Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2020-1971 (GCVE-0-2020-1971)
Vulnerability from cvelistv5 – Published: 2020-12-08 15:30 – Updated: 2026-05-29 15:40
VLAI
EPSS
Title
EDIPARTYNAME NULL pointer dereference
Summary
The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the "-crl_download" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- NULL pointer dereference
- CWE-476 - NULL Pointer Dereference
Assigner
References
26 references
Impacted products
Date Public
2020-12-08 00:00
Credits
David Benjamin (Google)
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T06:54:00.529Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.openssl.org/news/secadv/20201208.txt"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f960d81215ebf3f65e03d4d5d857fb9b666d6920"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e"
},
{
"name": "DSA-4807",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2020/dsa-4807"
},
{
"name": "FreeBSD-SA-20:33",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc"
},
{
"name": "[debian-lts-announce] 20201214 [SECURITY] [DLA 2493-1] openssl1.0 security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html"
},
{
"name": "[debian-lts-announce] 20201214 [SECURITY] [DLA 2492-1] openssl security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html"
},
{
"name": "FEDORA-2020-ef1870065a",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/"
},
{
"name": "[pulsar-commits] 20201216 [GitHub] [pulsar] phijohns-tibco opened a new issue #8978: OpenSSL needs to be updated to 1.1.1i current version is unsupported.",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143%40%3Ccommits.pulsar.apache.org%3E"
},
{
"name": "FEDORA-2020-a31b01e945",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/"
},
{
"name": "GLSA-202012-13",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202012-13"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.tenable.com/security/tns-2020-11"
},
{
"tags": [
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20201218-0005/"
},
{
"tags": [
"x_transferred"
],
"url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676"
},
{
"name": "[tomcat-dev] 20210207 [Bug 65126] New: A security vulnerability cve-2020-1971 in Tomcat dependency Library in version 9.0.40.",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c%40%3Cdev.tomcat.apache.org%3E"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.tenable.com/security/tns-2021-10"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.tenable.com/security/tns-2021-09"
},
{
"tags": [
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20210513-0002/"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.oracle.com//security-alerts/cpujul2021.html"
},
{
"name": "[oss-security] 20210914 Re: Oracle Solaris membership in the distros list",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/09/14/2"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2020-1971",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-29T15:40:23.131860Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-29T15:40:28.488Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "OpenSSL",
"vendor": "OpenSSL",
"versions": [
{
"status": "affected",
"version": "Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h)"
},
{
"status": "affected",
"version": "Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w)"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "David Benjamin (Google)"
}
],
"datePublic": "2020-12-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL\u0027s s_server, s_client and verify tools have support for the \"-crl_download\" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL\u0027s parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w)."
}
],
"metrics": [
{
"other": {
"content": {
"lang": "eng",
"url": "https://www.openssl.org/policies/secpolicy.html#High",
"value": "High"
},
"type": "unknown"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "NULL pointer dereference",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-21T19:06:11.147Z",
"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
"shortName": "openssl"
},
"references": [
{
"url": "https://www.openssl.org/news/secadv/20201208.txt"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f960d81215ebf3f65e03d4d5d857fb9b666d6920"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e"
},
{
"name": "DSA-4807",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4807"
},
{
"name": "FreeBSD-SA-20:33",
"tags": [
"vendor-advisory"
],
"url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc"
},
{
"name": "[debian-lts-announce] 20201214 [SECURITY] [DLA 2493-1] openssl1.0 security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html"
},
{
"name": "[debian-lts-announce] 20201214 [SECURITY] [DLA 2492-1] openssl security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html"
},
{
"name": "FEDORA-2020-ef1870065a",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/"
},
{
"name": "[pulsar-commits] 20201216 [GitHub] [pulsar] phijohns-tibco opened a new issue #8978: OpenSSL needs to be updated to 1.1.1i current version is unsupported.",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143%40%3Ccommits.pulsar.apache.org%3E"
},
{
"name": "FEDORA-2020-a31b01e945",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/"
},
{
"name": "GLSA-202012-13",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202012-13"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"url": "https://www.tenable.com/security/tns-2020-11"
},
{
"url": "https://security.netapp.com/advisory/ntap-20201218-0005/"
},
{
"url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676"
},
{
"name": "[tomcat-dev] 20210207 [Bug 65126] New: A security vulnerability cve-2020-1971 in Tomcat dependency Library in version 9.0.40.",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c%40%3Cdev.tomcat.apache.org%3E"
},
{
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"url": "https://www.tenable.com/security/tns-2021-10"
},
{
"url": "https://www.tenable.com/security/tns-2021-09"
},
{
"url": "https://security.netapp.com/advisory/ntap-20210513-0002/"
},
{
"url": "https://www.oracle.com//security-alerts/cpujul2021.html"
},
{
"name": "[oss-security] 20210914 Re: Oracle Solaris membership in the distros list",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2021/09/14/2"
},
{
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
}
],
"title": "EDIPARTYNAME NULL pointer dereference"
}
},
"cveMetadata": {
"assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
"assignerShortName": "openssl",
"cveId": "CVE-2020-1971",
"datePublished": "2020-12-08T15:30:16.835Z",
"dateReserved": "2019-12-03T00:00:00.000Z",
"dateUpdated": "2026-05-29T15:40:28.488Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2020-1971",
"date": "2026-06-09",
"epss": "0.00348",
"percentile": "0.57652"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.0.2\", \"versionEndExcluding\": \"1.0.2x\", \"matchCriteriaId\": \"4D0947DA-4A07-4C73-9FE7-7666734C568B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.1.1\", \"versionEndExcluding\": \"1.1.1i\", \"matchCriteriaId\": \"BFE3E95C-90F0-48C0-A737-28AD6AC2BDB8\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DEECE5FC-CACF-4496-A3E7-164736409252\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"36D96259-24BD-44E2-96D9-78CE1D41F956\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E460AA51-FCDA-46B9-AE97-E6676AA5E194\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A5553591-073B-45E3-999F-21B8BA2EEE22\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:*\", \"matchCriteriaId\": \"D40AD626-B23A-44A3-A6C0-1FFB4D647AE4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:*\", \"matchCriteriaId\": \"B602F9E8-1580-436C-A26D-6E6F8121A583\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*\", \"matchCriteriaId\": \"77C3DD16-1D81-40E1-B312-50FBD275507C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*\", \"matchCriteriaId\": \"81DAC8C0-D342-44B5-9432-6B88D389584F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C2A5B24D-BDF2-423C-98EA-A40778C01A05\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.0\", \"versionEndIncluding\": \"8.1.0\", \"matchCriteriaId\": \"B5B4A191-44AE-4C35-9164-19237D2CF013\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.2.0\", \"versionEndIncluding\": \"8.2.3\", \"matchCriteriaId\": \"A543B4F8-149A-48AB-B388-AB7FA2ECAC18\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_session_border_controller:cz8.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"45F90ABB-2633-447C-B510-D63D9898BD67\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_session_border_controller:cz8.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"22822A0F-A2C4-427A-931F-428D2C010ECD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_session_border_controller:cz8.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"62A561CF-09BE-4EDB-AAB7-4B057C0B0E44\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_session_router:cz8.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"58E8C3A9-1B8B-4D13-B0E9-DC620F619DD9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_session_router:cz8.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5C880943-5A11-483E-9DA8-88D1D487BAA4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_session_router:cz8.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"ECF63433-30CC-4E0D-B66A-FD160111763B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"662B8154-6FFA-4B63-B5AD-18B1CECB3AF6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5F2BFCE3-D743-4AC6-8FEC-75CAF66BFB65\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B8D05530-BFC7-4652-B387-BC931F43AB5B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_unified_session_manager:scz8.2.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A200B074-61AF-4E1D-8F96-A73BECF81BC4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"83739D8B-EAA0-43CD-B0EB-278C2F65CA42\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2D3AD28E-4372-4B22-A0B9-B9BA7760E381\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4B317147-064A-4786-B3D6-CDE1653E067E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7582B307-3899-4BBB-B868-BC912A4D0109\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D26F3E23-F1A9-45E7-9E5F-0C0A24EE3783\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.4.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"61516569-C48F-4362-B334-8CA10EDB0EC2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B095CC03-7077-4A58-AB25-CC5380CDCE5A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EC124081-4465-4A80-897A-1DAC1013915E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B2AFC7C4-9FCC-425B-A010-F9EA0665753F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FC109637-7BCA-4E9D-AC51-48D488E17E2B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"394A16F2-CCD4-44E5-BF6B-E0C782A9FA38\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:graalvm:19.3.4:*:*:*:enterprise:*:*:*\", \"matchCriteriaId\": \"937F66F5-F5BA-4156-82E0-EB2C99ABD41A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:graalvm:20.3.0:*:*:*:enterprise:*:*:*\", \"matchCriteriaId\": \"BC0F8B31-F93B-40B6-9C06-A3996DC63829\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AD04BEE5-E9A8-4584-A68C-0195CE9C402C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"9.2.5.3\", \"matchCriteriaId\": \"4BCA7DD9-8599-4E43-9D82-999BE15483B9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0B1CAD50-749F-4ADB-A046-BF3585677A58\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"8.0.22\", \"matchCriteriaId\": \"16DEEDB2-E304-41A3-97DB-EDDFB16BE624\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"5.7.32\", \"matchCriteriaId\": \"B4335442-548B-48AB-A399-DB146C6A8705\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.15\", \"versionEndIncluding\": \"8.0.22\", \"matchCriteriaId\": \"B7EAD39D-A892-4667-89D9-F66A33EAF9B7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D0A735B4-4F3C-416B-8C08-9CB21BAD2889\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7E1E416B-920B-49A0-9523-382898C2979D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D9DB4A14-2EF5-4B54-95D2-75E6CF9AA0A9\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*\", \"matchCriteriaId\": \"3A756737-1CC4-42C2-A4DF-E1C893B4E2D5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*\", \"matchCriteriaId\": \"B55E8D50-99B4-47EC-86F9-699B67D473CE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"62347994-1353-497C-9C4A-D5D8D95F67E8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:data_ontap:-:*:*:*:*:7-mode:*:*\", \"matchCriteriaId\": \"6C2ACC32-5147-4EA5-95BE-B6B4EAB3D82B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"11.0.0\", \"versionEndIncluding\": \"11.60.3\", \"matchCriteriaId\": \"BD1E9594-C46F-40D1-8BC2-6B16635B55C4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A3C19813-E823-456A-B1CE-EC0684CE1953\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D39DCAE7-494F-40B2-867F-6C6A077939DD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F1BE6C1F-2565-4E97-92AA-16563E5660A5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5735E553-9731-4AAC-BCFF-989377F817B3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FFE0A9D2-9A49-4BF6-BC6F-8249162D8334\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"361B791A-D336-4431-8F68-8135BEFFAEA2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BDFB1169-41A0-4A86-8E4F-FDA9730B1E94\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AD7447BC-F315-4298-A822-549942FC118B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"02DEB4FB-A21D-4CB1-B522-EEE5093E8521\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:ef600a_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5356D8E0-38AB-44F2-BA0A-F884C92222D1\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:ef600a:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"44824034-DB0C-47AC-A32F-1EA373F30A61\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:aff_a250_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0D5DE972-F8B8-4964-943A-DA0BD18289D1\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:aff_a250:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D4B1F59C-6ADA-4930-834F-2A8A8444F6AE\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.0.9\", \"matchCriteriaId\": \"4ACF85D6-6B45-43DA-9C01-F0208186F014\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:tenable:nessus_network_monitor:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.13.1\", \"matchCriteriaId\": \"A87E730E-019C-4DCB-BA73-3994ECEF0C66\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.0.1.1\", \"matchCriteriaId\": \"B0F46497-4AB0-49A7-9453-CC26837BF253\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\", \"versionStartIncluding\": \"10.0.0\", \"versionEndIncluding\": \"10.12.0\", \"matchCriteriaId\": \"25A3180B-21AF-4010-9DAB-41ADFD2D8031\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*\", \"versionStartIncluding\": \"10.13.0\", \"versionEndExcluding\": \"10.23.1\", \"matchCriteriaId\": \"33081E31-5166-4064-91AA-951F5CD930D3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\", \"versionStartIncluding\": \"12.0.0\", \"versionEndIncluding\": \"12.12.0\", \"matchCriteriaId\": \"564ED5C8-50D7-413A-B88E-E62B6C07336A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*\", \"versionStartIncluding\": \"12.13.0\", \"versionEndExcluding\": \"12.20.1\", \"matchCriteriaId\": \"58879E00-2C36-4C1B-9993-2422346624D3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\", \"versionStartIncluding\": \"14.0.0\", \"versionEndIncluding\": \"14.14.0\", \"matchCriteriaId\": \"428DCD7B-6F66-4F18-B780-5BD80143D482\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*\", \"versionStartIncluding\": \"14.15.0\", \"versionEndExcluding\": \"14.15.4\", \"matchCriteriaId\": \"2F2D8EEB-7A9E-472A-B820-A3C33CB93B61\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\", \"versionStartIncluding\": \"15.0.0\", \"versionEndExcluding\": \"15.5.0\", \"matchCriteriaId\": \"1A868E7E-C25A-4B2A-BB37-7F2584ECB2D4\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL\u0027s s_server, s_client and verify tools have support for the \\\"-crl_download\\\" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL\u0027s parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).\"}, {\"lang\": \"es\", \"value\": \"El tipo GeneralName X.509 es un tipo gen\\u00e9rico para representar diferentes tipos de nombres.\u0026#xa0;Uno de esos tipos de nombres se conoce como EDIPartyName.\u0026#xa0;OpenSSL proporciona una funci\\u00f3n GENERAL_NAME_cmp que compara diferentes instancias de GENERAL_NAME para ver si son iguales o no.\u0026#xa0;Esta funci\\u00f3n se comporta incorrectamente cuando ambos GENERAL_NAME contienen un EDIPARTYNAME.\u0026#xa0;Es posible que se produzca una desreferencia del puntero NULL y un bloqueo que conduzca a un posible ataque de denegaci\\u00f3n de servicio.\u0026#xa0;El propio OpenSSL usa la funci\\u00f3n GENERAL_NAME_cmp para dos prop\\u00f3sitos:\u0026#xa0;1) Comparaci\\u00f3n de nombres de puntos de distribuci\\u00f3n de CRL entre una CRL disponible y un punto de distribuci\\u00f3n de CRL insertado en un certificado X509 2) Al comparar que un firmante de token de respuesta de marca de tiempo coincide con el nombre de autoridad de marca de tiempo (expuesto por medio de las funciones API TS_RESP_verify_response y TS_RESP_verify_token) Si un atacante puede controlar ambos elementos que se est\\u00e1n comparando, entonces ese atacante podr\\u00eda desencadenar un bloqueo.\u0026#xa0;Por ejemplo, si el atacante puede enga\\u00f1ar a un cliente o servidor para que compruebe un certificado malicioso con una CRL maliciosa, esto puede ocurrir.\u0026#xa0;Tome en cuenta que algunas aplicaciones descargan autom\\u00e1ticamente las CRL basadas en una URL insertada en un certificado.\u0026#xa0;Esta comprobaci\\u00f3n ocurre antes de que se verifiquen las firmas en el certificado y la CRL.\u0026#xa0;Las herramientas s_server, s_client y verify de OpenSSL tienen soporte para la opci\\u00f3n \\\"-crl_download\\\"\u0026#xa0;que implementa la descarga autom\\u00e1tica de CRL y se ha demostrado que este ataque funciona contra esas herramientas.\u0026#xa0;Tome en cuenta que un error no relacionado significa que las versiones afectadas de OpenSSL no pueden analizar ni construir codificaciones correctas de EDIPARTYNAME.\u0026#xa0;Sin embargo, es posible construir un EDIPARTYNAME malformado que el analizador de OpenSSL aceptar\\u00e1 y, por lo tanto, desencadenar\\u00e1 este ataque.\u0026#xa0;Todas las versiones de OpenSSL 1.1.1 y 1.0.2 est\\u00e1n afectadas por este problema.\u0026#xa0;Otras versiones de OpenSSL no son compatibles y no se han comprobado.\u0026#xa0;Corregido en OpenSSL versiones 1.1.1i (Afectado versiones 1.1.1-1.1.1h).\u0026#xa0;Corregido en OpenSSL versiones 1.0.2x (Afectado versiones 1.0.2-1.0.2w).\u0026#xa0;Sin embargo, es posible construir un EDIPARTYNAME malformado que el analizador de OpenSSL aceptar\\u00e1 y, por lo tanto, desencadenar\\u00e1 este ataque.\u0026#xa0;Todas las versiones de OpenSSL 1.1.1 y 1.0.2 est\\u00e1n afectadas por este problema.\u0026#xa0;Otras versiones de OpenSSL no son compatibles y no se han comprobado.\u0026#xa0;Corregido en OpenSSL versi\\u00f3n 1.1.1i (Afectada versi\\u00f3n 1.1.1-1.1.1h).\u0026#xa0;Corregido en OpenSSL versi\\u00f3n 1.0.2x (Afectada versi\\u00f3n 1.0.2-1.0.2w).\u0026#xa0;Sin embargo, es posible construir un EDIPARTYNAME malformado que el analizador de OpenSSL aceptar\\u00e1 y, por lo tanto, desencadenar\\u00e1 este ataque.\u0026#xa0;Todas las versiones de OpenSSL 1.1.1 y 1.0.2 est\\u00e1n afectadas por este problema.\u0026#xa0;Otras versiones de OpenSSL no son compatibles y no se han comprobado.\u0026#xa0;Corregido en OpenSSL versi\\u00f3n 1.1.1i (Afectada versi\\u00f3n 1.1.1-1.1.1h).\u0026#xa0;Corregido en OpenSSL versi\\u00f3n 1.0.2x (Afectada versi\\u00f3n 1.0.2-1.0.2w)\"}]",
"id": "CVE-2020-1971",
"lastModified": "2024-11-21T05:11:45.673",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.9, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:N/A:P\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2020-12-08T16:15:11.730",
"references": "[{\"url\": \"http://www.openwall.com/lists/oss-security/2021/09/14/2\", \"source\": \"openssl-security@openssl.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf\", \"source\": \"openssl-security@openssl.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e\", \"source\": \"openssl-security@openssl.org\"}, {\"url\": \"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f960d81215ebf3f65e03d4d5d857fb9b666d6920\", \"source\": \"openssl-security@openssl.org\"}, {\"url\": \"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676\", \"source\": \"openssl-security@openssl.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"openssl-security@openssl.org\"}, {\"url\": \"https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143%40%3Ccommits.pulsar.apache.org%3E\", \"source\": \"openssl-security@openssl.org\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html\", \"source\": \"openssl-security@openssl.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html\", \"source\": \"openssl-security@openssl.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/\", \"source\": \"openssl-security@openssl.org\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/\", \"source\": \"openssl-security@openssl.org\"}, {\"url\": \"https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc\", \"source\": \"openssl-security@openssl.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.gentoo.org/glsa/202012-13\", \"source\": \"openssl-security@openssl.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20201218-0005/\", \"source\": \"openssl-security@openssl.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20210513-0002/\", \"source\": \"openssl-security@openssl.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20240621-0006/\", \"source\": \"openssl-security@openssl.org\"}, {\"url\": \"https://www.debian.org/security/2020/dsa-4807\", \"source\": \"openssl-security@openssl.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.openssl.org/news/secadv/20201208.txt\", \"source\": \"openssl-security@openssl.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.oracle.com//security-alerts/cpujul2021.html\", \"source\": \"openssl-security@openssl.org\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuApr2021.html\", \"source\": \"openssl-security@openssl.org\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuapr2022.html\", \"source\": \"openssl-security@openssl.org\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2021.html\", \"source\": \"openssl-security@openssl.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuoct2021.html\", \"source\": \"openssl-security@openssl.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.tenable.com/security/tns-2020-11\", \"source\": \"openssl-security@openssl.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.tenable.com/security/tns-2021-09\", \"source\": \"openssl-security@openssl.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.tenable.com/security/tns-2021-10\", \"source\": \"openssl-security@openssl.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/09/14/2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f960d81215ebf3f65e03d4d5d857fb9b666d6920\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143%40%3Ccommits.pulsar.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.gentoo.org/glsa/202012-13\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20201218-0005/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20210513-0002/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20240621-0006/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.debian.org/security/2020/dsa-4807\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.openssl.org/news/secadv/20201208.txt\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.oracle.com//security-alerts/cpujul2021.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuApr2021.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuapr2022.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2021.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuoct2021.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.tenable.com/security/tns-2020-11\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.tenable.com/security/tns-2021-09\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.tenable.com/security/tns-2021-10\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
