Important: Red Hat JBoss Web Server 5.7.8 release and security update

Important: Red Hat JBoss Web Server 5.7.8 release and security update

Important: Red Hat JBoss Web Server 6.0.1 release and security update

Important: Red Hat JBoss Web Server 6.0.1 release and security update

Important: Red Hat JBoss Web Server 5.8.0 release and security update

Important: Red Hat JBoss Web Server 5.8.0 release and security update

Important: Red Hat JBoss Web Server 6.0.2 release and security update

Important: Red Hat JBoss Web Server 5.8.1 release and security update

Important: Red Hat JBoss Web Server 5.8.1 release and security update

Important: Red Hat JBoss Web Server 5.7.5 release and security update

Important: Red Hat JBoss Web Server 5.7.5 release and security update

Moderate: Red Hat JBoss Web Server 5.7.4 release and security update

Moderate: Red Hat JBoss Web Server 5.7.4 release and security update

Moderate: Red Hat JBoss Web Server 5.8.2 release and security update

Moderate: Red Hat JBoss Web Server 5.8.2 release and security update

Moderate: Red Hat JBoss Web Server 6.0.5 release and security update

Moderate: Red Hat JBoss Web Server 6.0.5 release and security update

Moderate: Red Hat JBoss Web Server 5.8.3 release and security update

Moderate: Red Hat JBoss Web Server 5.8.3 release and security update

Moderate: Red Hat JBoss Web Server 5.8.4 release and security update

Moderate: Red Hat JBoss Web Server 5.7.7 release and security update

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (modcluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.This release of Red Hat JBoss Web Server 6.0.3 serves as a replacement for Red Hat JBoss Web Server 6.0.2. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.Security Fix(es): jws6-tomcat: Improper Handling of Exceptional Conditions (CVE-2024-34750) jws6-tomcat: Denial of Service in Tomcat (CVE-2024-38286) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (modcluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.<br>This release of Red Hat JBoss Web Server 5.8.4 serves as a replacement for Red Hat JBoss Web Server 5.8.3. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.<br>Security Fix(es):<br><li> tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation [jws-5] (CVE-2024-56337)</li> <li> tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITYUPDATE frame [jws-5] (CVE-2025-31650)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.<br>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.<br>This release provides an update to OpenSSL and Tomcat 6/7 for Red Hat JBoss Web Server 2.1.2. The updates are documented in the Release Notes document linked to in the References.<br>Users of Red Hat JBoss Web Server 2.1.2 should upgrade to these updated packages, which resolve several security issues.<br>Security Fix(es):<br><li> A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304)</li> <li> A vulnerability was discovered in tomcat's handling of pipelined requests when "Sendfile" was used. If sendfile processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could lead to invalid responses or information disclosure. (CVE-2017-5647)</li> <li> A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page. (CVE-2017-5664)</li> <li> A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. (CVE-2016-8610)</li> Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6304 and Shi Lei (Gear Team of Qihoo 360 Inc.) for reporting CVE-2016-8610. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6304.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (modcluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.This release of Red Hat JBoss Web Server 5.3.1 serves as a replacement for Red Hat JBoss Web Server 5.3.0, and includes bug fixes, enhancements, and component upgrades, which are documented in the Release Notes, linked to in the References.Security Fix(es): tomcat: Apache Tomcat Remote Code Execution via session persistence (CVE-2020-9484) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (modcluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.This release of Red Hat JBoss Web Server 5.6.2 serves as a replacement for Red Hat JBoss Web Server 5.6.1. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes, linked to in the References.Security Fix(es): openssl: Infinite loop in BNmodsqrt() reachable when parsing certificates (CVE-2022-0778) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (modjk), JBoss HTTP Connector (modcluster), Hibernate, and the Tomcat Native library.<br>This release of Red Hat JBoss Web Server 3.1 Service Pack 2 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References.<br>Security Fix(es):<br><li> apr: Out-of-bounds array deref in aprtimeexp() functions (CVE-2017-12613)</li> <li> tomcat: Remote Code Execution via JSP Upload (CVE-2017-12615)</li> <li> tomcat: Information Disclosure when using VirtualDirContext (CVE-2017-12616)</li> <li> tomcat: Remote Code Execution bypass for CVE-2017-12615 (CVE-2017-12617)</li> <li> tomcat-native: Mishandling of client certificates can allow for OCSP check bypass (CVE-2017-15698)</li> <li> tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources (CVE-2018-1304)</li> <li> tomcat: Late application of security constraints can lead to resource exposure for unauthorised users (CVE-2018-1305)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (modcluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.<br>Refer to the Release Notes for information on the most significant bug fixes, enhancements and component upgrades included in this release.<br>Security Fix(es):<br><li> openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) </li> <li> tomcat: XSS in SSI printenv (CVE-2019-0221) </li> <li> openssl: 0-byte record padding oracle (CVE-2019-1559) </li> <li> tomcat: HTTP/2 implementation leads to denial of service (CVE-2019-10072)</li> <li> tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (modcluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.This release of Red Hat JBoss Web Server 5.4.1 serves as a replacement for Red Hat JBoss Web Server 5.4.0, and includes bug fixes, enhancements, and component upgrades, which are documented in the Release Notes, linked to in the References.Security Fix(es): tomcat: Apache Tomcat HTTP/2 Request mix-up (CVE-2020-13943) tomcat: HTTP/2 request header mix-up (CVE-2020-17527) tomcat: Information disclosure when using NTFS file system (CVE-2021-24122) openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (modcluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.This release of Red Hat JBoss Web Server 5.7.1 serves as a replacement for Red Hat JBoss Web Server 5.7.0. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes, linked to in the References.Security Fix(es): openssl: crehash script allows command injection (CVE-2022-1292) openssl: the crehash script allows command injection (CVE-2022-2068) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.