Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 security update
Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP6 security update
Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP6 security update
Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP5 security update
Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP5 security update
Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4 security update
Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP3 security update
Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP3 security update
Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP2 security update
Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP2 security update
Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP1 security update
Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 security update
Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 security update
A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability.
A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability.
A flaw was found in Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44. The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (modjk) Connector did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.
References: https://lists.apache.org/thread.html/6d564bb0ab73d6b3efdd1d6b1c075d1a2c84ecd84a4159d6122529ad@%3Cannounce.tomcat.apache.org%3E
It was found that Red Hat JBoss Core Services incorrectly included CVE-2016-3705 as resolved in Apache HTTP 2.4.23 (erratum RHSA-2016:2957). The release did not include the fix to libxml2, leaving it vulnerable to a Denial of Service attack due to a Stack Overflow. This is a regression CVE for CVE-2016-3705.
It was found that Red Hat JBoss Core Services incorrectly fixed CVE-2016-3627 in Apache HTTP 2.4.23 (erratum RHSA-2016:2957), leaving libxml2 vulnerable to a Denial of Service attack via stack consumption.
It was found that Red Hat JBoss Core Services incorrectly fixed CVE-2016-3627 in Apache HTTP 2.4.23 (erratum RHSA-2016:2957), leaving libxml2 vulnerable to a Denial of Service attack via stack consumption.