"sourceIdentifier": "openssl-security@openssl.org",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2020-1971\",\"sourceIdentifier\":\"openssl-security@openssl.org\",\"published\":\"2020-12-08T16:15:11.730\",\"lastModified\":\"2026-05-29T16:16:20.507\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL\u0027s s_server, s_client and verify tools have support for the \\\"-crl_download\\\" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL\u0027s parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).\"},{\"lang\":\"es\",\"value\":\"El tipo GeneralName X.509 es un tipo gen\u00e9rico para representar diferentes tipos de nombres.\u0026#xa0;Uno de esos tipos de nombres se conoce como EDIPartyName.\u0026#xa0;OpenSSL proporciona una funci\u00f3n GENERAL_NAME_cmp que compara diferentes instancias de GENERAL_NAME para ver si son iguales o no.\u0026#xa0;Esta funci\u00f3n se comporta incorrectamente cuando ambos GENERAL_NAME contienen un EDIPARTYNAME.\u0026#xa0;Es posible que se produzca una desreferencia del puntero NULL y un bloqueo que conduzca a un posible ataque de denegaci\u00f3n de servicio.\u0026#xa0;El propio OpenSSL usa la funci\u00f3n GENERAL_NAME_cmp para dos prop\u00f3sitos:\u0026#xa0;1) Comparaci\u00f3n de nombres de puntos de distribuci\u00f3n de CRL entre una CRL disponible y un punto de distribuci\u00f3n de CRL insertado en un certificado X509 2) Al comparar que un firmante de token de respuesta de marca de tiempo coincide con el nombre de autoridad de marca de tiempo (expuesto por medio de las funciones API TS_RESP_verify_response y TS_RESP_verify_token) Si un atacante puede controlar ambos elementos que se est\u00e1n comparando, entonces ese atacante podr\u00eda desencadenar un bloqueo.\u0026#xa0;Por ejemplo, si el atacante puede enga\u00f1ar a un cliente o servidor para que compruebe un certificado malicioso con una CRL maliciosa, esto puede ocurrir.\u0026#xa0;Tome en cuenta que algunas aplicaciones descargan autom\u00e1ticamente las CRL basadas en una URL insertada en un certificado.\u0026#xa0;Esta comprobaci\u00f3n ocurre antes de que se verifiquen las firmas en el certificado y la CRL.\u0026#xa0;Las herramientas s_server, s_client y verify de OpenSSL tienen soporte para la opci\u00f3n \\\"-crl_download\\\"\u0026#xa0;que implementa la descarga autom\u00e1tica de CRL y se ha demostrado que este ataque funciona contra esas herramientas.\u0026#xa0;Tome en cuenta que un error no relacionado significa que las versiones afectadas de OpenSSL no pueden analizar ni construir codificaciones correctas de EDIPARTYNAME.\u0026#xa0;Sin embargo, es posible construir un EDIPARTYNAME malformado que el analizador de OpenSSL aceptar\u00e1 y, por lo tanto, desencadenar\u00e1 este ataque.\u0026#xa0;Todas las versiones de OpenSSL 1.1.1 y 1.0.2 est\u00e1n afectadas por este problema.\u0026#xa0;Otras versiones de OpenSSL no son compatibles y no se han comprobado.\u0026#xa0;Corregido en OpenSSL versiones 1.1.1i (Afectado versiones 1.1.1-1.1.1h).\u0026#xa0;Corregido en OpenSSL versiones 1.0.2x (Afectado versiones 1.0.2-1.0.2w).\u0026#xa0;Sin embargo, es posible construir un EDIPARTYNAME malformado que el analizador de OpenSSL aceptar\u00e1 y, por lo tanto, desencadenar\u00e1 este ataque.\u0026#xa0;Todas las versiones de OpenSSL 1.1.1 y 1.0.2 est\u00e1n afectadas por este problema.\u0026#xa0;Otras versiones de OpenSSL no son compatibles y no se han comprobado.\u0026#xa0;Corregido en OpenSSL versi\u00f3n 1.1.1i (Afectada versi\u00f3n 1.1.1-1.1.1h).\u0026#xa0;Corregido en OpenSSL versi\u00f3n 1.0.2x (Afectada versi\u00f3n 1.0.2-1.0.2w).\u0026#xa0;Sin embargo, es posible construir un EDIPARTYNAME malformado que el analizador de OpenSSL aceptar\u00e1 y, por lo tanto, desencadenar\u00e1 este ataque.\u0026#xa0;Todas las versiones de OpenSSL 1.1.1 y 1.0.2 est\u00e1n afectadas por este problema.\u0026#xa0;Otras versiones de OpenSSL no son compatibles y no se han comprobado.\u0026#xa0;Corregido en OpenSSL versi\u00f3n 1.1.1i (Afectada versi\u00f3n 1.1.1-1.1.1h).\u0026#xa0;Corregido en OpenSSL versi\u00f3n 1.0.2x (Afectada versi\u00f3n 1.0.2-1.0.2w)\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:N/A:P\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.0.2\",\"versionEndExcluding\":\"1.0.2x\",\"matchCriteriaId\":\"4D0947DA-4A07-4C73-9FE7-7666734C568B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.1.1\",\"versionEndExcluding\":\"1.1.1i\",\"matchCriteriaId\":\"BFE3E95C-90F0-48C0-A737-28AD6AC2BDB8\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36D96259-24BD-44E2-96D9-78CE1D41F956\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E460AA51-FCDA-46B9-AE97-E6676AA5E194\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A5553591-073B-45E3-999F-21B8BA2EEE22\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"D40AD626-B23A-44A3-A6C0-1FFB4D647AE4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"B602F9E8-1580-436C-A26D-6E6F8121A583\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"77C3DD16-1D81-40E1-B312-50FBD275507C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"81DAC8C0-D342-44B5-9432-6B88D389584F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C2A5B24D-BDF2-423C-98EA-A40778C01A05\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndIncluding\":\"8.1.0\",\"matchCriteriaId\":\"B5B4A191-44AE-4C35-9164-19237D2CF013\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.2.0\",\"versionEndIncluding\":\"8.2.3\",\"matchCriteriaId\":\"A543B4F8-149A-48AB-B388-AB7FA2ECAC18\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_session_border_controller:cz8.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"45F90ABB-2633-447C-B510-D63D9898BD67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_session_border_controller:cz8.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"22822A0F-A2C4-427A-931F-428D2C010ECD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_session_border_controller:cz8.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"62A561CF-09BE-4EDB-AAB7-4B057C0B0E44\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_session_router:cz8.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"58E8C3A9-1B8B-4D13-B0E9-DC620F619DD9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_session_router:cz8.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5C880943-5A11-483E-9DA8-88D1D487BAA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_session_router:cz8.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ECF63433-30CC-4E0D-B66A-FD160111763B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"662B8154-6FFA-4B63-B5AD-18B1CECB3AF6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F2BFCE3-D743-4AC6-8FEC-75CAF66BFB65\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8D05530-BFC7-4652-B387-BC931F43AB5B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_unified_session_manager:scz8.2.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A200B074-61AF-4E1D-8F96-A73BECF81BC4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"83739D8B-EAA0-43CD-B0EB-278C2F65CA42\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D3AD28E-4372-4B22-A0B9-B9BA7760E381\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4B317147-064A-4786-B3D6-CDE1653E067E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7582B307-3899-4BBB-B868-BC912A4D0109\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D26F3E23-F1A9-45E7-9E5F-0C0A24EE3783\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.4.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"61516569-C48F-4362-B334-8CA10EDB0EC2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B095CC03-7077-4A58-AB25-CC5380CDCE5A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC124081-4465-4A80-897A-1DAC1013915E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2AFC7C4-9FCC-425B-A010-F9EA0665753F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FC109637-7BCA-4E9D-AC51-48D488E17E2B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"394A16F2-CCD4-44E5-BF6B-E0C782A9FA38\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:graalvm:19.3.4:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"937F66F5-F5BA-4156-82E0-EB2C99ABD41A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:graalvm:20.3.0:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"BC0F8B31-F93B-40B6-9C06-A3996DC63829\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AD04BEE5-E9A8-4584-A68C-0195CE9C402C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"9.2.5.3\",\"matchCriteriaId\":\"4BCA7DD9-8599-4E43-9D82-999BE15483B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B1CAD50-749F-4ADB-A046-BF3585677A58\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"8.0.22\",\"matchCriteriaId\":\"16DEEDB2-E304-41A3-97DB-EDDFB16BE624\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"5.7.32\",\"matchCriteriaId\":\"B4335442-548B-48AB-A399-DB146C6A8705\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.15\",\"versionEndIncluding\":\"8.0.22\",\"matchCriteriaId\":\"B7EAD39D-A892-4667-89D9-F66A33EAF9B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D0A735B4-4F3C-416B-8C08-9CB21BAD2889\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7E1E416B-920B-49A0-9523-382898C2979D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9DB4A14-2EF5-4B54-95D2-75E6CF9AA0A9\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*\",\"matchCriteriaId\":\"3A756737-1CC4-42C2-A4DF-E1C893B4E2D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*\",\"matchCriteriaId\":\"B55E8D50-99B4-47EC-86F9-699B67D473CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"62347994-1353-497C-9C4A-D5D8D95F67E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:data_ontap:-:*:*:*:*:7-mode:*:*\",\"matchCriteriaId\":\"6C2ACC32-5147-4EA5-95BE-B6B4EAB3D82B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"11.0.0\",\"versionEndIncluding\":\"11.60.3\",\"matchCriteriaId\":\"BD1E9594-C46F-40D1-8BC2-6B16635B55C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A3C19813-E823-456A-B1CE-EC0684CE1953\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D39DCAE7-494F-40B2-867F-6C6A077939DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F1BE6C1F-2565-4E97-92AA-16563E5660A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5735E553-9731-4AAC-BCFF-989377F817B3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FFE0A9D2-9A49-4BF6-BC6F-8249162D8334\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"361B791A-D336-4431-8F68-8135BEFFAEA2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BDFB1169-41A0-4A86-8E4F-FDA9730B1E94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AD7447BC-F315-4298-A822-549942FC118B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"02DEB4FB-A21D-4CB1-B522-EEE5093E8521\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:ef600a_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5356D8E0-38AB-44F2-BA0A-F884C92222D1\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:ef600a:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"44824034-DB0C-47AC-A32F-1EA373F30A61\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:aff_a250_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D5DE972-F8B8-4964-943A-DA0BD18289D1\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:aff_a250:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D4B1F59C-6ADA-4930-834F-2A8A8444F6AE\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.0.9\",\"matchCriteriaId\":\"4ACF85D6-6B45-43DA-9C01-F0208186F014\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tenable:nessus_network_monitor:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.13.1\",\"matchCriteriaId\":\"A87E730E-019C-4DCB-BA73-3994ECEF0C66\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.0.1.1\",\"matchCriteriaId\":\"B0F46497-4AB0-49A7-9453-CC26837BF253\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"10.0.0\",\"versionEndIncluding\":\"10.12.0\",\"matchCriteriaId\":\"25A3180B-21AF-4010-9DAB-41ADFD2D8031\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*\",\"versionStartIncluding\":\"10.13.0\",\"versionEndExcluding\":\"10.23.1\",\"matchCriteriaId\":\"33081E31-5166-4064-91AA-951F5CD930D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"12.0.0\",\"versionEndIncluding\":\"12.12.0\",\"matchCriteriaId\":\"564ED5C8-50D7-413A-B88E-E62B6C07336A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*\",\"versionStartIncluding\":\"12.13.0\",\"versionEndExcluding\":\"12.20.1\",\"matchCriteriaId\":\"58879E00-2C36-4C1B-9993-2422346624D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"14.0.0\",\"versionEndIncluding\":\"14.14.0\",\"matchCriteriaId\":\"428DCD7B-6F66-4F18-B780-5BD80143D482\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*\",\"versionStartIncluding\":\"14.15.0\",\"versionEndExcluding\":\"14.15.4\",\"matchCriteriaId\":\"2F2D8EEB-7A9E-472A-B820-A3C33CB93B61\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"15.0.0\",\"versionEndExcluding\":\"15.5.0\",\"matchCriteriaId\":\"1A868E7E-C25A-4B2A-BB37-7F2584ECB2D4\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2021/09/14/2\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f960d81215ebf3f65e03d4d5d857fb9b666d6920\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143%40%3Ccommits.pulsar.apache.org%3E\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/202012-13\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20201218-0005/\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20210513-0002/\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20240621-0006/\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://www.debian.org/security/2020/dsa-4807\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.openssl.org/news/secadv/20201208.txt\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.oracle.com//security-alerts/cpujul2021.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuApr2021.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2022.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2021.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2021.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2020-11\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2021-09\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2021-10\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2021/09/14/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f960d81215ebf3f65e03d4d5d857fb9b666d6920\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143%40%3Ccommits.pulsar.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/202012-13\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20201218-0005/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20210513-0002/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20240621-0006/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.debian.org/security/2020/dsa-4807\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.openssl.org/news/secadv/20201208.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.oracle.com//security-alerts/cpujul2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuApr2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2022.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2020-11\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2021-09\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2021-10\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.openssl.org/news/secadv/20201208.txt\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f960d81215ebf3f65e03d4d5d857fb9b666d6920\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.debian.org/security/2020/dsa-4807\", \"name\": \"DSA-4807\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc\", \"name\": \"FreeBSD-SA-20:33\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html\", \"name\": \"[debian-lts-announce] 20201214 [SECURITY] [DLA 2493-1] openssl1.0 security update\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html\", \"name\": \"[debian-lts-announce] 20201214 [SECURITY] [DLA 2492-1] openssl security update\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/\", \"name\": \"FEDORA-2020-ef1870065a\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143%40%3Ccommits.pulsar.apache.org%3E\", \"name\": \"[pulsar-commits] 20201216 [GitHub] [pulsar] phijohns-tibco opened a new issue #8978: OpenSSL needs to be updated to 1.1.1i current version is unsupported.\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/\", \"name\": \"FEDORA-2020-a31b01e945\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://security.gentoo.org/glsa/202012-13\", \"name\": \"GLSA-202012-13\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2021.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.tenable.com/security/tns-2020-11\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20201218-0005/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c%40%3Cdev.tomcat.apache.org%3E\", \"name\": \"[tomcat-dev] 20210207 [Bug 65126] New: A security vulnerability cve-2020-1971 in Tomcat dependency Library in version 9.0.40.\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuApr2021.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.tenable.com/security/tns-2021-10\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.tenable.com/security/tns-2021-09\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20210513-0002/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.oracle.com//security-alerts/cpujul2021.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/09/14/2\", \"name\": \"[oss-security] 20210914 Re: Oracle Solaris membership in the distros list\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuoct2021.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuapr2022.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20240621-0006/\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T06:54:00.529Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2020-1971\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-29T15:40:23.131860Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-29T15:40:20.244Z\"}}], \"cna\": {\"title\": \"EDIPARTYNAME NULL pointer dereference\", \"credits\": [{\"lang\": \"en\", \"value\": \"David Benjamin (Google)\"}], \"metrics\": [{\"other\": {\"type\": \"unknown\", \"content\": {\"url\": \"https://www.openssl.org/policies/secpolicy.html#High\", \"lang\": \"eng\", \"value\": \"High\"}}}], \"affected\": [{\"vendor\": \"OpenSSL\", \"product\": \"OpenSSL\", \"versions\": [{\"status\": \"affected\", \"version\": \"Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h)\"}, {\"status\": \"affected\", \"version\": \"Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w)\"}]}], \"datePublic\": \"2020-12-08T00:00:00.000Z\", \"references\": [{\"url\": \"https://www.openssl.org/news/secadv/20201208.txt\"}, {\"url\": \"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f960d81215ebf3f65e03d4d5d857fb9b666d6920\"}, {\"url\": \"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e\"}, {\"url\": \"https://www.debian.org/security/2020/dsa-4807\", \"name\": \"DSA-4807\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc\", \"name\": \"FreeBSD-SA-20:33\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html\", \"name\": \"[debian-lts-announce] 20201214 [SECURITY] [DLA 2493-1] openssl1.0 security update\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html\", \"name\": \"[debian-lts-announce] 20201214 [SECURITY] [DLA 2492-1] openssl security update\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/\", \"name\": \"FEDORA-2020-ef1870065a\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143%40%3Ccommits.pulsar.apache.org%3E\", \"name\": \"[pulsar-commits] 20201216 [GitHub] [pulsar] phijohns-tibco opened a new issue #8978: OpenSSL needs to be updated to 1.1.1i current version is unsupported.\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/\", \"name\": \"FEDORA-2020-a31b01e945\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://security.gentoo.org/glsa/202012-13\", \"name\": \"GLSA-202012-13\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2021.html\"}, {\"url\": \"https://www.tenable.com/security/tns-2020-11\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20201218-0005/\"}, {\"url\": \"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676\"}, {\"url\": \"https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c%40%3Cdev.tomcat.apache.org%3E\", \"name\": \"[tomcat-dev] 20210207 [Bug 65126] New: A security vulnerability cve-2020-1971 in Tomcat dependency Library in version 9.0.40.\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuApr2021.html\"}, {\"url\": \"https://www.tenable.com/security/tns-2021-10\"}, {\"url\": \"https://www.tenable.com/security/tns-2021-09\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20210513-0002/\"}, {\"url\": \"https://www.oracle.com//security-alerts/cpujul2021.html\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2021/09/14/2\", \"name\": \"[oss-security] 20210914 Re: Oracle Solaris membership in the distros list\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuoct2021.html\"}, {\"url\": \"https://www.oracle.com/security-alerts/cpuapr2022.html\"}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20240621-0006/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL\u0027s s_server, s_client and verify tools have support for the \\\"-crl_download\\\" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL\u0027s parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"NULL pointer dereference\"}]}], \"providerMetadata\": {\"orgId\": \"3a12439a-ef3a-4c79-92e6-6081a721f1e5\", \"shortName\": \"openssl\", \"dateUpdated\": \"2024-06-21T19:06:11.147Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2020-1971\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-29T15:40:28.488Z\", \"dateReserved\": \"2019-12-03T00:00:00.000Z\", \"assignerOrgId\": \"3a12439a-ef3a-4c79-92e6-6081a721f1e5\", \"datePublished\": \"2020-12-08T15:30:16.835Z\", \"assignerShortName\": \"openssl\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2021:0491
Vulnerability from csaf_redhat - Published: 2021-02-11 13:39 - Updated: 2026-05-29 17:09Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 11 security update
Severity
Low
Notes
Topic: An update is now available for Red Hat JBoss Web Server 3.1, for RHEL 7 and Windows.
