- Vulnerability/
- RHSA-2018:2185
RHSA-2018:2185: Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 7 security update
First published: Thu Jul 12 2018(Updated: )
This release adds the new Apache HTTP Server 2.4.29 packages that are part<br>of the JBoss Core Services offering.<br>This release serves as a replacement for Red Hat JBoss Core Services<br>Apache HTTP Server 2.4.23, and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes,<br>enhancements and component upgrades included in this release.<br>This release upgrades OpenSSL to version 1.0.2.n<br>Security Fix(es):<br><li> openssl: Out-of-bounds write caused by unchecked errors in BN_bn2dec() (CVE-2016-2182)</li> <li> openssl: Insufficient TLS session ticket HMAC length checks (CVE-2016-6302)</li> <li> openssl: certificate message OOB reads (CVE-2016-6306)</li> <li> openssl: Carry propagating bug in Montgomery multiplication (CVE-2016-7055)</li> <li> openssl: Truncated packet could crash via OOB read (CVE-2017-3731)</li> <li> openssl: BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)</li> <li> openssl: bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)</li> <li> openssl: Read/write after SSL object in error state (CVE-2017-3737)</li> <li> openssl: rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)</li> Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6306 <br>and CVE-2016-7055. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6306.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/jbcs-httpd24-apache-commons-daemon | <1.1.0-1.redhat_2.1.jbcs.el7 | 1.1.0-1.redhat_2.1.jbcs.el7 |
| redhat/jbcs-httpd24-apache-commons-daemon-jsvc | <1.1.0-1.redhat_2.jbcs.el7 | 1.1.0-1.redhat_2.jbcs.el7 |
| redhat/jbcs-httpd24-apr | <1.6.3-14.jbcs.el7 | 1.6.3-14.jbcs.el7 |
| redhat/jbcs-httpd24-apr-util | <1.6.1-9.jbcs.el7 | 1.6.1-9.jbcs.el7 |
| redhat/jbcs-httpd24-httpd | <2.4.29-17.jbcs.el7 | 2.4.29-17.jbcs.el7 |
| redhat/jbcs-httpd24-nghttp2 | <1.29.0-8.jbcs.el7 | 1.29.0-8.jbcs.el7 |
| redhat/jbcs-httpd24-openssl | <1.0.2n-11.jbcs.el7 | 1.0.2n-11.jbcs.el7 |
| redhat/jbcs-httpd24-apache-commons-daemon | <1.1.0-1.redhat_2.1.jbcs.el7 | 1.1.0-1.redhat_2.1.jbcs.el7 |
| redhat/jbcs-httpd24-apache-commons-daemon-jsvc | <1.1.0-1.redhat_2.jbcs.el7 | 1.1.0-1.redhat_2.jbcs.el7 |
| redhat/jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo | <1.1.0-1.redhat_2.jbcs.el7 | 1.1.0-1.redhat_2.jbcs.el7 |
| redhat/jbcs-httpd24-apr | <1.6.3-14.jbcs.el7 | 1.6.3-14.jbcs.el7 |
| redhat/jbcs-httpd24-apr-debuginfo | <1.6.3-14.jbcs.el7 | 1.6.3-14.jbcs.el7 |
| redhat/jbcs-httpd24-apr-devel | <1.6.3-14.jbcs.el7 | 1.6.3-14.jbcs.el7 |
| redhat/jbcs-httpd24-apr-util | <1.6.1-9.jbcs.el7 | 1.6.1-9.jbcs.el7 |
