.rpm
jws5-tomcat-jsp-2.3-api-9.0.62-13.redhat_00011.1.el7jws.noarch.rpm
jws5-tomcat-lib-9.0.62-13.redhat_00011.1.el7jws.noarch.rpm
jws5-tomcat-selinux-9.0.62-13.redhat_00011.1.el7jws.noarch.rpm
jws5-tomcat-servlet-4.0-api-9.0.62-13.redhat_00011.1.el7jws.noarch.rpm
jws5-tomcat-webapps-9.0.62-13.redhat_00011.1.el7jws.noarch.rpm
Red Hat JBoss Web Server 5.7 for RHEL 8:
Source:
jws5-tomcat-9.0.62-13.redhat_00011.1.el8jws.src.rpm
noarch:
jws5-tomcat-9.0.62-13.redhat_00011.1.el8jws.noarch.rpm
jws5-tomcat-admin-webapps-9.0.62-13.redhat_00011.1.el8jws.noarch.rpm
jws5-tomcat-docs-webapp-9.0.62-13.redhat_00011.1.el8jws.noarch.rpm
jws5-tomcat-el-3.0-api-9.0.62-13.redhat_00011.1.el8jws.noarch.rpm
jws5-tomcat-javadoc-9.0.62-13.redhat_00011.1.el8jws.noarch.rpm
jws5-tomcat-jsp-2.3-api-9.0.62-13.redhat_00011.1.el8jws.noarch.rpm
jws5-tomcat-lib-9.0.62-13.redhat_00011.1.el8jws.noarch.rpm
jws5-tomcat-selinux-9.0.62-13.redhat_00011.1.el8jws.noarch.rpm
jws5-tomcat-servlet-4.0-api-9.0.62-13.redhat_00011.1.el8jws.noarch.rpm
jws5-tomcat-webapps-9.0.62-13.redhat_00011.1.el8jws.noarch.rpm
Red Hat JBoss Web Server 5.7 for RHEL 9:
Source:
jws5-tomcat-9.0.62-13.redhat_00011.1.el9jws.src.rpm
noarch:
jws5-tomcat-9.0.62-13.redhat_00011.1.el9jws.noarch.rpm
jws5-tomcat-admin-webapps-9.0.62-13.redhat_00011.1.el9jws.noarch.rpm
jws5-tomcat-docs-webapp-9.0.62-13.redhat_00011.1.el9jws.noarch.rpm
jws5-tomcat-el-3.0-api-9.0.62-13.redhat_00011.1.el9jws.noarch.rpm
jws5-tomcat-javadoc-9.0.62-13.redhat_00011.1.el9jws.noarch.rpm
jws5-tomcat-jsp-2.3-api-9.0.62-13.redhat_00011.1.el9jws.noarch.rpm
jws5-tomcat-lib-9.0.62-13.redhat_00011.1.el9jws.noarch.rpm
jws5-tomcat-selinux-9.0.62-13.redhat_00011.1.el9jws.noarch.rpm
jws5-tomcat-servlet-4.0-api-9.0.62-13.redhat_00011.1.el9jws.noarch.rpm
jws5-tomcat-webapps-9.0.62-13.redhat_00011.1.el9jws.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2022-42252
https://access.redhat.com/security/cve/CVE-2022-45143
https://access.redhat.com/security/updates/classification/#low
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBZDbdDNzjgjWX9erEAQgKzhAAnJkQUZeQ47zUMX/RBtw59MhHkHuwwZR6
333IQfka9h6txKZ9YDNMrO8+N+QBFiy7z+Z0afLj56kOrVSS7/o72d5A5iovTwki
8Y5rrFbzqIKCoqK696QqA0UAIGeWN4Dk8CRoraAHuW+tB/4u1cEfnZuNB4mfQ7Uh
nk2lPpwzbwW1J6mtPqjlE3wQEP3/7gtLFlbKiK13jzEtjGPHWs9taxescAzfS0hN
tQT6r6ek5EAyS3aBeO/GWjzrrcLJS6lLXkEXOypNEzNH3U8fthlSdtJRCKo7Blqm
oRwcpLKV4IT/5rF5SA0Kb+M9PBdYlJnSnaDFQAcAU9v5GoS6E4V/EK14UJ4Tw4ii
sMu7/zfGezspNFqok0UftP97vhLsdA5rKZNXgeKSmfQT2B4R0AOef8dWyAEcrUyK
3bmQcoP/YOQ8nZb+2vA+rLfwML7fqFio2MbL72s4Gj3Jwcxyt+aTKZcHIV6yx8VX
mH9pjWpgIvpnDvWhM4FiTWe2IqQ5qWdsVK2RbcKX3UMkRZvvkyHWzPeVM1aTWfq6
lL29LKhLESvqbLjFG/r6rnjrPuuChetr5qT0UQFp93bSez37jncTWuwcgCrf84KN
u+7dxIK5ao8O0ZvIobivJTeu4GkNcMQEoq5bAdeGGCOGRx3rQwrX3wof7tpEm7Tc
m2JImjNFncU=
=3rkd
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
Ubuntu Security Notice 6880-1 - Sam Shahsavar discovered that Apache Tomcat did not properly reject HTTP requests with an invalid Content-Length header. A remote attacker could possibly use this issue to perform HTTP request smuggling attacks.