Red Hat Product Security has rated this release as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 3.1 Service Pack 11 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.
5.9 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 3.1
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:3.1
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
References
9 references
Acknowledgments
the OpenSSL project
Google
David Benjamin
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat JBoss Web Server 3.1, for RHEL 7 and Windows.\n\nRed Hat Product Security has rated this release as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 3.1 Service Pack 11 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:0491",
"url": "https://access.redhat.com/errata/RHSA-2021:0491"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "1903409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903409"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0491.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 11 security update",
"tracking": {
"current_release_date": "2026-05-29T17:09:10+00:00",
"generator": {
"date": "2026-05-29T17:09:10+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.1"
}
},
"id": "RHSA-2021:0491",
"initial_release_date": "2021-02-11T13:39:36+00:00",
"revision_history": [
{
"date": "2021-02-11T13:39:36+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-02-11T13:39:36+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-29T17:09:10+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 3.1",
"product": {
"name": "Red Hat JBoss Web Server 3.1",
"product_id": "Red Hat JBoss Web Server 3.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the OpenSSL project"
]
},
{
"names": [
"David Benjamin"
],
"organization": "Google",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-1971",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2020-12-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1903409"
}
],
"notes": [
{
"category": "description",
"text": "A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: EDIPARTYNAME NULL pointer de-reference",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a flaw in the GENERAL_NAME_cmp function of openssl which can be triggered when both its arguments are of the same type i.e. EDIPARTYNAME. \n\n1. Red Hat does not ship any applications compiled with openssl, which used the above function in a vulnerable way.\n\n2. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes, when comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate and when verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token). If an attacker can control both items being compared then that attacker could trigger a crash. For example, if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then a crash may be triggered.\n\nThird party applications compiled with openssl using the function GENERAL_NAME_cmp in a vulnerable way are affected by this flaw.\n\nGENERAL_NAME_cmp was added in 0.9.8k, therefore older versions of openssl are not affected by this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1971"
},
{
"category": "external",
"summary": "RHBZ#1903409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1971",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1971"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971"
},
{
"category": "external",
"summary": "https://www.openssl.org/news/secadv/20201208.txt",
"url": "https://www.openssl.org/news/secadv/20201208.txt"
}
],
"release_date": "2020-12-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-11T13:39:36+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.",
"product_ids": [
"Red Hat JBoss Web Server 3.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0491"
},
{
"category": "workaround",
"details": "Applications not using the GENERAL_NAME_cmp of openssl are not vulnerable to this flaw. Even when this function is used, if the attacker can control both the arguments of this function, only then the attacker could trigger a crash.",
"product_ids": [
"Red Hat JBoss Web Server 3.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Web Server 3.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openssl: EDIPARTYNAME NULL pointer de-reference"
}
]
}
RHSA-2021:0494
Vulnerability from csaf_redhat - Published: 2021-02-11 13:51 - Updated: 2026-05-29 17:09Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 5.4.1 Security Update
Severity
Moderate
Notes
Topic: Updated Red Hat JBoss Web Server 5.4.1 packages are now available for Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 5.4.1 serves as a replacement for Red Hat JBoss Web Server 5.4.0, and includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes, linked to in the References.
Security Fix(es):
* tomcat: Apache Tomcat HTTP/2 Request mix-up (CVE-2020-13943)
* tomcat: HTTP/2 request header mix-up (CVE-2020-17527)
* tomcat: Information disclosure when using NTFS file system (CVE-2021-24122)
* openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.
5.9 (Medium)
Affected products
Fixed
28 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
A flaw was found in Apache Tomcat. If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it is possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources. The highest threat from this vulnerability is to data confidentiality.
5.3 (Medium)
Affected products
Fixed
28 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
7.5 (High)
Affected products
Fixed
28 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Apache Tomcat. When serving resources from a network location using the NTFS file system, it was possible to bypass security constraints and view the source code for JSPs in some configurations. The root cause was the unexpected behavior of the JRE API File.getCanonicalPath(), which was caused by the inconsistent behavior of the Windows API (FindFirstFileW) in some circumstances. The highest threat from this vulnerability is to confidentiality.
5.9 (Medium)
Affected products
Fixed
28 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
33 references
Acknowledgments
the OpenSSL project
Google
David Benjamin
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated Red Hat JBoss Web Server 5.4.1 packages are now available for Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 5.4.1 serves as a replacement for Red Hat JBoss Web Server 5.4.0, and includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes, linked to in the References.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat HTTP/2 Request mix-up (CVE-2020-13943)\n* tomcat: HTTP/2 request header mix-up (CVE-2020-17527)\n* tomcat: Information disclosure when using NTFS file system (CVE-2021-24122)\n* openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:0494",
"url": "https://access.redhat.com/errata/RHSA-2021:0494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1887648",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1887648"
},
{
"category": "external",
"summary": "1903409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903409"
},
{
"category": "external",
"summary": "1904221",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1904221"
},
{
"category": "external",
"summary": "1917209",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1917209"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0494.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 5.4.1 Security Update",
"tracking": {
"current_release_date": "2026-05-29T17:09:10+00:00",
"generator": {
"date": "2026-05-29T17:09:10+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.1"
}
},
"id": "RHSA-2021:0494",
"initial_release_date": "2021-02-11T13:51:48+00:00",
"revision_history": [
{
"date": "2021-02-11T13:51:48+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-02-11T13:51:48+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-29T17:09:10+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product": {
"name": "Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.4::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 5.4 for RHEL 8",
"product": {
"name": "Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.4::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
},
{
"branches": [
{
"category": "product_version",
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"product": {
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"product_id": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native@1.2.25-3.redhat_3.el7jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"product": {
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"product_id": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat@9.0.36-9.redhat_8.1.el7jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"product": {
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"product_id": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native@1.2.25-3.redhat_3.el8jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"product": {
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"product_id": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat@9.0.36-9.redhat_8.1.el8jws?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"product": {
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"product_id": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native@1.2.25-3.redhat_3.el7jws?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"product": {
"name": "jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"product_id": "jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.25-3.redhat_3.el7jws?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"product": {
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"product_id": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native@1.2.25-3.redhat_3.el8jws?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"product": {
"name": "jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"product_id": "jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.25-3.redhat_3.el8jws?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_id": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat@9.0.36-9.redhat_8.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_id": "jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.36-9.redhat_8.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_id": "jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.36-9.redhat_8.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_id": "jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.36-9.redhat_8.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_id": "jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.36-9.redhat_8.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_id": "jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.36-9.redhat_8.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_id": "jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-lib@9.0.36-9.redhat_8.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_id": "jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.36-9.redhat_8.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_id": "jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.36-9.redhat_8.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_id": "jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.36-9.redhat_8.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_id": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat@9.0.36-9.redhat_8.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_id": "jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.36-9.redhat_8.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_id": "jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.36-9.redhat_8.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_id": "jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.36-9.redhat_8.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_id": "jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.36-9.redhat_8.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_id": "jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.36-9.redhat_8.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_id": "jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-lib@9.0.36-9.redhat_8.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_id": "jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.36-9.redhat_8.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_id": "jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.36-9.redhat_8.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_id": "jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.36-9.redhat_8.1.el8jws?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src"
},
"product_reference": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src"
},
"product_reference": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64 as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64"
},
"product_reference": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64 as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64"
},
"product_reference": "jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src"
},
"product_reference": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src"
},
"product_reference": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64 as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64"
},
"product_reference": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64 as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64"
},
"product_reference": "jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.4"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the OpenSSL project"
]
},
{
"names": [
"David Benjamin"
],
"organization": "Google",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-1971",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2020-12-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1903409"
}
],
"notes": [
{
"category": "description",
"text": "A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: EDIPARTYNAME NULL pointer de-reference",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a flaw in the GENERAL_NAME_cmp function of openssl which can be triggered when both its arguments are of the same type i.e. EDIPARTYNAME. \n\n1. Red Hat does not ship any applications compiled with openssl, which used the above function in a vulnerable way.\n\n2. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes, when comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate and when verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token). If an attacker can control both items being compared then that attacker could trigger a crash. For example, if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then a crash may be triggered.\n\nThird party applications compiled with openssl using the function GENERAL_NAME_cmp in a vulnerable way are affected by this flaw.\n\nGENERAL_NAME_cmp was added in 0.9.8k, therefore older versions of openssl are not affected by this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1971"
},
{
"category": "external",
"summary": "RHBZ#1903409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1971",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1971"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971"
},
{
"category": "external",
"summary": "https://www.openssl.org/news/secadv/20201208.txt",
"url": "https://www.openssl.org/news/secadv/20201208.txt"
}
],
"release_date": "2020-12-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-11T13:51:48+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0494"
},
{
"category": "workaround",
"details": "Applications not using the GENERAL_NAME_cmp of openssl are not vulnerable to this flaw. Even when this function is used, if the attacker can control both the arguments of this function, only then the attacker could trigger a crash.",
"product_ids": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openssl: EDIPARTYNAME NULL pointer de-reference"
},
{
"cve": "CVE-2020-13943",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-10-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1887648"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it is possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources. The highest threat from this vulnerability is to data confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat HTTP/2 Request mix-up",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Enterprise Linux 8\u0027s Identity Management is using an affected version of Tomcat bundled within PKI servlet engine, however HTTP/2 protocol is not supported by this component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-13943"
},
{
"category": "external",
"summary": "RHBZ#1887648",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1887648"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-13943",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-13943"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-13943",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13943"
},
{
"category": "external",
"summary": "http://mail-archives.apache.org/mod_mbox/tomcat-announce/202010.mbox/%3C2b767c6e-dcb9-5816-bd69-a3bc0771fef3%40apache.org%3E",
"url": "http://mail-archives.apache.org/mod_mbox/tomcat-announce/202010.mbox/%3C2b767c6e-dcb9-5816-bd69-a3bc0771fef3%40apache.org%3E"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M8",
"url": "http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M8"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.58",
"url": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.58"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.38",
"url": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.38"
}
],
"release_date": "2020-10-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-11T13:51:48+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0494"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Apache Tomcat HTTP/2 Request mix-up"
},
{
"cve": "CVE-2020-17527",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-12-03T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1904221"
}
],
"notes": [
{
"category": "description",
"text": "While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: HTTP/2 request header mix-up",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Enterprise Linux 8\u0027s Identity Management and Certificate System are using a vulnerable version of Tomcat that is bundled into the pki-servlet-engine component. However, HTTP/2 is not enabled in such a configuration, and it is not possible to trigger the flaw in a supported setup. A future update may fix the code.\n\nRed Hat Enterprise Linux 7\u0027s tomcat package, Identity Management, and Certificate System are all not affected by this flaw because HTTP/2 is not supported in the shipped version of tomcat in those packages.\n\ntomcat5 and tomcat6 in Red Hat Enterprise Linux 5 and 6 (respectively) are not affected by this flaw because HTTP/2 is not supported in the shipped versions of those packages.\n\npki-servlet-engine has been obsoleted by Tomcat in Red Hat Enterprise Linux 8.9 and later. Therefore no additional fixes would be made available for the servlet engine.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-17527"
},
{
"category": "external",
"summary": "RHBZ#1904221",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1904221"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-17527",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-17527"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-17527",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-17527"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M10",
"url": "http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M10"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60",
"url": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40",
"url": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40"
}
],
"release_date": "2020-12-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-11T13:51:48+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0494"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: HTTP/2 request header mix-up"
},
{
"cve": "CVE-2021-24122",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2021-01-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1917209"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. When serving resources from a network location using the NTFS file system, it was possible to bypass security constraints and view the source code for JSPs in some configurations. The root cause was the unexpected behavior of the JRE API File.getCanonicalPath(), which was caused by the inconsistent behavior of the Windows API (FindFirstFileW) in some circumstances. The highest threat from this vulnerability is to confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Information disclosure when using NTFS file system",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In Red Hat OpenStack Platform\u0027s OpenDaylight, tomcat is disabled by default. Further, ODL deployments are not supported on untrusted administrator networks; even if tomcat is enabled, if random users can access it, this would be in an unsupported configuration. For this reason, the RHOSP impact has been reduced and no update will be provided at this time for the ODL tomcat package.\n\nThis flaw does not affect tomcat or pki-servlet-engine as shipped with Red Hat Enterprise Linux 6, 7, or 8 because the functionality involving FindFirstFileW() is specific to the Windows native code. Additionally, RHEL is not shipped with NTFS support.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-24122"
},
{
"category": "external",
"summary": "RHBZ#1917209",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1917209"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-24122",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-24122"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-24122",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24122"
},
{
"category": "external",
"summary": "http://mail-archives.apache.org/mod_mbox/tomcat-announce/202101.mbox/%3Cf3765f21-969d-7f21-e34a-efc106175373%40apache.org%3E",
"url": "http://mail-archives.apache.org/mod_mbox/tomcat-announce/202101.mbox/%3Cf3765f21-969d-7f21-e34a-efc106175373%40apache.org%3E"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.107",
"url": "http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.107"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60",
"url": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40",
"url": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40"
}
],
"release_date": "2021-01-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-11T13:51:48+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0494"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Information disclosure when using NTFS file system"
}
]
}
RHSA-2021:0495
Vulnerability from csaf_redhat - Published: 2021-02-11 13:51 - Updated: 2026-05-29 17:09Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 5.4.1 Security Update
Severity
Moderate
Notes
Topic: Red Hat JBoss Web Server 5.4.1 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and Windows.
Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 5.4.1 serves as a replacement for Red Hat JBoss Web Server 5.4.0, and includes bug fixes, enhancements, and component upgrades, which are documented in the Release Notes, linked to in the References.
Security Fix(es):
* tomcat: Apache Tomcat HTTP/2 Request mix-up (CVE-2020-13943)
* tomcat: HTTP/2 request header mix-up (CVE-2020-17527)
* tomcat: Information disclosure when using NTFS file system (CVE-2021-24122)
* openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.
5.9 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 5
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:5.4
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
A flaw was found in Apache Tomcat. If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it is possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources. The highest threat from this vulnerability is to data confidentiality.
5.3 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 5
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:5.4
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 5
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:5.4
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Apache Tomcat. When serving resources from a network location using the NTFS file system, it was possible to bypass security constraints and view the source code for JSPs in some configurations. The root cause was the unexpected behavior of the JRE API File.getCanonicalPath(), which was caused by the inconsistent behavior of the Windows API (FindFirstFileW) in some circumstances. The highest threat from this vulnerability is to confidentiality.