| redhat/jbcs-httpd24-apr-util-debuginfo | <1.6.1-9.jbcs.el7 | 1.6.1-9.jbcs.el7 |
| redhat/jbcs-httpd24-apr-util-devel | <1.6.1-9.jbcs.el7 | 1.6.1-9.jbcs.el7 |
| redhat/jbcs-httpd24-apr-util-ldap | <1.6.1-9.jbcs.el7 | 1.6.1-9.jbcs.el7 |
| redhat/jbcs-httpd24-apr-util-mysql | <1.6.1-9.jbcs.el7 | 1.6.1-9.jbcs.el7 |
| redhat/jbcs-httpd24-apr-util-nss | <1.6.1-9.jbcs.el7 | 1.6.1-9.jbcs.el7 |
| redhat/jbcs-httpd24-apr-util-odbc | <1.6.1-9.jbcs.el7 | 1.6.1-9.jbcs.el7 |
| redhat/jbcs-httpd24-apr-util-openssl | <1.6.1-9.jbcs.el7 | 1.6.1-9.jbcs.el7 |
| redhat/jbcs-httpd24-apr-util-pgsql | <1.6.1-9.jbcs.el7 | 1.6.1-9.jbcs.el7 |
| redhat/jbcs-httpd24-apr-util-sqlite | <1.6.1-9.jbcs.el7 | 1.6.1-9.jbcs.el7 |
| redhat/jbcs-httpd24-httpd | <2.4.29-17.jbcs.el7 | 2.4.29-17.jbcs.el7 |
| redhat/jbcs-httpd24-httpd-debuginfo | <2.4.29-17.jbcs.el7 | 2.4.29-17.jbcs.el7 |
| redhat/jbcs-httpd24-httpd-devel | <2.4.29-17.jbcs.el7 | 2.4.29-17.jbcs.el7 |
| redhat/jbcs-httpd24-httpd-manual | <2.4.29-17.jbcs.el7 | 2.4.29-17.jbcs.el7 |
| redhat/jbcs-httpd24-httpd-selinux | <2.4.29-17.jbcs.el7 | 2.4.29-17.jbcs.el7 |
| redhat/jbcs-httpd24-httpd-tools | <2.4.29-17.jbcs.el7 | 2.4.29-17.jbcs.el7 |
| redhat/jbcs-httpd24-nghttp2 | <1.29.0-8.jbcs.el7 | 1.29.0-8.jbcs.el7 |
| redhat/jbcs-httpd24-nghttp2-debuginfo | <1.29.0-8.jbcs.el7 | 1.29.0-8.jbcs.el7 |
| redhat/jbcs-httpd24-nghttp2-devel | <1.29.0-8.jbcs.el7 | 1.29.0-8.jbcs.el7 |
| redhat/jbcs-httpd24-openssl | <1.0.2n-11.jbcs.el7 | 1.0.2n-11.jbcs.el7 |
| redhat/jbcs-httpd24-openssl-debuginfo | <1.0.2n-11.jbcs.el7 | 1.0.2n-11.jbcs.el7 |
| redhat/jbcs-httpd24-openssl-devel | <1.0.2n-11.jbcs.el7 | 1.0.2n-11.jbcs.el7 |
| redhat/jbcs-httpd24-openssl-libs | <1.0.2n-11.jbcs.el7 | 1.0.2n-11.jbcs.el7 |
| redhat/jbcs-httpd24-openssl-perl | <1.0.2n-11.jbcs.el7 | 1.0.2n-11.jbcs.el7 |
| redhat/jbcs-httpd24-openssl-static | <1.0.2n-11.jbcs.el7 | 1.0.2n-11.jbcs.el7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1367340
- https://bugzilla.redhat.com/show_bug.cgi?id=1369855
- https://bugzilla.redhat.com/show_bug.cgi?id=1377594
- https://bugzilla.redhat.com/show_bug.cgi?id=1393929
- https://bugzilla.redhat.com/show_bug.cgi?id=1416852
- https://bugzilla.redhat.com/show_bug.cgi?id=1416856
- https://bugzilla.redhat.com/show_bug.cgi?id=1509169
- https://bugzilla.redhat.com/show_bug.cgi?id=1523504
- https://bugzilla.redhat.com/show_bug.cgi?id=1523510
- https://access.redhat.com/security/updates/classification/#moderate
- https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.29/
- https://access.redhat.com/errata/RHSA-2018:2185 (Advisory)
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- collector/redhat-errata
- source/Red Hat
- anchor-id/RHSA-2018:2185
- agent/software-canonical-lookup
- package-manager/redhat