Red Hat Security Advisory 2023-4612-01 - Red Hat support for Spring Boot provides an application platform that reduces the complexity of developing and operating applications for OpenShift as a containerized platform. This release of Red Hat support for Spring Boot 2.7.13 serves as a replacement for Red Hat support for Spring Boot 2.7.12, and includes security, bug fixes and enhancements. For more information, see the release notes linked in the References section. Issues addressed include bypass, code execution, denial of service, and deserialization vulnerabilities.
An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46877: A flaw was found in Jackson Databind. This issue may allow a malicious user to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization. * CVE-2022-1471: A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malici...
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). The supported version that is affected is 11.2.13.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. While the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).
Red Hat Security Advisory 2023-3954-01 - This release of Red Hat Fuse 7.12 serves as a replacement for Red Hat Fuse 7.11 and includes bug fixes and enhancements, which are documented in the Release Notes document linked in the References. Issues addressed include bypass, code execution, denial of service, information leakage, resource exhaustion, server-side request forgery, and traversal vulnerabilities.
A minor version update (from 7.11 to 7.12) is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2012-5783: It was found that Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or su...
Dell VxRail, version(s) 8.0.100 and earlier contain a denial-of-service vulnerability in the upgrade functionality. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to degraded performance and system malfunction.
Dell SCG 5.14 contains an information disclosure vulnerability during the SRS to SCG upgrade path. A remote low privileged malicious user could potentially exploit this vulnerability to retrieve the plain text.
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through...
Red Hat Security Advisory 2023-1664-01 - Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector, the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library. This release of Red Hat JBoss Web Server 5.7.2 serves as a replacement for Red Hat JBoss Web Server 5.7.1. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes, linked to in the References.
Red Hat JBoss Web Server 5.7.2 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Microsoft Windows. Red Hat Product Security has rated this release as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-42252: A flaw was found in Apache Tomcat. If the server is configured to ignore invalid HTTP headers, the server does not reject a request containing an invalid content-length header, making it vulnerable to a request smuggling attack. * CVE-2022-45143: A fla...
An update is now available for Red Hat JBoss Web Server 5.7.2 on Red Hat Enterprise Linux versions 7, 8, and 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-42252: A flaw was found in Apache Tomcat. If the server is configured to ignore invalid HTTP headers, the server does not reject a request containing an invalid content-length header, making it vulnerable to a request smuggling attack. * CVE-2022-45143: A flaw was found in the Tomcat package. This flaw allowed users t...
Debian Linux Security Advisory 5381-1 - Several security vulnerabilities have been discovered in the Tomcat servlet and JSP engine.
Debian Linux Security Advisory 5381-1 - Several security vulnerabilities have been discovered in the Tomcat servlet and JSP engine.
Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: E-Business Collections). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Demantra Demand Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Demantra Demand Management accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
The `JsonErrorReportValve` in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 does not escape the `type`, `message` or `description` values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.
The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.
If Apache Tomcat 8.5.0 to 8.5.52, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.
If Apache Tomcat 8.5.0 to 8.5.52, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.