5.9 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 5
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:5.4
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
35 references
Acknowledgments
the OpenSSL project
Google
David Benjamin
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Web Server 5.4.1 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and Windows.\n\nRed Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 5.4.1 serves as a replacement for Red Hat JBoss Web Server 5.4.0, and includes bug fixes, enhancements, and component upgrades, which are documented in the Release Notes, linked to in the References.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat HTTP/2 Request mix-up (CVE-2020-13943)\n* tomcat: HTTP/2 request header mix-up (CVE-2020-17527)\n* tomcat: Information disclosure when using NTFS file system (CVE-2021-24122)\n* openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:0495",
"url": "https://access.redhat.com/errata/RHSA-2021:0495"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver\u0026downloadType=securityPatches\u0026version=5.4",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver\u0026downloadType=securityPatches\u0026version=5.4"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/5.4/",
"url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/5.4/"
},
{
"category": "external",
"summary": "1887648",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1887648"
},
{
"category": "external",
"summary": "1903409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903409"
},
{
"category": "external",
"summary": "1904221",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1904221"
},
{
"category": "external",
"summary": "1917209",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1917209"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0495.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 5.4.1 Security Update",
"tracking": {
"current_release_date": "2026-05-29T17:09:11+00:00",
"generator": {
"date": "2026-05-29T17:09:11+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.1"
}
},
"id": "RHSA-2021:0495",
"initial_release_date": "2021-02-11T13:51:32+00:00",
"revision_history": [
{
"date": "2021-02-11T13:51:32+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-02-11T13:51:32+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-29T17:09:11+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 5",
"product": {
"name": "Red Hat JBoss Web Server 5",
"product_id": "Red Hat JBoss Web Server 5",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.4"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the OpenSSL project"
]
},
{
"names": [
"David Benjamin"
],
"organization": "Google",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-1971",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2020-12-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1903409"
}
],
"notes": [
{
"category": "description",
"text": "A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: EDIPARTYNAME NULL pointer de-reference",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a flaw in the GENERAL_NAME_cmp function of openssl which can be triggered when both its arguments are of the same type i.e. EDIPARTYNAME. \n\n1. Red Hat does not ship any applications compiled with openssl, which used the above function in a vulnerable way.\n\n2. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes, when comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate and when verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token). If an attacker can control both items being compared then that attacker could trigger a crash. For example, if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then a crash may be triggered.\n\nThird party applications compiled with openssl using the function GENERAL_NAME_cmp in a vulnerable way are affected by this flaw.\n\nGENERAL_NAME_cmp was added in 0.9.8k, therefore older versions of openssl are not affected by this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 5"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1971"
},
{
"category": "external",
"summary": "RHBZ#1903409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1971",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1971"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971"
},
{
"category": "external",
"summary": "https://www.openssl.org/news/secadv/20201208.txt",
"url": "https://www.openssl.org/news/secadv/20201208.txt"
}
],
"release_date": "2020-12-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-11T13:51:32+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.",
"product_ids": [
"Red Hat JBoss Web Server 5"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0495"
},
{
"category": "workaround",
"details": "Applications not using the GENERAL_NAME_cmp of openssl are not vulnerable to this flaw. Even when this function is used, if the attacker can control both the arguments of this function, only then the attacker could trigger a crash.",
"product_ids": [
"Red Hat JBoss Web Server 5"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Web Server 5"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openssl: EDIPARTYNAME NULL pointer de-reference"
},
{
"cve": "CVE-2020-13943",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-10-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1887648"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it is possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources. The highest threat from this vulnerability is to data confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat HTTP/2 Request mix-up",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Enterprise Linux 8\u0027s Identity Management is using an affected version of Tomcat bundled within PKI servlet engine, however HTTP/2 protocol is not supported by this component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 5"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-13943"
},
{
"category": "external",
"summary": "RHBZ#1887648",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1887648"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-13943",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-13943"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-13943",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13943"
},
{
"category": "external",
"summary": "http://mail-archives.apache.org/mod_mbox/tomcat-announce/202010.mbox/%3C2b767c6e-dcb9-5816-bd69-a3bc0771fef3%40apache.org%3E",
"url": "http://mail-archives.apache.org/mod_mbox/tomcat-announce/202010.mbox/%3C2b767c6e-dcb9-5816-bd69-a3bc0771fef3%40apache.org%3E"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M8",
"url": "http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M8"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.58",
"url": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.58"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.38",
"url": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.38"
}
],
"release_date": "2020-10-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-11T13:51:32+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.",
"product_ids": [
"Red Hat JBoss Web Server 5"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0495"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Web Server 5"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Apache Tomcat HTTP/2 Request mix-up"
},
{
"cve": "CVE-2020-17527",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-12-03T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1904221"
}
],
"notes": [
{
"category": "description",
"text": "While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: HTTP/2 request header mix-up",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Enterprise Linux 8\u0027s Identity Management and Certificate System are using a vulnerable version of Tomcat that is bundled into the pki-servlet-engine component. However, HTTP/2 is not enabled in such a configuration, and it is not possible to trigger the flaw in a supported setup. A future update may fix the code.\n\nRed Hat Enterprise Linux 7\u0027s tomcat package, Identity Management, and Certificate System are all not affected by this flaw because HTTP/2 is not supported in the shipped version of tomcat in those packages.\n\ntomcat5 and tomcat6 in Red Hat Enterprise Linux 5 and 6 (respectively) are not affected by this flaw because HTTP/2 is not supported in the shipped versions of those packages.\n\npki-servlet-engine has been obsoleted by Tomcat in Red Hat Enterprise Linux 8.9 and later. Therefore no additional fixes would be made available for the servlet engine.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 5"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-17527"
},
{
"category": "external",
"summary": "RHBZ#1904221",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1904221"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-17527",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-17527"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-17527",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-17527"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M10",
"url": "http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M10"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60",
"url": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40",
"url": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40"
}
],
"release_date": "2020-12-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-11T13:51:32+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.",
"product_ids": [
"Red Hat JBoss Web Server 5"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0495"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Web Server 5"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: HTTP/2 request header mix-up"
},
{
"cve": "CVE-2021-24122",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2021-01-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1917209"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. When serving resources from a network location using the NTFS file system, it was possible to bypass security constraints and view the source code for JSPs in some configurations. The root cause was the unexpected behavior of the JRE API File.getCanonicalPath(), which was caused by the inconsistent behavior of the Windows API (FindFirstFileW) in some circumstances. The highest threat from this vulnerability is to confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Information disclosure when using NTFS file system",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In Red Hat OpenStack Platform\u0027s OpenDaylight, tomcat is disabled by default. Further, ODL deployments are not supported on untrusted administrator networks; even if tomcat is enabled, if random users can access it, this would be in an unsupported configuration. For this reason, the RHOSP impact has been reduced and no update will be provided at this time for the ODL tomcat package.\n\nThis flaw does not affect tomcat or pki-servlet-engine as shipped with Red Hat Enterprise Linux 6, 7, or 8 because the functionality involving FindFirstFileW() is specific to the Windows native code. Additionally, RHEL is not shipped with NTFS support.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 5"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-24122"
},
{
"category": "external",
"summary": "RHBZ#1917209",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1917209"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-24122",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-24122"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-24122",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24122"
},
{
"category": "external",
"summary": "http://mail-archives.apache.org/mod_mbox/tomcat-announce/202101.mbox/%3Cf3765f21-969d-7f21-e34a-efc106175373%40apache.org%3E",
"url": "http://mail-archives.apache.org/mod_mbox/tomcat-announce/202101.mbox/%3Cf3765f21-969d-7f21-e34a-efc106175373%40apache.org%3E"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.107",
"url": "http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.107"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60",
"url": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40",
"url": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40"
}
],
"release_date": "2021-01-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-11T13:51:32+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.",
"product_ids": [
"Red Hat JBoss Web Server 5"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0495"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Web Server 5"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Information disclosure when using NTFS file system"
}
]
}
RHSA-2021:0949
Vulnerability from csaf_redhat - Published: 2021-03-22 10:10 - Updated: 2026-05-29 17:09Summary
Red Hat Security Advisory: Red Hat OpenShift Do openshift/odo-init-image 1.1.3 security update
Severity
Low
Notes
Topic: Updated openshift/odo-init-image container image is now available for Red Hat Openshift Do 1.0.
Details: Red Hat OpenShift Do (odo) is a simple CLI tool for developers to create,
build, and deploy applications on OpenShift. The odo tool is completely
client-based and requires no server within the OpenShift cluster for
deployment. It detects changes to local code and deploys it to the cluster
automatically, giving instant feedback to validate changes in real-time. It
supports multiple programming languages and frameworks.
Red Hat OpenShift Do openshift/odo-init-image 1.1.3 is a container image
that is used as part of the InitContainer setup that provisions odo
components.
The advisory addresses the following issues:
* Re-release of odo-init-image 1.1.3 for security updates
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
It was discovered that the "setElementTypePrefix()" function incorrectly extracted XML namespace prefixes. By tricking an application into processing a specially crafted XML file, an attacker could cause unusually high consumption of memory resources and possibly lead to a denial of service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.
6.4 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
6.3 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.
CWE-327 - Use of a Broken or Risky Cryptographic AlgorithmAffected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Low
A use-after-free flaw was found in Mozilla Network Security Services (NSS) related to PK11 session handling. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled with NSS.
7.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.
6.6 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in dbus. The implementation of DBUS_COOKIE_SHA1 is susceptible to a symbolic link attack. A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause the DBusServer to read and write in unintended locations resulting in an authentication bypass. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
7.0 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was discovered in ibus that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is using the graphical interface, change the input method engine, or modify other input related configurations of the victim user.
6.1 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
It was discovered cpio does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.
6.7 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
A reflected cross-site scripting (XSS) vulnerability was found in Python XML-RPC server. The `server_title` field is not sufficiently sanitized allowing malicious JavaScript to be injected. Successful exploitation would allow a remote attacker to execute JavaScript code within the context of the affected user.
6.1 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A vulnerability was discovered in nss where input text length was not checked when using certain cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak. The highest threat is to confidentiality and integrity of data as well as system availability.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A protocol downgrade flaw was found in Network Security Services (NSS). After a HelloRetryRequest has been sent, the client may negotiate a lower protocol than TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored.
5.3 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Low
In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A vulnerability was discovered in glibc where the LD_PREFER_MAP_32BIT_EXEC environment variable is not ignored when running binaries with the setuid flag on x86_64 architectures. This allows an attacker to force system to utilize only half of the memory (making the system think the software is 32-bit only), thus lowering the amount of memory being used with address space layout randomization (ASLR). The highest threat is confidentiality although the complexity of attack is high. The affected application must already have other vulnerabilities for this flaw to be usable.
CWE-20 - Improper Input ValidationAffected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Low
xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A memory leak was discovered in the systemd-login when a power-switch event is received. A physical attacker may trigger one of these events and leak bytes due to a missing free.
CWE-400 - Uncontrolled Resource ConsumptionAffected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Low
A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service. System availability is the highest threat from this vulnerability.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in python. In Lib/tarfile.py an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in glibc. When processing input in the EUC-KR encoding, an invalid input sequence could cause glibc to read beyond the end of a buffer, resulting in a segmentation fault. The highest threat from this vulnerability is to system availability.
4.8 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.
5.9 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality.
4.4 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in curl. Overwriting local files is possible when using a certain combination of command line options. Requesting content from a malicious server could lead to overwriting local files with compromised files leading to unknown effects. The highest threat from this vulnerability is to file integrity.
5.4 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in glibc in versions prior to 2.32. Pseudo-zero values are not validated causing a stack corruption due to a stack-based overflow. The highest threat from this vulnerability is to system availability.
5.7 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A side-channel flaw was found in NSS, in the way P-384 and P-521 curves are used in the generation of EDSA signatures, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality.
4.4 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality.
4.4 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in NSS, where it is vulnerable to RSA key generation cache timing side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. The highest threat to this flaw is to confidentiality.
4.4 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A stack buffer overflow flaw was found in glibc in the way the printf family of functions processed an 80-bit long double with a non-canonical bit pattern. This flaw allows an attacker who can control the arguments of these functions with the non-standard long double pattern to trigger an overflow and cause an application crash. The highest threat from this vulnerability is to system availability.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
152 references
Acknowledgments
the Curl project
Thomas Vegas
the Mozilla project
Henry Corrigan-Gibbs
Hubert Kario
the D-Bus project
Apple Information Security
Joe Vennix
Collabora Ltd.
Simon McVittie
Thomas Habets
the Mozilla Project
the OpenSSL project
Google
David Benjamin
Network and Information Security Group (NISEC
Cesar Pereida
Nicola Tuveri
Yuval Yarom
Billy Bob Brumley
NISEC
Cesar Pereida Garcia and the Network and Information Security Group
Network and Information Security Group (NISEC
Billy Bob Brumley
Cesar Pereida
Nicola Tuveri
Yuval Yarom
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated openshift/odo-init-image container image is now available for Red Hat Openshift Do 1.0.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Do (odo) is a simple CLI tool for developers to create,\nbuild, and deploy applications on OpenShift. The odo tool is completely\nclient-based and requires no server within the OpenShift cluster for\ndeployment. It detects changes to local code and deploys it to the cluster\nautomatically, giving instant feedback to validate changes in real-time. It\nsupports multiple programming languages and frameworks.\n\nRed Hat OpenShift Do openshift/odo-init-image 1.1.3 is a container image\nthat is used as part of the InitContainer setup that provisions odo\ncomponents.\n\nThe advisory addresses the following issues:\n\n* Re-release of odo-init-image 1.1.3 for security updates",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:0949",
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "https://docs.openshift.com/container-platform/4.4/cli_reference/openshift_developer_cli/installing-odo.html",
"url": "https://docs.openshift.com/container-platform/4.4/cli_reference/openshift_developer_cli/installing-odo.html"
},
{
"category": "external",
"summary": "1832983",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1832983"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0949.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenShift Do openshift/odo-init-image 1.1.3 security update",
"tracking": {
"current_release_date": "2026-05-29T17:09:11+00:00",
"generator": {
"date": "2026-05-29T17:09:11+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.1"
}
},
"id": "RHSA-2021:0949",
"initial_release_date": "2021-03-22T10:10:55+00:00",
"revision_history": [
{
"date": "2021-03-22T10:10:55+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-03-22T10:10:55+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-29T17:09:11+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Do 1",
"product": {
"name": "OpenShift Do 1",
"product_id": "7Server-RHODO-1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_do:1.0::el7"
}
}
}
],
"category": "product_family",
"name": "OpenShift Do"
},
{
"branches": [
{
"category": "product_version",
"name": "openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64",
"product": {
"name": "openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64",
"product_id": "openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64",
"product_identification_helper": {
"purl": "pkg:oci/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96?arch=amd64\u0026repository_url=registry.redhat.io/openshiftdo/odo-init-image-rhel7\u0026tag=1.1.3-2"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64 as a component of OpenShift Do 1",
"product_id": "7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
},
"product_reference": "openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64",
"relates_to_product_reference": "7Server-RHODO-1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2018-20843",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2019-06-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1723723"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the \"setElementTypePrefix()\" function incorrectly extracted XML namespace prefixes. By tricking an application into processing a specially crafted XML file, an attacker could cause unusually high consumption of memory resources and possibly lead to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "expat: large number of colons in input makes parser consume high amount of resources, leading to DoS",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "When processing a specially crafted XML file, expat may use more memory than ultimately necessary, which can also lead to increased CPU usage and longer processing times. Depending on available system resources and configuration, this may also lead to the application triggering the Out-Of-Memory-Killer, causing the application to be terminated.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-20843"
},
{
"category": "external",
"summary": "RHBZ#1723723",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1723723"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-20843",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20843"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-20843",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20843"
},
{
"category": "external",
"summary": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931031",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931031"
}
],
"release_date": "2019-06-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "expat: large number of colons in input makes parser consume high amount of resources, leading to DoS"
},
{
"cve": "CVE-2019-5094",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2019-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1768555"
}
],
"notes": [
{
"category": "description",
"text": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "e2fsprogs: Crafted ext4 partition leads to out-of-bounds write",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-5094"
},
{
"category": "external",
"summary": "RHBZ#1768555",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1768555"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-5094",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5094"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5094",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5094"
},
{
"category": "external",
"summary": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887"
}
],
"release_date": "2019-08-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "e2fsprogs: Crafted ext4 partition leads to out-of-bounds write"
},
{
"cve": "CVE-2019-5188",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2020-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1790048"
}
],
"notes": [
{
"category": "description",
"text": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "e2fsprogs: Out-of-bounds write in e2fsck/rehash.c",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-5188"
},
{
"category": "external",
"summary": "RHBZ#1790048",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1790048"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-5188",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5188"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5188",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5188"
}
],
"release_date": "2020-01-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "e2fsprogs: Out-of-bounds write in e2fsck/rehash.c"
},
{
"acknowledgments": [
{
"names": [
"the Curl project"
]
},
{
"names": [
"Thomas Vegas"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2019-5482",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2019-09-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1749652"
}
],
"notes": [
{
"category": "description",
"text": "Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: heap buffer overflow in function tftp_receive_packet()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-5482"
},
{
"category": "external",
"summary": "RHBZ#1749652",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1749652"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-5482",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5482"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5482",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5482"
},
{
"category": "external",
"summary": "https://curl.haxx.se/docs/CVE-2019-5482.html",
"url": "https://curl.haxx.se/docs/CVE-2019-5482.html"
}
],
"release_date": "2019-09-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "workaround",
"details": "Do not use TFTP with curl with smaller than the default BLKSIZE.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: heap buffer overflow in function tftp_receive_packet()"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla project"
]
},
{
"names": [
"Henry Corrigan-Gibbs"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2019-11719",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2019-07-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1728436"
}
],
"notes": [
{
"category": "description",
"text": "When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR \u003c 60.8, Firefox \u003c 68, and Thunderbird \u003c 60.8.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nss: Out-of-bounds read when importing curve25519 private key",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Firefox on Red Hat Enterprise Linux is built against the system nss library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-11719"
},
{
"category": "external",
"summary": "RHBZ#1728436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1728436"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-11719",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11719"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11719",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11719"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11719",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11719"
}
],
"release_date": "2019-07-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nss: Out-of-bounds read when importing curve25519 private key"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla project"
]
},
{
"names": [
"Hubert Kario"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2019-11727",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2019-07-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1730988"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox \u003c 68.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nss: PKCS#1 v1.5 signatures can be used for TLS 1.3",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-11727"
},
{
"category": "external",
"summary": "RHBZ#1730988",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730988"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-11727",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11727"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11727",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11727"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11727",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11727"
}
],
"release_date": "2019-07-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.4,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "nss: PKCS#1 v1.5 signatures can be used for TLS 1.3"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla project"
]
}
],
"cve": "CVE-2019-11756",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2019-11-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1774835"
}
],
"notes": [
{
"category": "description",
"text": "A use-after-free flaw was found in Mozilla Network Security Services (NSS) related to PK11 session handling. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled with NSS.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nss: Use-after-free in sftk_FreeSession due to improper refcounting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw was fixed in upstream nss-3.47. Exploitation of this flaw is difficult and even impossible in most cases.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-11756"
},
{
"category": "external",
"summary": "RHBZ#1774835",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1774835"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-11756",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11756"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11756",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11756"
},
{
"category": "external",
"summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47_release_notes",
"url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47_release_notes"
}
],
"release_date": "2019-12-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nss: Use-after-free in sftk_FreeSession due to improper refcounting"
},
{
"cve": "CVE-2019-12450",
"cwe": {
"id": "CWE-552",
"name": "Files or Directories Accessible to External Parties"
},
"discovery_date": "2019-06-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1719141"
}
],
"notes": [
{
"category": "description",
"text": "file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the versions of glib2 as shipped with Red Hat Enterprise Linux 6, 7 and 8 . Red Hat Product Security has rated this issue as having a security impact of Moderate.\n\nRed Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-12450"
},
{
"category": "external",
"summary": "RHBZ#1719141",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1719141"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-12450",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-12450"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-12450",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12450"
}
],
"release_date": "2019-05-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress"
},
{
"acknowledgments": [
{
"names": [
"the D-Bus project"
]
},
{
"names": [
"Joe Vennix"
],
"organization": "Apple Information Security",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2019-12749",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2019-06-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1719344"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in dbus. The implementation of DBUS_COOKIE_SHA1 is susceptible to a symbolic link attack. A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause the DBusServer to read and write in unintended locations resulting in an authentication bypass. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dbus: DBusServer DBUS_COOKIE_SHA1 authentication bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is mitigated by the fact that by default, the well-known system dbus-daemon (since 2003) and the well-known session dbus-daemon (in stable releases since dbus 1.10.0 in 2015) only accept the EXTERNAL authentication mechanism, and as a result will reject DBUS_COOKIE_SHA1 at an early stage, before manipulating cookies. \n\nRed Hat Enterprise Linux 6 is affected by this flaw, which can be leveraged to achieve privilege escalation via upstart. This issue has been rated as having important impact for Red Hat Enterprise Linux 6.\n\nRed Hat Enterprise Linux 7 and 8, both ship dbus \u003e= 1.10 and therefore are affected by this flaw only when system or session dbus-daemons are used under non-standard configurations or by third party users of DBusServer. Red Hat Enterprise Linux 7 and 8 does not ship any affected DBusServer cosumer. However third party applications may be affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-12749"
},
{
"category": "external",
"summary": "RHBZ#1719344",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1719344"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-12749",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-12749"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-12749",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12749"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2019/06/11/2",
"url": "https://www.openwall.com/lists/oss-security/2019/06/11/2"
}
],
"release_date": "2019-06-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dbus: DBusServer DBUS_COOKIE_SHA1 authentication bypass"
},
{
"acknowledgments": [
{
"names": [
"Simon McVittie"
],
"organization": "Collabora Ltd."
}
],
"cve": "CVE-2019-14822",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2019-06-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1717958"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was discovered in ibus that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is using the graphical interface, change the input method engine, or modify other input related configurations of the victim user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ibus: missing authorization allows local attacker to access the input bus of another user",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Gnome uses the ibus input framework only when the user explicitly configures it or when some input method sources are in use, like Korean from the ibus-hangul package or Chinese input methods from the ibus-libpinyin. Input methods like en-US are not handled by ibus, thus if the victim user just use them the attacker will not be able to intercept the key strokes of that user.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-14822"
},
{
"category": "external",
"summary": "RHBZ#1717958",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1717958"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-14822",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14822"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-14822",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14822"
}
],
"release_date": "2019-09-13T07:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ibus: missing authorization allows local attacker to access the input bus of another user"
},
{
"acknowledgments": [
{
"names": [
"Thomas Habets"
]
}
],
"cve": "CVE-2019-14866",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2019-10-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1765511"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered cpio does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cpio: improper input validation when writing tar header fields leads to unexpected tar generation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-14866"
},
{
"category": "external",
"summary": "RHBZ#1765511",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1765511"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-14866",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14866"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-14866",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14866"
}
],
"release_date": "2019-08-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "workaround",
"details": "TAR archives should be inspected before being extracted and the extraction should be performed with the `tar` command or `--no-absolute-filenames` option if done with `cpio`. Moreover, it should be performed by a low-privilege user whenever possible, to prevent extraction of files that could compromise the system.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cpio: improper input validation when writing tar header fields leads to unexpected tar generation"
},
{
"cve": "CVE-2019-15903",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2019-09-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1752592"
}
],
"notes": [
{
"category": "description",
"text": "In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "expat: heap-based buffer over-read via crafted XML input",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-15903"
},
{
"category": "external",
"summary": "RHBZ#1752592",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752592"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-15903",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-15903"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-15903",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15903"
}
],
"release_date": "2019-09-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "expat: heap-based buffer over-read via crafted XML input"
},
{
"cve": "CVE-2019-16935",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2019-09-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1763229"
}
],
"notes": [
{
"category": "description",
"text": "A reflected cross-site scripting (XSS) vulnerability was found in Python XML-RPC server. The `server_title` field is not sufficiently sanitized allowing malicious JavaScript to be injected. Successful exploitation would allow a remote attacker to execute JavaScript code within the context of the affected user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: XSS vulnerability in the documentation XML-RPC server in server_title field",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw does not affect the versions of python27-python as shipped with Red Hat Software Collections 3 as they already include the fix.\nThis flaw does not affect the versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 as they are \"symlinks\" to the main python3 component, which provides the actual interpreter of the Python programming language.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-16935"
},
{
"category": "external",
"summary": "RHBZ#1763229",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1763229"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-16935",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16935"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-16935",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16935"
}
],
"release_date": "2019-09-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python: XSS vulnerability in the documentation XML-RPC server in server_title field"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla Project"
]
}
],
"cve": "CVE-2019-17006",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2019-11-23T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1775916"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was discovered in nss where input text length was not checked when using certain cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak. The highest threat is to confidentiality and integrity of data as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nss: Check length of inputs for cryptographic primitives",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-17006"
},
{
"category": "external",
"summary": "RHBZ#1775916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1775916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-17006",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17006"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-17006",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17006"
},
{
"category": "external",
"summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes",
"url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes"
}
],
"release_date": "2019-12-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nss: Check length of inputs for cryptographic primitives"
},
{
"cve": "CVE-2019-17023",
"discovery_date": "2020-01-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1791225"
}
],
"notes": [
{
"category": "description",
"text": "A protocol downgrade flaw was found in Network Security Services (NSS). After a HelloRetryRequest has been sent, the client may negotiate a lower protocol than TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw causes the client to hang when there is a downgrade attempt. Therefore no actual protocol downgrade occurs.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-17023"
},
{
"category": "external",
"summary": "RHBZ#1791225",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1791225"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-17023",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17023"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-17023",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17023"
},
{
"category": "external",
"summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.49_release_notes",
"url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.49_release_notes"
}
],
"release_date": "2020-01-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state"
},
{
"cve": "CVE-2019-17498",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2019-10-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1766898"
}
],
"notes": [
{
"category": "description",
"text": "In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libssh2: integer overflow in SSH_MSG_DISCONNECT logic in packet.c",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw needs a malicious MITM SSH server. When an application compiled with libssh2 connects to such a MITM SSH server, the server can trigger an integer overflow leading to an OOB read in the SSH_MSG_DISCONNECT logic. This can cause the application compiled with libssh2 to crash. This is strictly a client side crash and the SSH server may not be affected.\n\nAlso note that when a user connects to a malicious MITM server there is already a risk of disclosing password/keys irrespective of the flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-17498"
},
{
"category": "external",
"summary": "RHBZ#1766898",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1766898"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-17498",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17498"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-17498",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17498"
},
{
"category": "external",
"summary": "https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/",
"url": "https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/"
}
],
"release_date": "2019-10-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libssh2: integer overflow in SSH_MSG_DISCONNECT logic in packet.c"
},
{
"cve": "CVE-2019-19126",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2019-11-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1774681"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was discovered in glibc where the LD_PREFER_MAP_32BIT_EXEC environment variable is not ignored when running binaries with the setuid flag on x86_64 architectures. This allows an attacker to force system to utilize only half of the memory (making the system think the software is 32-bit only), thus lowering the amount of memory being used with address space layout randomization (ASLR). The highest threat is confidentiality although the complexity of attack is high. The affected application must already have other vulnerabilities for this flaw to be usable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-19126"
},
{
"category": "external",
"summary": "RHBZ#1774681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1774681"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-19126",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19126"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-19126",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19126"
}
],
"release_date": "2019-11-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.9,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries"
},
{
"cve": "CVE-2019-19956",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2020-01-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1788856"
}
],
"notes": [
{
"category": "description",
"text": "xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc-\u003eoldNs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-19956"
},
{
"category": "external",
"summary": "RHBZ#1788856",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1788856"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-19956",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19956"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-19956",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19956"
}
],
"release_date": "2020-01-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c"
},
{
"cve": "CVE-2019-20386",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2020-01-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1793979"
}
],
"notes": [
{
"category": "description",
"text": "A memory leak was discovered in the systemd-login when a power-switch event is received. A physical attacker may trigger one of these events and leak bytes due to a missing free.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "systemd: memory leak in button_open() in login/logind-button.c when udev events are received",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The version of systemd delivered in OpenShift Container Platform 4.1 and included in CoreOS images has been superseded by the version delivered in Red Hat Enterprise Linux 8. CoreOS updates for systemd in will be consumed from Red Hat Enterprise Linux 8 channels.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-20386"
},
{
"category": "external",
"summary": "RHBZ#1793979",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1793979"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-20386",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20386"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-20386",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20386"
}
],
"release_date": "2020-01-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "LOW",
"baseScore": 2.4,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "systemd: memory leak in button_open() in login/logind-button.c when udev events are received"
},
{
"cve": "CVE-2019-20388",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"discovery_date": "2020-02-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1799734"
}
],
"notes": [
{
"category": "description",
"text": "A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service. System availability is the highest threat from this vulnerability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-20388"
},
{
"category": "external",
"summary": "RHBZ#1799734",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1799734"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-20388",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20388"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-20388",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20388"
}
],
"release_date": "2020-01-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c"
},
{
"cve": "CVE-2019-20907",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2020-07-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1856481"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python. In Lib/tarfile.py an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: infinite loop in the tarfile module via crafted TAR archive",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A service is vulnerable if it uses python\u0027s tarfile module to open untrusted tar files. If an attacker is able to submit a crafted tar file to a service which uses the tarfile module to open it, an infinite loop will be executed, potentially causing a denial of service. The tarfile module is included with python.\n\nVersions of `python36:3.6/python36` as shipped with Red Hat Enterprise Linux 8 are marked as \u0027Not affected\u0027 as they just provide \"symlinks\" to the main `python3` component, which provides the actual interpreter of the Python programming language.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-20907"
},
{
"category": "external",
"summary": "RHBZ#1856481",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856481"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-20907",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20907"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-20907",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20907"
}
],
"release_date": "2019-12-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "workaround",
"details": "This flaw can be mitigated by not opening untrusted files with tarfile.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python: infinite loop in the tarfile module via crafted TAR archive"
},
{
"cve": "CVE-2019-25013",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2021-01-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1912960"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in glibc. When processing input in the EUC-KR encoding, an invalid input sequence could cause glibc to read beyond the end of a buffer, resulting in a segmentation fault. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glibc: buffer over-read in iconv when processing invalid multi-byte input sequences in the EUC-KR encoding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has been rated as having moderate impact for glibc packages shipped with Red Hat Enterprise Linux because, the maximum impact of this vulnerability is a crash, and it relies on processing untrusted input in an uncommon encoding (EUC-KR). When this encoding is not used, the vulnerability can not be triggered.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-25013"
},
{
"category": "external",
"summary": "RHBZ#1912960",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912960"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-25013",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-25013"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-25013",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25013"
}
],
"release_date": "2019-09-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glibc: buffer over-read in iconv when processing invalid multi-byte input sequences in the EUC-KR encoding"
},
{
"acknowledgments": [
{
"names": [
"the OpenSSL project"
]
},
{
"names": [
"David Benjamin"
],
"organization": "Google",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-1971",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2020-12-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1903409"
}
],
"notes": [
{
"category": "description",
"text": "A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: EDIPARTYNAME NULL pointer de-reference",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a flaw in the GENERAL_NAME_cmp function of openssl which can be triggered when both its arguments are of the same type i.e. EDIPARTYNAME. \n\n1. Red Hat does not ship any applications compiled with openssl, which used the above function in a vulnerable way.\n\n2. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes, when comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate and when verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token). If an attacker can control both items being compared then that attacker could trigger a crash. For example, if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then a crash may be triggered.\n\nThird party applications compiled with openssl using the function GENERAL_NAME_cmp in a vulnerable way are affected by this flaw.\n\nGENERAL_NAME_cmp was added in 0.9.8k, therefore older versions of openssl are not affected by this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1971"
},
{
"category": "external",
"summary": "RHBZ#1903409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1971",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1971"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971"
},
{
"category": "external",
"summary": "https://www.openssl.org/news/secadv/20201208.txt",
"url": "https://www.openssl.org/news/secadv/20201208.txt"
}
],
"release_date": "2020-12-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "workaround",
"details": "Applications not using the GENERAL_NAME_cmp of openssl are not vulnerable to this flaw. Even when this function is used, if the attacker can control both the arguments of this function, only then the attacker could trigger a crash.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "openssl: EDIPARTYNAME NULL pointer de-reference"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla Project"
]
},
{
"names": [
"Cesar Pereida",
"Nicola Tuveri",
"Yuval Yarom",
"Billy Bob Brumley"
],
"organization": "Network and Information Security Group (NISEC",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-6829",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2020-04-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1826187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nss: Side channel attack on ECDSA signature generation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a side channel attack which can used to exact pirate keys when ECDSA signatures are being generated. This attack is only feasible when the attacker is local to the machine or in certain cross-VM scenarios where the signature is being generated. Attacks over the network or via the internet are not feasible.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-6829"
},
{
"category": "external",
"summary": "RHBZ#1826187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1826187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-6829",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-6829"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-6829",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6829"
},
{
"category": "external",
"summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
"url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes"
}
],
"release_date": "2020-06-02T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nss: Side channel attack on ECDSA signature generation"
},
{
"cve": "CVE-2020-7595",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2020-02-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1799786"
}
],
"notes": [
{
"category": "description",
"text": "xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-7595"
},
{
"category": "external",
"summary": "RHBZ#1799786",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1799786"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-7595",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-7595"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7595",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7595"
}
],
"release_date": "2020-01-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations"
},
{
"cve": "CVE-2020-8177",
"discovery_date": "2020-06-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1847915"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. Overwriting local files is possible when using a certain combination of command line options. Requesting content from a malicious server could lead to overwriting local files with compromised files leading to unknown effects. The highest threat from this vulnerability is to file integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: Incorrect argument check can allow remote servers to overwrite local files",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue only affects the \u0027curl\u0027 command line utility. Additionally, this is only an issue when using the \u0027-J\u0027 (with the \u0027-O\u0027 option) and \u0027-i\u0027 command line options combined.\n\nIn most cases, there is nothing to gain for a local attacker here: the curl command line utility is likely running with the same privileges as the user, and thus the user can already overwrite all the files curl could overwrite. However, a local user will have to call curl with the \u0027-J\u0027 and \u0027-i\u0027 command line options while requesting content from a malicious server, which then opens up an opportunity for the malicious server to overwrite local files.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-8177"
},
{
"category": "external",
"summary": "RHBZ#1847915",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847915"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-8177",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8177"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8177",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8177"
},
{
"category": "external",
"summary": "https://curl.haxx.se/docs/CVE-2020-8177.html",
"url": "https://curl.haxx.se/docs/CVE-2020-8177.html"
}
],
"release_date": "2020-06-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "workaround",
"details": "The vulnerability is only possible when using the \u0027-J\u0027 and \u0027-i\u0027 switches in conjunction with the curl command. Executing curl without these switches mitigates the flaw.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: Incorrect argument check can allow remote servers to overwrite local files"
},
{
"cve": "CVE-2020-10029",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2020-03-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1810670"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in glibc in versions prior to 2.32. Pseudo-zero values are not validated causing a stack corruption due to a stack-based overflow. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The glibc version shipped with Red Hat Enterprise Linux 8 is compiled using gcc\u0027s stack-protector option which mitigates the possibility of code execution led by the stack corruption.\n\nThe glibc version shipped with Red Hat Enterprise Linux 7 is more difficult to exploit using this flaw, specifically for remote code execution. Because exploitation of the flaw depends on the usage of pseudo-zero values, an attacker can only overwrite the stack with 0s. Due to this, a valid address value for code execution is difficult to get and is likely to only result in a crash.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-10029"
},
{
"category": "external",
"summary": "RHBZ#1810670",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1810670"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-10029",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10029"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10029",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10029"
}
],
"release_date": "2020-02-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions"
},
{
"cve": "CVE-2020-12243",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2020-04-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1833535"
}
],
"notes": [
{
"category": "description",
"text": "In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openldap: denial of service via nested boolean expressions in LDAP search filters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does not affect Red Hat Enterprise Linux 8 because we don\u0027t ship openldap-servers subpackage with the Red Hat Enterprise Linux 8 (it is only present in the buildroot).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-12243"
},
{
"category": "external",
"summary": "RHBZ#1833535",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1833535"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-12243",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12243"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-12243",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12243"
}
],
"release_date": "2020-04-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openldap: denial of service via nested boolean expressions in LDAP search filters"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla Project"
]
},
{
"names": [
"Cesar Pereida Garcia and the Network and Information Security Group"
],
"organization": "NISEC",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-12400",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2020-07-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1853983"
}
],
"notes": [
{
"category": "description",
"text": "A side-channel flaw was found in NSS, in the way P-384 and P-521 curves are used in the generation of EDSA signatures, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nss: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a side-channel attack that can be used to exact pirate keys when ECDSA signatures are being generated. This attack is only feasible when the attacker is local to the machine or in certain cross-VM scenarios where the signature is being generated. Attacks over the network or via the internet are not feasible.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-12400"
},
{
"category": "external",
"summary": "RHBZ#1853983",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1853983"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-12400",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12400"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-12400",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12400"
},
{
"category": "external",
"summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
"url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes"
}
],
"release_date": "2020-07-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nss: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla Project"
]
},
{
"names": [
"Cesar Pereida Garcia and the Network and Information Security Group"
],
"organization": "NISEC",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-12401",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2020-06-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1851294"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nss: ECDSA timing attack mitigation bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a side channel attack which can used to exact pirate keys when ECDSA signatures are being generated. This attack is only feasible when the attacker is local to the machine or in certain cross-VM scenarios where the signature is being generated. Attacks over the network or via the internet are not feasible.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-12401"
},
{
"category": "external",
"summary": "RHBZ#1851294",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1851294"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-12401",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12401"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-12401",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12401"
},
{
"category": "external",
"summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
"url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes"
}
],
"release_date": "2020-06-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "workaround",
"details": "This is a side channel attack which can used to exact pirate keys when ECDSA signatures are being generated. This attack is only feasible when the attacker is local to the machine or in certain cross-VM scenarios where the signature is being generated. Attacks over the network or via the internet are not feasible.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nss: ECDSA timing attack mitigation bypass"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla Project"
]
},
{
"names": [
"Billy Bob Brumley",
"Cesar Pereida",
"Nicola Tuveri",
"Yuval Yarom"
],
"organization": "Network and Information Security Group (NISEC",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-12402",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2020-04-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1826231"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NSS, where it is vulnerable to RSA key generation cache timing side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. The highest threat to this flaw is to confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nss: Side channel vulnerabilities during RSA key generation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A timing attack was found in the way NSS generated RSA keys. A man-in-the-middle attacker could use this attack during RSA key generation to recover the private key. This attack is only feasible when the attacker is local to the machine or in certain cross-VM scenarios where the signature is being generated. Attacks over the network or via the internet are not feasible.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-12402"
},
{
"category": "external",
"summary": "RHBZ#1826231",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1826231"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-12402",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12402"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-12402",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12402"
},
{
"category": "external",
"summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53.1_release_notes",
"url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53.1_release_notes"
}
],
"release_date": "2020-06-02T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nss: Side channel vulnerabilities during RSA key generation"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla Project"
]
}
],
"cve": "CVE-2020-12403",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2020-08-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1868931"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-12403"
},
{
"category": "external",
"summary": "RHBZ#1868931",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868931"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-12403",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12403"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-12403",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12403"
},
{
"category": "external",
"summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
"url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes"
}
],
"release_date": "2020-07-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read"
},
{
"cve": "CVE-2020-29573",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2020-12-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1905213"
}
],
"notes": [
{
"category": "description",
"text": "A stack buffer overflow flaw was found in glibc in the way the printf family of functions processed an 80-bit long double with a non-canonical bit pattern. This flaw allows an attacker who can control the arguments of these functions with the non-standard long double pattern to trigger an overflow and cause an application crash. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glibc: stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is essentially a crash which can only be triggered by a non-standard argument passed as a long double input to a member of printf family of functions. The application has to be written in this way to allow this issue to be triggered. The maximum impact is an application crash.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-29573"
},
{
"category": "external",
"summary": "RHBZ#1905213",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1905213"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-29573",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-29573"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-29573",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29573"
},
{
"category": "external",
"summary": "https://sourceware.org/pipermail/libc-alpha/2020-September/117779.html",
"url": "https://sourceware.org/pipermail/libc-alpha/2020-September/117779.html"
}
],
"release_date": "2020-09-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-03-22T10:10:55+00:00",
"details": "Download and install a new CLI binary by following the instructions linked from the References section.",
"product_ids": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0949"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-RHODO-1:openshiftdo/odo-init-image-rhel7@sha256:83eea230500106cf84b287fb7249be475171c8ff9ced7025cbf628a213cb9d96_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glibc: stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern"
}
]
}
RHSA-2021_0056
Vulnerability from csaf_redhat - Published: 2021-01-11 10:34 - Updated: 2024-11-22 15:55Summary
Red Hat Security Advisory: openssl security update
Severity
Important
Notes
Topic: An update for openssl is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.
Security Fix(es):
* openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.
5.9 (Medium)
Affected products
Fixed
38 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-ELS:openssl-0:1.0.1e-59.el6_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-ELS:openssl-0:1.0.1e-59.el6_10.s390 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-ELS:openssl-0:1.0.1e-59.el6_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-ELS:openssl-0:1.0.1e-59.el6_10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-ELS:openssl-0:1.0.1e-59.el6_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-ELS:openssl-perl-0:1.0.1e-59.el6_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-ELS:openssl-perl-0:1.0.1e-59.el6_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-ELS:openssl-perl-0:1.0.1e-59.el6_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-ELS:openssl-static-0:1.0.1e-59.el6_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-ELS:openssl-static-0:1.0.1e-59.el6_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-ELS:openssl-static-0:1.0.1e-59.el6_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.s390 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-optional-ELS:openssl-perl-0:1.0.1e-59.el6_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-optional-ELS:openssl-perl-0:1.0.1e-59.el6_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-optional-ELS:openssl-perl-0:1.0.1e-59.el6_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-optional-ELS:openssl-static-0:1.0.1e-59.el6_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-optional-ELS:openssl-static-0:1.0.1e-59.el6_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 6Server-optional-ELS:openssl-static-0:1.0.1e-59.el6_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
9 references
Acknowledgments
the OpenSSL project
Google
David Benjamin
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for openssl is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:0056",
"url": "https://access.redhat.com/errata/RHSA-2021:0056"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1903409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903409"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0056.json"
}
],
"title": "Red Hat Security Advisory: openssl security update",
"tracking": {
"current_release_date": "2024-11-22T15:55:58+00:00",
"generator": {
"date": "2024-11-22T15:55:58+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2021:0056",
"initial_release_date": "2021-01-11T10:34:05+00:00",
"revision_history": [
{
"date": "2021-01-11T10:34:05+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-01-11T10:34:05+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T15:55:58+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 6 ELS)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 6 ELS)",
"product_id": "6Server-ELS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_els:6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
"product": {
"name": "Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
"product_id": "6Server-optional-ELS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_els:6"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "openssl-0:1.0.1e-59.el6_10.src",
"product": {
"name": "openssl-0:1.0.1e-59.el6_10.src",
"product_id": "openssl-0:1.0.1e-59.el6_10.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openssl@1.0.1e-59.el6_10?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "openssl-0:1.0.1e-59.el6_10.s390",
"product": {
"name": "openssl-0:1.0.1e-59.el6_10.s390",
"product_id": "openssl-0:1.0.1e-59.el6_10.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openssl@1.0.1e-59.el6_10?arch=s390"
}
}
},
{
"category": "product_version",
"name": "openssl-devel-0:1.0.1e-59.el6_10.s390",
"product": {
"name": "openssl-devel-0:1.0.1e-59.el6_10.s390",
"product_id": "openssl-devel-0:1.0.1e-59.el6_10.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openssl-devel@1.0.1e-59.el6_10?arch=s390"
}
}
},
{
"category": "product_version",
"name": "openssl-debuginfo-0:1.0.1e-59.el6_10.s390",
"product": {
"name": "openssl-debuginfo-0:1.0.1e-59.el6_10.s390",
"product_id": "openssl-debuginfo-0:1.0.1e-59.el6_10.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.1e-59.el6_10?arch=s390"
}
}
}
],
"category": "architecture",
"name": "s390"
},
{
"branches": [
{
"category": "product_version",
"name": "openssl-0:1.0.1e-59.el6_10.s390x",
"product": {
"name": "openssl-0:1.0.1e-59.el6_10.s390x",
"product_id": "openssl-0:1.0.1e-59.el6_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openssl@1.0.1e-59.el6_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "openssl-devel-0:1.0.1e-59.el6_10.s390x",
"product": {
"name": "openssl-devel-0:1.0.1e-59.el6_10.s390x",
"product_id": "openssl-devel-0:1.0.1e-59.el6_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openssl-devel@1.0.1e-59.el6_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "openssl-debuginfo-0:1.0.1e-59.el6_10.s390x",
"product": {
"name": "openssl-debuginfo-0:1.0.1e-59.el6_10.s390x",
"product_id": "openssl-debuginfo-0:1.0.1e-59.el6_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.1e-59.el6_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "openssl-perl-0:1.0.1e-59.el6_10.s390x",
"product": {
"name": "openssl-perl-0:1.0.1e-59.el6_10.s390x",
"product_id": "openssl-perl-0:1.0.1e-59.el6_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openssl-perl@1.0.1e-59.el6_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "openssl-static-0:1.0.1e-59.el6_10.s390x",
"product": {
"name": "openssl-static-0:1.0.1e-59.el6_10.s390x",
"product_id": "openssl-static-0:1.0.1e-59.el6_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openssl-static@1.0.1e-59.el6_10?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "openssl-0:1.0.1e-59.el6_10.x86_64",
"product": {
"name": "openssl-0:1.0.1e-59.el6_10.x86_64",
"product_id": "openssl-0:1.0.1e-59.el6_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openssl@1.0.1e-59.el6_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "openssl-devel-0:1.0.1e-59.el6_10.x86_64",
"product": {
"name": "openssl-devel-0:1.0.1e-59.el6_10.x86_64",
"product_id": "openssl-devel-0:1.0.1e-59.el6_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openssl-devel@1.0.1e-59.el6_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "openssl-debuginfo-0:1.0.1e-59.el6_10.x86_64",
"product": {
"name": "openssl-debuginfo-0:1.0.1e-59.el6_10.x86_64",
"product_id": "openssl-debuginfo-0:1.0.1e-59.el6_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.1e-59.el6_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "openssl-perl-0:1.0.1e-59.el6_10.x86_64",
"product": {
"name": "openssl-perl-0:1.0.1e-59.el6_10.x86_64",
"product_id": "openssl-perl-0:1.0.1e-59.el6_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openssl-perl@1.0.1e-59.el6_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "openssl-static-0:1.0.1e-59.el6_10.x86_64",
"product": {
"name": "openssl-static-0:1.0.1e-59.el6_10.x86_64",
"product_id": "openssl-static-0:1.0.1e-59.el6_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openssl-static@1.0.1e-59.el6_10?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "openssl-0:1.0.1e-59.el6_10.i686",
"product": {
"name": "openssl-0:1.0.1e-59.el6_10.i686",
"product_id": "openssl-0:1.0.1e-59.el6_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openssl@1.0.1e-59.el6_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "openssl-devel-0:1.0.1e-59.el6_10.i686",
"product": {
"name": "openssl-devel-0:1.0.1e-59.el6_10.i686",
"product_id": "openssl-devel-0:1.0.1e-59.el6_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openssl-devel@1.0.1e-59.el6_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "openssl-debuginfo-0:1.0.1e-59.el6_10.i686",
"product": {
"name": "openssl-debuginfo-0:1.0.1e-59.el6_10.i686",
"product_id": "openssl-debuginfo-0:1.0.1e-59.el6_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.1e-59.el6_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "openssl-perl-0:1.0.1e-59.el6_10.i686",
"product": {
"name": "openssl-perl-0:1.0.1e-59.el6_10.i686",
"product_id": "openssl-perl-0:1.0.1e-59.el6_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openssl-perl@1.0.1e-59.el6_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "openssl-static-0:1.0.1e-59.el6_10.i686",
"product": {
"name": "openssl-static-0:1.0.1e-59.el6_10.i686",
"product_id": "openssl-static-0:1.0.1e-59.el6_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openssl-static@1.0.1e-59.el6_10?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-0:1.0.1e-59.el6_10.i686 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
"product_id": "6Server-ELS:openssl-0:1.0.1e-59.el6_10.i686"
},
"product_reference": "openssl-0:1.0.1e-59.el6_10.i686",
"relates_to_product_reference": "6Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-0:1.0.1e-59.el6_10.s390 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
"product_id": "6Server-ELS:openssl-0:1.0.1e-59.el6_10.s390"
},
"product_reference": "openssl-0:1.0.1e-59.el6_10.s390",
"relates_to_product_reference": "6Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-0:1.0.1e-59.el6_10.s390x as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
"product_id": "6Server-ELS:openssl-0:1.0.1e-59.el6_10.s390x"
},
"product_reference": "openssl-0:1.0.1e-59.el6_10.s390x",
"relates_to_product_reference": "6Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-0:1.0.1e-59.el6_10.src as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
"product_id": "6Server-ELS:openssl-0:1.0.1e-59.el6_10.src"
},
"product_reference": "openssl-0:1.0.1e-59.el6_10.src",
"relates_to_product_reference": "6Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-0:1.0.1e-59.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
"product_id": "6Server-ELS:openssl-0:1.0.1e-59.el6_10.x86_64"
},
"product_reference": "openssl-0:1.0.1e-59.el6_10.x86_64",
"relates_to_product_reference": "6Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-debuginfo-0:1.0.1e-59.el6_10.i686 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
"product_id": "6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.i686"
},
"product_reference": "openssl-debuginfo-0:1.0.1e-59.el6_10.i686",
"relates_to_product_reference": "6Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-debuginfo-0:1.0.1e-59.el6_10.s390 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
"product_id": "6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390"
},
"product_reference": "openssl-debuginfo-0:1.0.1e-59.el6_10.s390",
"relates_to_product_reference": "6Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-debuginfo-0:1.0.1e-59.el6_10.s390x as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
"product_id": "6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390x"
},
"product_reference": "openssl-debuginfo-0:1.0.1e-59.el6_10.s390x",
"relates_to_product_reference": "6Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-debuginfo-0:1.0.1e-59.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
"product_id": "6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.x86_64"
},
"product_reference": "openssl-debuginfo-0:1.0.1e-59.el6_10.x86_64",
"relates_to_product_reference": "6Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-devel-0:1.0.1e-59.el6_10.i686 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
"product_id": "6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.i686"
},
"product_reference": "openssl-devel-0:1.0.1e-59.el6_10.i686",
"relates_to_product_reference": "6Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-devel-0:1.0.1e-59.el6_10.s390 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
"product_id": "6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390"
},
"product_reference": "openssl-devel-0:1.0.1e-59.el6_10.s390",
"relates_to_product_reference": "6Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-devel-0:1.0.1e-59.el6_10.s390x as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
"product_id": "6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390x"
},
"product_reference": "openssl-devel-0:1.0.1e-59.el6_10.s390x",
"relates_to_product_reference": "6Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-devel-0:1.0.1e-59.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
"product_id": "6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.x86_64"
},
"product_reference": "openssl-devel-0:1.0.1e-59.el6_10.x86_64",
"relates_to_product_reference": "6Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-perl-0:1.0.1e-59.el6_10.i686 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
"product_id": "6Server-ELS:openssl-perl-0:1.0.1e-59.el6_10.i686"
},
"product_reference": "openssl-perl-0:1.0.1e-59.el6_10.i686",
"relates_to_product_reference": "6Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-perl-0:1.0.1e-59.el6_10.s390x as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
"product_id": "6Server-ELS:openssl-perl-0:1.0.1e-59.el6_10.s390x"
},
"product_reference": "openssl-perl-0:1.0.1e-59.el6_10.s390x",
"relates_to_product_reference": "6Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-perl-0:1.0.1e-59.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
"product_id": "6Server-ELS:openssl-perl-0:1.0.1e-59.el6_10.x86_64"
},
"product_reference": "openssl-perl-0:1.0.1e-59.el6_10.x86_64",
"relates_to_product_reference": "6Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-static-0:1.0.1e-59.el6_10.i686 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
"product_id": "6Server-ELS:openssl-static-0:1.0.1e-59.el6_10.i686"
},
"product_reference": "openssl-static-0:1.0.1e-59.el6_10.i686",
"relates_to_product_reference": "6Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-static-0:1.0.1e-59.el6_10.s390x as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
"product_id": "6Server-ELS:openssl-static-0:1.0.1e-59.el6_10.s390x"
},
"product_reference": "openssl-static-0:1.0.1e-59.el6_10.s390x",
"relates_to_product_reference": "6Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-static-0:1.0.1e-59.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6 ELS)",
"product_id": "6Server-ELS:openssl-static-0:1.0.1e-59.el6_10.x86_64"
},
"product_reference": "openssl-static-0:1.0.1e-59.el6_10.x86_64",
"relates_to_product_reference": "6Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-0:1.0.1e-59.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
"product_id": "6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.i686"
},
"product_reference": "openssl-0:1.0.1e-59.el6_10.i686",
"relates_to_product_reference": "6Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-0:1.0.1e-59.el6_10.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
"product_id": "6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.s390"
},
"product_reference": "openssl-0:1.0.1e-59.el6_10.s390",
"relates_to_product_reference": "6Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-0:1.0.1e-59.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
"product_id": "6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.s390x"
},
"product_reference": "openssl-0:1.0.1e-59.el6_10.s390x",
"relates_to_product_reference": "6Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-0:1.0.1e-59.el6_10.src as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
"product_id": "6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.src"
},
"product_reference": "openssl-0:1.0.1e-59.el6_10.src",
"relates_to_product_reference": "6Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-0:1.0.1e-59.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
"product_id": "6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.x86_64"
},
"product_reference": "openssl-0:1.0.1e-59.el6_10.x86_64",
"relates_to_product_reference": "6Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-debuginfo-0:1.0.1e-59.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
"product_id": "6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.i686"
},
"product_reference": "openssl-debuginfo-0:1.0.1e-59.el6_10.i686",
"relates_to_product_reference": "6Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-debuginfo-0:1.0.1e-59.el6_10.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
"product_id": "6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390"
},
"product_reference": "openssl-debuginfo-0:1.0.1e-59.el6_10.s390",
"relates_to_product_reference": "6Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-debuginfo-0:1.0.1e-59.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
"product_id": "6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390x"
},
"product_reference": "openssl-debuginfo-0:1.0.1e-59.el6_10.s390x",
"relates_to_product_reference": "6Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-debuginfo-0:1.0.1e-59.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
"product_id": "6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.x86_64"
},
"product_reference": "openssl-debuginfo-0:1.0.1e-59.el6_10.x86_64",
"relates_to_product_reference": "6Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-devel-0:1.0.1e-59.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
"product_id": "6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.i686"
},
"product_reference": "openssl-devel-0:1.0.1e-59.el6_10.i686",
"relates_to_product_reference": "6Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-devel-0:1.0.1e-59.el6_10.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
"product_id": "6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390"
},
"product_reference": "openssl-devel-0:1.0.1e-59.el6_10.s390",
"relates_to_product_reference": "6Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-devel-0:1.0.1e-59.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
"product_id": "6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390x"
},
"product_reference": "openssl-devel-0:1.0.1e-59.el6_10.s390x",
"relates_to_product_reference": "6Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-devel-0:1.0.1e-59.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
"product_id": "6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.x86_64"
},
"product_reference": "openssl-devel-0:1.0.1e-59.el6_10.x86_64",
"relates_to_product_reference": "6Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-perl-0:1.0.1e-59.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
"product_id": "6Server-optional-ELS:openssl-perl-0:1.0.1e-59.el6_10.i686"
},
"product_reference": "openssl-perl-0:1.0.1e-59.el6_10.i686",
"relates_to_product_reference": "6Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-perl-0:1.0.1e-59.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
"product_id": "6Server-optional-ELS:openssl-perl-0:1.0.1e-59.el6_10.s390x"
},
"product_reference": "openssl-perl-0:1.0.1e-59.el6_10.s390x",
"relates_to_product_reference": "6Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-perl-0:1.0.1e-59.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
"product_id": "6Server-optional-ELS:openssl-perl-0:1.0.1e-59.el6_10.x86_64"
},
"product_reference": "openssl-perl-0:1.0.1e-59.el6_10.x86_64",
"relates_to_product_reference": "6Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-static-0:1.0.1e-59.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
"product_id": "6Server-optional-ELS:openssl-static-0:1.0.1e-59.el6_10.i686"
},
"product_reference": "openssl-static-0:1.0.1e-59.el6_10.i686",
"relates_to_product_reference": "6Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-static-0:1.0.1e-59.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
"product_id": "6Server-optional-ELS:openssl-static-0:1.0.1e-59.el6_10.s390x"
},
"product_reference": "openssl-static-0:1.0.1e-59.el6_10.s390x",
"relates_to_product_reference": "6Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openssl-static-0:1.0.1e-59.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6 ELS)",
"product_id": "6Server-optional-ELS:openssl-static-0:1.0.1e-59.el6_10.x86_64"
},
"product_reference": "openssl-static-0:1.0.1e-59.el6_10.x86_64",
"relates_to_product_reference": "6Server-optional-ELS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the OpenSSL project"
]
},
{
"names": [
"David Benjamin"
],
"organization": "Google",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-1971",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2020-12-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1903409"
}
],
"notes": [
{
"category": "description",
"text": "A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: EDIPARTYNAME NULL pointer de-reference",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a flaw in the GENERAL_NAME_cmp function of openssl which can be triggered when both its arguments are of the same type i.e. EDIPARTYNAME. \n\n1. Red Hat does not ship any applications compiled with openssl, which used the above function in a vulnerable way.\n\n2. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes, when comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate and when verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token). If an attacker can control both items being compared then that attacker could trigger a crash. For example, if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then a crash may be triggered.\n\nThird party applications compiled with openssl using the function GENERAL_NAME_cmp in a vulnerable way are affected by this flaw.\n\nGENERAL_NAME_cmp was added in 0.9.8k, therefore older versions of openssl are not affected by this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-ELS:openssl-0:1.0.1e-59.el6_10.i686",
"6Server-ELS:openssl-0:1.0.1e-59.el6_10.s390",
"6Server-ELS:openssl-0:1.0.1e-59.el6_10.s390x",
"6Server-ELS:openssl-0:1.0.1e-59.el6_10.src",
"6Server-ELS:openssl-0:1.0.1e-59.el6_10.x86_64",
"6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.i686",
"6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390",
"6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390x",
"6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.x86_64",
"6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.i686",
"6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390",
"6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390x",
"6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.x86_64",
"6Server-ELS:openssl-perl-0:1.0.1e-59.el6_10.i686",
"6Server-ELS:openssl-perl-0:1.0.1e-59.el6_10.s390x",
"6Server-ELS:openssl-perl-0:1.0.1e-59.el6_10.x86_64",
"6Server-ELS:openssl-static-0:1.0.1e-59.el6_10.i686",
"6Server-ELS:openssl-static-0:1.0.1e-59.el6_10.s390x",
"6Server-ELS:openssl-static-0:1.0.1e-59.el6_10.x86_64",
"6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.i686",
"6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.s390",
"6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.s390x",
"6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.src",
"6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.x86_64",
"6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.i686",
"6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390",
"6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390x",
"6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.x86_64",
"6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.i686",
"6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390",
"6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390x",
"6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.x86_64",
"6Server-optional-ELS:openssl-perl-0:1.0.1e-59.el6_10.i686",
"6Server-optional-ELS:openssl-perl-0:1.0.1e-59.el6_10.s390x",
"6Server-optional-ELS:openssl-perl-0:1.0.1e-59.el6_10.x86_64",
"6Server-optional-ELS:openssl-static-0:1.0.1e-59.el6_10.i686",
"6Server-optional-ELS:openssl-static-0:1.0.1e-59.el6_10.s390x",
"6Server-optional-ELS:openssl-static-0:1.0.1e-59.el6_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1971"
},
{
"category": "external",
"summary": "RHBZ#1903409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1971",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1971"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971"
},
{
"category": "external",
"summary": "https://www.openssl.org/news/secadv/20201208.txt",
"url": "https://www.openssl.org/news/secadv/20201208.txt"
}
],
"release_date": "2020-12-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-01-11T10:34:05+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.",
"product_ids": [
"6Server-ELS:openssl-0:1.0.1e-59.el6_10.i686",
"6Server-ELS:openssl-0:1.0.1e-59.el6_10.s390",
"6Server-ELS:openssl-0:1.0.1e-59.el6_10.s390x",
"6Server-ELS:openssl-0:1.0.1e-59.el6_10.src",
"6Server-ELS:openssl-0:1.0.1e-59.el6_10.x86_64",
"6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.i686",
"6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390",
"6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390x",
"6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.x86_64",
"6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.i686",
"6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390",
"6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390x",
"6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.x86_64",
"6Server-ELS:openssl-perl-0:1.0.1e-59.el6_10.i686",
"6Server-ELS:openssl-perl-0:1.0.1e-59.el6_10.s390x",
"6Server-ELS:openssl-perl-0:1.0.1e-59.el6_10.x86_64",
"6Server-ELS:openssl-static-0:1.0.1e-59.el6_10.i686",
"6Server-ELS:openssl-static-0:1.0.1e-59.el6_10.s390x",
"6Server-ELS:openssl-static-0:1.0.1e-59.el6_10.x86_64",
"6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.i686",
"6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.s390",
"6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.s390x",
"6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.src",
"6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.x86_64",
"6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.i686",
"6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390",
"6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390x",
"6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.x86_64",
"6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.i686",
"6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390",
"6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390x",
"6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.x86_64",
"6Server-optional-ELS:openssl-perl-0:1.0.1e-59.el6_10.i686",
"6Server-optional-ELS:openssl-perl-0:1.0.1e-59.el6_10.s390x",
"6Server-optional-ELS:openssl-perl-0:1.0.1e-59.el6_10.x86_64",
"6Server-optional-ELS:openssl-static-0:1.0.1e-59.el6_10.i686",
"6Server-optional-ELS:openssl-static-0:1.0.1e-59.el6_10.s390x",
"6Server-optional-ELS:openssl-static-0:1.0.1e-59.el6_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0056"
},
{
"category": "workaround",
"details": "Applications not using the GENERAL_NAME_cmp of openssl are not vulnerable to this flaw. Even when this function is used, if the attacker can control both the arguments of this function, only then the attacker could trigger a crash.",
"product_ids": [
"6Server-ELS:openssl-0:1.0.1e-59.el6_10.i686",
"6Server-ELS:openssl-0:1.0.1e-59.el6_10.s390",
"6Server-ELS:openssl-0:1.0.1e-59.el6_10.s390x",
"6Server-ELS:openssl-0:1.0.1e-59.el6_10.src",
"6Server-ELS:openssl-0:1.0.1e-59.el6_10.x86_64",
"6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.i686",
"6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390",
"6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390x",
"6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.x86_64",
"6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.i686",
"6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390",
"6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390x",
"6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.x86_64",
"6Server-ELS:openssl-perl-0:1.0.1e-59.el6_10.i686",
"6Server-ELS:openssl-perl-0:1.0.1e-59.el6_10.s390x",
"6Server-ELS:openssl-perl-0:1.0.1e-59.el6_10.x86_64",
"6Server-ELS:openssl-static-0:1.0.1e-59.el6_10.i686",
"6Server-ELS:openssl-static-0:1.0.1e-59.el6_10.s390x",
"6Server-ELS:openssl-static-0:1.0.1e-59.el6_10.x86_64",
"6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.i686",
"6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.s390",
"6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.s390x",
"6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.src",
"6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.x86_64",
"6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.i686",
"6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390",
"6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390x",
"6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.x86_64",
"6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.i686",
"6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390",
"6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390x",
"6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.x86_64",
"6Server-optional-ELS:openssl-perl-0:1.0.1e-59.el6_10.i686",
"6Server-optional-ELS:openssl-perl-0:1.0.1e-59.el6_10.s390x",
"6Server-optional-ELS:openssl-perl-0:1.0.1e-59.el6_10.x86_64",
"6Server-optional-ELS:openssl-static-0:1.0.1e-59.el6_10.i686",
"6Server-optional-ELS:openssl-static-0:1.0.1e-59.el6_10.s390x",
"6Server-optional-ELS:openssl-static-0:1.0.1e-59.el6_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"6Server-ELS:openssl-0:1.0.1e-59.el6_10.i686",
"6Server-ELS:openssl-0:1.0.1e-59.el6_10.s390",
"6Server-ELS:openssl-0:1.0.1e-59.el6_10.s390x",
"6Server-ELS:openssl-0:1.0.1e-59.el6_10.src",
"6Server-ELS:openssl-0:1.0.1e-59.el6_10.x86_64",
"6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.i686",
"6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390",
"6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390x",
"6Server-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.x86_64",
"6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.i686",
"6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390",
"6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390x",
"6Server-ELS:openssl-devel-0:1.0.1e-59.el6_10.x86_64",
"6Server-ELS:openssl-perl-0:1.0.1e-59.el6_10.i686",
"6Server-ELS:openssl-perl-0:1.0.1e-59.el6_10.s390x",
"6Server-ELS:openssl-perl-0:1.0.1e-59.el6_10.x86_64",
"6Server-ELS:openssl-static-0:1.0.1e-59.el6_10.i686",
"6Server-ELS:openssl-static-0:1.0.1e-59.el6_10.s390x",
"6Server-ELS:openssl-static-0:1.0.1e-59.el6_10.x86_64",
"6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.i686",
"6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.s390",
"6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.s390x",
"6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.src",
"6Server-optional-ELS:openssl-0:1.0.1e-59.el6_10.x86_64",
"6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.i686",
"6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390",
"6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.s390x",
"6Server-optional-ELS:openssl-debuginfo-0:1.0.1e-59.el6_10.x86_64",
"6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.i686",
"6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390",
"6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.s390x",
"6Server-optional-ELS:openssl-devel-0:1.0.1e-59.el6_10.x86_64",
"6Server-optional-ELS:openssl-perl-0:1.0.1e-59.el6_10.i686",
"6Server-optional-ELS:openssl-perl-0:1.0.1e-59.el6_10.s390x",
"6Server-optional-ELS:openssl-perl-0:1.0.1e-59.el6_10.x86_64",
"6Server-optional-ELS:openssl-static-0:1.0.1e-59.el6_10.i686",
"6Server-optional-ELS:openssl-static-0:1.0.1e-59.el6_10.s390x",
"6Server-optional-ELS:openssl-static-0:1.0.1e-59.el6_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "openssl: EDIPARTYNAME NULL pointer de-reference"
}
]
}
RHSA-2021_0486
Vulnerability from csaf_redhat - Published: 2021-02-11 13:19 - Updated: 2024-11-22 15:56Summary
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP6 security update
Severity
Low
Notes
Topic: Updated packages that provide Red Hat JBoss Core Services Pack Apache Server 2.4.37 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: This release adds the new Apache HTTP Server 2.4.37 Service Pack 6 packages that are part of the JBoss Core Services offering.
This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 5 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.
Security fix(es):
* openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.
5.9 (Medium)
Affected products
Fixed
48 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-40.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-40.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-66.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-66.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-66.jbcs.el7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-66.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-66.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.15.7-12.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.48-11.redhat_1.jbcs.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.48-11.redhat_1.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.48-11.redhat_1.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.48-11.redhat_1.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-66.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.0.8-31.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-66.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-58.GA.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-66.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-66.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-35.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-35.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-openssl-chil-debuginfo-0:1.0.0-3.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1g-3.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1g-3.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1g-3.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1g-3.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-openssl-pkcs11-debuginfo-0:0.4.10-18.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1g-3.jbcs.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
References
10 references
Acknowledgments
the OpenSSL project
Google
David Benjamin
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated packages that provide Red Hat JBoss Core Services Pack Apache Server 2.4.37 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "This release adds the new Apache HTTP Server 2.4.37 Service Pack 6 packages that are part of the JBoss Core Services offering.\n\nThis release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 5 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.\n\nSecurity fix(es):\n\n* openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:0486",
"url": "https://access.redhat.com/errata/RHSA-2021:0486"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.37/",
"url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.37/"
},
{
"category": "external",
"summary": "1903409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903409"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0486.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP6 security update",
"tracking": {
"current_release_date": "2024-11-22T15:56:05+00:00",
"generator": {
"date": "2024-11-22T15:56:05+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2021:0486",
"initial_release_date": "2021-02-11T13:19:08+00:00",
"revision_history": [
{
"date": "2021-02-11T13:19:08+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-02-11T13:19:08+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T15:56:05+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Core Services on RHEL 7 Server",
"product": {
"name": "Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_core_services:1::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Core Services"
},
{
"branches": [
{
"category": "product_version",
"name": "jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.src",
"product": {
"name": "jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.src",
"product_id": "jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-40.jbcs.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.src",
"product": {
"name": "jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.src",
"product_id": "jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1g-3.jbcs.el7?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.src",
"product": {
"name": "jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.src",
"product_id": "jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2@1.39.2-35.jbcs.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.src",
"product": {
"name": "jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.src",
"product_id": "jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-pkcs11@0.4.10-18.jbcs.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.src",
"product": {
"name": "jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.src",
"product_id": "jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-chil@1.0.0-3.jbcs.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.src",
"product": {
"name": "jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.src",
"product_id": "jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-66.jbcs.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.src",
"product": {
"name": "jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.src",
"product_id": "jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-mod_md@2.0.8-31.jbcs.el7?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.src",
"product": {
"name": "jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.src",
"product_id": "jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-mod_http2@1.15.7-12.jbcs.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.src",
"product": {
"name": "jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.src",
"product_id": "jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.2-58.GA.jbcs.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-mod_jk-0:1.2.48-11.redhat_1.jbcs.el7.src",
"product": {
"name": "jbcs-httpd24-mod_jk-0:1.2.48-11.redhat_1.jbcs.el7.src",
"product_id": "jbcs-httpd24-mod_jk-0:1.2.48-11.redhat_1.jbcs.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk@1.2.48-11.redhat_1.jbcs.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.src",
"product": {
"name": "jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.src",
"product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.14-16.Final_redhat_2.jbcs.el7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-40.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-brotli-devel-0:1.0.6-40.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-brotli-devel-0:1.0.6-40.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-brotli-devel-0:1.0.6-40.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-devel@1.0.6-40.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-40.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-40.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-40.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-debuginfo@1.0.6-40.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1g-3.jbcs.el7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-openssl-devel-1:1.1.1g-3.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-openssl-devel-1:1.1.1g-3.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-openssl-devel-1:1.1.1g-3.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-devel@1.1.1g-3.jbcs.el7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-openssl-libs-1:1.1.1g-3.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-openssl-libs-1:1.1.1g-3.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-openssl-libs-1:1.1.1g-3.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-libs@1.1.1g-3.jbcs.el7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-openssl-perl-1:1.1.1g-3.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-openssl-perl-1:1.1.1g-3.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-openssl-perl-1:1.1.1g-3.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-perl@1.1.1g-3.jbcs.el7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-openssl-static-1:1.1.1g-3.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-openssl-static-1:1.1.1g-3.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-openssl-static-1:1.1.1g-3.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-static@1.1.1g-3.jbcs.el7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1g-3.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1g-3.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-openssl-debuginfo-1:1.1.1g-3.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-debuginfo@1.1.1g-3.jbcs.el7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2@1.39.2-35.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-35.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-35.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-nghttp2-devel-0:1.39.2-35.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2-devel@1.39.2-35.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-35.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-35.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-35.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2-debuginfo@1.39.2-35.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-pkcs11@0.4.10-18.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-openssl-pkcs11-debuginfo-0:0.4.10-18.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-openssl-pkcs11-debuginfo-0:0.4.10-18.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-openssl-pkcs11-debuginfo-0:0.4.10-18.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-pkcs11-debuginfo@0.4.10-18.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-chil@1.0.0-3.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-openssl-chil-debuginfo-0:1.0.0-3.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-openssl-chil-debuginfo-0:1.0.0-3.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-openssl-chil-debuginfo-0:1.0.0-3.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-chil-debuginfo@1.0.0-3.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-66.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-httpd-devel-0:2.4.37-66.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-httpd-devel-0:2.4.37-66.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-httpd-devel-0:2.4.37-66.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-devel@2.4.37-66.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-httpd-selinux-0:2.4.37-66.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-httpd-selinux-0:2.4.37-66.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-httpd-selinux-0:2.4.37-66.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-selinux@2.4.37-66.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-httpd-tools-0:2.4.37-66.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-httpd-tools-0:2.4.37-66.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-httpd-tools-0:2.4.37-66.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-tools@2.4.37-66.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-mod_ldap-0:2.4.37-66.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-mod_ldap-0:2.4.37-66.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-mod_ldap-0:2.4.37-66.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ldap@2.4.37-66.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-66.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-66.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-mod_proxy_html-1:2.4.37-66.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-mod_proxy_html@2.4.37-66.jbcs.el7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-mod_session-0:2.4.37-66.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-mod_session-0:2.4.37-66.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-mod_session-0:2.4.37-66.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-mod_session@2.4.37-66.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-mod_ssl-1:2.4.37-66.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-mod_ssl-1:2.4.37-66.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-mod_ssl-1:2.4.37-66.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ssl@2.4.37-66.jbcs.el7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-66.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-66.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-66.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-debuginfo@2.4.37-66.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-mod_md@2.0.8-31.jbcs.el7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-mod_md-debuginfo-1:2.0.8-31.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-mod_md-debuginfo-1:2.0.8-31.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-mod_md-debuginfo-1:2.0.8-31.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-mod_md-debuginfo@2.0.8-31.jbcs.el7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-mod_http2@1.15.7-12.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-mod_http2-debuginfo-0:1.15.7-12.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-mod_http2-debuginfo-0:1.15.7-12.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-mod_http2-debuginfo-0:1.15.7-12.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-mod_http2-debuginfo@1.15.7-12.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.2-58.GA.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-58.GA.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-58.GA.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-58.GA.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security-debuginfo@2.9.2-58.GA.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-mod_jk-ap24-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-mod_jk-ap24-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-mod_jk-ap24-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-ap24@1.2.48-11.redhat_1.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-mod_jk-manual-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-mod_jk-manual-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-mod_jk-manual-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-manual@1.2.48-11.redhat_1.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-debuginfo@1.2.48-11.redhat_1.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.14-16.Final_redhat_2.jbcs.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64",
"product": {
"name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64",
"product_id": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native-debuginfo@1.3.14-16.Final_redhat_2.jbcs.el7?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "jbcs-httpd24-httpd-manual-0:2.4.37-66.jbcs.el7.noarch",
"product": {
"name": "jbcs-httpd24-httpd-manual-0:2.4.37-66.jbcs.el7.noarch",
"product_id": "jbcs-httpd24-httpd-manual-0:2.4.37-66.jbcs.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-manual@2.4.37-66.jbcs.el7?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.src"
},
"product_reference": "jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.src",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-40.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-40.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-40.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-brotli-devel-0:1.0.6-40.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-40.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-brotli-devel-0:1.0.6-40.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.src"
},
"product_reference": "jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.src",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-66.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-66.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-66.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-httpd-devel-0:2.4.37-66.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-66.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-httpd-devel-0:2.4.37-66.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-httpd-manual-0:2.4.37-66.jbcs.el7.noarch as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-66.jbcs.el7.noarch"
},
"product_reference": "jbcs-httpd24-httpd-manual-0:2.4.37-66.jbcs.el7.noarch",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-httpd-selinux-0:2.4.37-66.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-66.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-httpd-selinux-0:2.4.37-66.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-httpd-tools-0:2.4.37-66.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-66.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-httpd-tools-0:2.4.37-66.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.src"
},
"product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.src",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.src"
},
"product_reference": "jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.src",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-mod_http2-debuginfo-0:1.15.7-12.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.15.7-12.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-mod_http2-debuginfo-0:1.15.7-12.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-mod_jk-0:1.2.48-11.redhat_1.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.48-11.redhat_1.jbcs.el7.src"
},
"product_reference": "jbcs-httpd24-mod_jk-0:1.2.48-11.redhat_1.jbcs.el7.src",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-mod_jk-ap24-0:1.2.48-11.redhat_1.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.48-11.redhat_1.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-mod_jk-ap24-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.48-11.redhat_1.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.48-11.redhat_1.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-mod_jk-manual-0:1.2.48-11.redhat_1.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.48-11.redhat_1.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-mod_jk-manual-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-mod_ldap-0:2.4.37-66.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-66.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-mod_ldap-0:2.4.37-66.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.src"
},
"product_reference": "jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.src",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-mod_md-debuginfo-1:2.0.8-31.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.0.8-31.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-mod_md-debuginfo-1:2.0.8-31.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-66.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-66.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-mod_proxy_html-1:2.4.37-66.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.src"
},
"product_reference": "jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.src",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-58.GA.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-58.GA.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-58.GA.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-mod_session-0:2.4.37-66.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-66.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-mod_session-0:2.4.37-66.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-mod_ssl-1:2.4.37-66.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-66.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-mod_ssl-1:2.4.37-66.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.src"
},
"product_reference": "jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.src",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-35.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-35.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-35.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-35.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-35.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-nghttp2-devel-0:1.39.2-35.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.src"
},
"product_reference": "jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.src",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.src"
},
"product_reference": "jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.src",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-openssl-chil-debuginfo-0:1.0.0-3.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-openssl-chil-debuginfo-0:1.0.0-3.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-openssl-chil-debuginfo-0:1.0.0-3.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1g-3.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1g-3.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-openssl-debuginfo-1:1.1.1g-3.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-openssl-devel-1:1.1.1g-3.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1g-3.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-openssl-devel-1:1.1.1g-3.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-openssl-libs-1:1.1.1g-3.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1g-3.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-openssl-libs-1:1.1.1g-3.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-openssl-perl-1:1.1.1g-3.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1g-3.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-openssl-perl-1:1.1.1g-3.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.src"
},
"product_reference": "jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.src",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-openssl-pkcs11-debuginfo-0:0.4.10-18.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-openssl-pkcs11-debuginfo-0:0.4.10-18.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-openssl-pkcs11-debuginfo-0:0.4.10-18.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jbcs-httpd24-openssl-static-1:1.1.1g-3.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
"product_id": "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1g-3.jbcs.el7.x86_64"
},
"product_reference": "jbcs-httpd24-openssl-static-1:1.1.1g-3.jbcs.el7.x86_64",
"relates_to_product_reference": "7Server-JBCS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the OpenSSL project"
]
},
{
"names": [
"David Benjamin"
],
"organization": "Google",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-1971",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2020-12-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1903409"
}
],
"notes": [
{
"category": "description",
"text": "A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: EDIPARTYNAME NULL pointer de-reference",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a flaw in the GENERAL_NAME_cmp function of openssl which can be triggered when both its arguments are of the same type i.e. EDIPARTYNAME. \n\n1. Red Hat does not ship any applications compiled with openssl, which used the above function in a vulnerable way.\n\n2. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes, when comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate and when verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token). If an attacker can control both items being compared then that attacker could trigger a crash. For example, if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then a crash may be triggered.\n\nThird party applications compiled with openssl using the function GENERAL_NAME_cmp in a vulnerable way are affected by this flaw.\n\nGENERAL_NAME_cmp was added in 0.9.8k, therefore older versions of openssl are not affected by this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-40.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-40.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-66.jbcs.el7.noarch",
"7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.15.7-12.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.48-11.redhat_1.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.0.8-31.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-58.GA.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-35.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-35.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-chil-debuginfo-0:1.0.0-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1g-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1g-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1g-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1g-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-pkcs11-debuginfo-0:0.4.10-18.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1g-3.jbcs.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1971"
},
{
"category": "external",
"summary": "RHBZ#1903409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1971",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1971"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971"
},
{
"category": "external",
"summary": "https://www.openssl.org/news/secadv/20201208.txt",
"url": "https://www.openssl.org/news/secadv/20201208.txt"
}
],
"release_date": "2020-12-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-11T13:19:08+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-40.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-40.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-66.jbcs.el7.noarch",
"7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.15.7-12.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.48-11.redhat_1.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.0.8-31.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-58.GA.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-35.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-35.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-chil-debuginfo-0:1.0.0-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1g-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1g-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1g-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1g-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-pkcs11-debuginfo-0:0.4.10-18.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1g-3.jbcs.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0486"
},
{
"category": "workaround",
"details": "Applications not using the GENERAL_NAME_cmp of openssl are not vulnerable to this flaw. Even when this function is used, if the attacker can control both the arguments of this function, only then the attacker could trigger a crash.",
"product_ids": [
"7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-40.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-40.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-66.jbcs.el7.noarch",
"7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.15.7-12.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.48-11.redhat_1.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.0.8-31.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-58.GA.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-35.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-35.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-chil-debuginfo-0:1.0.0-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1g-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1g-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1g-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1g-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-pkcs11-debuginfo-0:0.4.10-18.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1g-3.jbcs.el7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-40.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-40.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-66.jbcs.el7.noarch",
"7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.14-16.Final_redhat_2.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_http2-debuginfo-0:1.15.7-12.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.48-11.redhat_1.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.48-11.redhat_1.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_md-debuginfo-1:2.0.8-31.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-58.GA.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-66.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-35.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-35.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-chil-debuginfo-0:1.0.0-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1g-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1g-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1g-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1g-3.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.src",
"7Server-JBCS:jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-pkcs11-debuginfo-0:0.4.10-18.jbcs.el7.x86_64",
"7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1g-3.jbcs.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openssl: EDIPARTYNAME NULL pointer de-reference"
}
]
}
RHSA-2021_0488
Vulnerability from csaf_redhat - Published: 2021-02-11 13:29 - Updated: 2024-11-22 15:56Summary
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP6 security update
Severity
Low
Notes
Topic: Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 6 zip release for RHEL 7, RHEL 8 and Microsoft Windows is available.
Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.
This release adds the new Apache HTTP Server 2.4.37 Service Pack 6 packages that are part of the JBoss Core Services offering.
This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 5 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.
Security fix(es):
* openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.
5.9 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
JBCS 2.4.37 SP6
Red Hat / Red Hat JBoss Core Services
|
cpe:/a:redhat:jboss_core_services:1
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
References
12 references
Acknowledgments
the OpenSSL project
Google
David Benjamin
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 6 zip release for RHEL 7, RHEL 8 and Microsoft Windows is available.\n\nRed Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.\n\nThis release adds the new Apache HTTP Server 2.4.37 Service Pack 6 packages that are part of the JBoss Core Services offering.\n\nThis release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 5 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.\n\nSecurity fix(es):\n\n* openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:0488",
"url": "https://access.redhat.com/errata/RHSA-2021:0488"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.apachehttp\u0026downloadType=securityPatches\u0026version=2.4.37",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.apachehttp\u0026downloadType=securityPatches\u0026version=2.4.37"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.openssl\u0026downloadType=securityPatches\u0026version=1.1.1c",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.openssl\u0026downloadType=securityPatches\u0026version=1.1.1c"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.37/",
"url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.37/"
},
{
"category": "external",
"summary": "1903409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903409"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0488.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP6 security update",
"tracking": {
"current_release_date": "2024-11-22T15:56:13+00:00",
"generator": {
"date": "2024-11-22T15:56:13+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2021:0488",
"initial_release_date": "2021-02-11T13:29:52+00:00",
"revision_history": [
{
"date": "2021-02-11T13:29:52+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-02-11T13:29:52+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T15:56:13+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "JBCS 2.4.37 SP6",
"product": {
"name": "JBCS 2.4.37 SP6",
"product_id": "JBCS 2.4.37 SP6",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_core_services:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Core Services"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the OpenSSL project"
]
},
{
"names": [
"David Benjamin"
],
"organization": "Google",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-1971",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2020-12-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1903409"
}
],
"notes": [
{
"category": "description",
"text": "A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: EDIPARTYNAME NULL pointer de-reference",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a flaw in the GENERAL_NAME_cmp function of openssl which can be triggered when both its arguments are of the same type i.e. EDIPARTYNAME. \n\n1. Red Hat does not ship any applications compiled with openssl, which used the above function in a vulnerable way.\n\n2. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes, when comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate and when verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token). If an attacker can control both items being compared then that attacker could trigger a crash. For example, if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then a crash may be triggered.\n\nThird party applications compiled with openssl using the function GENERAL_NAME_cmp in a vulnerable way are affected by this flaw.\n\nGENERAL_NAME_cmp was added in 0.9.8k, therefore older versions of openssl are not affected by this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"JBCS 2.4.37 SP6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1971"
},
{
"category": "external",
"summary": "RHBZ#1903409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1971",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1971"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971"
},
{
"category": "external",
"summary": "https://www.openssl.org/news/secadv/20201208.txt",
"url": "https://www.openssl.org/news/secadv/20201208.txt"
}
],
"release_date": "2020-12-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-11T13:29:52+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.",
"product_ids": [
"JBCS 2.4.37 SP6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0488"
},
{
"category": "workaround",
"details": "Applications not using the GENERAL_NAME_cmp of openssl are not vulnerable to this flaw. Even when this function is used, if the attacker can control both the arguments of this function, only then the attacker could trigger a crash.",
"product_ids": [
"JBCS 2.4.37 SP6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"JBCS 2.4.37 SP6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openssl: EDIPARTYNAME NULL pointer de-reference"
}
]
}
RHSA-2021_0489
Vulnerability from csaf_redhat - Published: 2021-02-11 13:38 - Updated: 2024-11-22 15:56Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 11 security update
Severity
Low
Notes
Topic: An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 7.
Red Hat Product Security has rated this release as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 3.1 Service Pack 11 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.
5.9 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.23-23.redhat_23.ep7.el7.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
References
10 references
Acknowledgments
the OpenSSL project
Google
David Benjamin
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 7.\n\nRed Hat Product Security has rated this release as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 3.1 Service Pack 11 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:0489",
"url": "https://access.redhat.com/errata/RHSA-2021:0489"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "1903409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903409"
},
{
"category": "external",
"summary": "JWS-1938",
"url": "https://issues.redhat.com/browse/JWS-1938"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0489.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 11 security update",
"tracking": {
"current_release_date": "2024-11-22T15:56:35+00:00",
"generator": {
"date": "2024-11-22T15:56:35+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2021:0489",
"initial_release_date": "2021-02-11T13:38:43+00:00",
"revision_history": [
{
"date": "2021-02-11T13:38:43+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-02-11T13:38:43+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T15:56:35+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 3.1 for RHEL 7",
"product": {
"name": "Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.src",
"product": {
"name": "tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.src",
"product_id": "tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-native@1.2.23-23.redhat_23.ep7.el7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.x86_64",
"product": {
"name": "tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.x86_64",
"product_id": "tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-native@1.2.23-23.redhat_23.ep7.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "tomcat-native-debuginfo-0:1.2.23-23.redhat_23.ep7.el7.x86_64",
"product": {
"name": "tomcat-native-debuginfo-0:1.2.23-23.redhat_23.ep7.el7.x86_64",
"product_id": "tomcat-native-debuginfo-0:1.2.23-23.redhat_23.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-native-debuginfo@1.2.23-23.redhat_23.ep7.el7?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.src as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.src"
},
"product_reference": "tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.src",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.x86_64"
},
"product_reference": "tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-native-debuginfo-0:1.2.23-23.redhat_23.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.1 for RHEL 7",
"product_id": "7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.23-23.redhat_23.ep7.el7.x86_64"
},
"product_reference": "tomcat-native-debuginfo-0:1.2.23-23.redhat_23.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.1"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the OpenSSL project"
]
},
{
"names": [
"David Benjamin"
],
"organization": "Google",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-1971",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2020-12-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1903409"
}
],
"notes": [
{
"category": "description",
"text": "A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: EDIPARTYNAME NULL pointer de-reference",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a flaw in the GENERAL_NAME_cmp function of openssl which can be triggered when both its arguments are of the same type i.e. EDIPARTYNAME. \n\n1. Red Hat does not ship any applications compiled with openssl, which used the above function in a vulnerable way.\n\n2. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes, when comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate and when verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token). If an attacker can control both items being compared then that attacker could trigger a crash. For example, if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then a crash may be triggered.\n\nThird party applications compiled with openssl using the function GENERAL_NAME_cmp in a vulnerable way are affected by this flaw.\n\nGENERAL_NAME_cmp was added in 0.9.8k, therefore older versions of openssl are not affected by this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JWS-3.1:tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.23-23.redhat_23.ep7.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1971"
},
{
"category": "external",
"summary": "RHBZ#1903409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1971",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1971"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971"
},
{
"category": "external",
"summary": "https://www.openssl.org/news/secadv/20201208.txt",
"url": "https://www.openssl.org/news/secadv/20201208.txt"
}
],
"release_date": "2020-12-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-11T13:38:43+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JWS-3.1:tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.23-23.redhat_23.ep7.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0489"
},
{
"category": "workaround",
"details": "Applications not using the GENERAL_NAME_cmp of openssl are not vulnerable to this flaw. Even when this function is used, if the attacker can control both the arguments of this function, only then the attacker could trigger a crash.",
"product_ids": [
"7Server-JWS-3.1:tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.23-23.redhat_23.ep7.el7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JWS-3.1:tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.src",
"7Server-JWS-3.1:tomcat-native-0:1.2.23-23.redhat_23.ep7.el7.x86_64",
"7Server-JWS-3.1:tomcat-native-debuginfo-0:1.2.23-23.redhat_23.ep7.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openssl: EDIPARTYNAME NULL pointer de-reference"
}
]
}
RHSA-2021_0491
Vulnerability from csaf_redhat - Published: 2021-02-11 13:39 - Updated: 2024-11-22 15:56Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 11 security update
Severity
Low
Notes
Topic: An update is now available for Red Hat JBoss Web Server 3.1, for RHEL 7 and Windows.
Red Hat Product Security has rated this release as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 3.1 Service Pack 11 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.
5.9 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Web Server 3.1
Red Hat / Red Hat JBoss Web Server
|
cpe:/a:redhat:jboss_enterprise_web_server:3.1
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
References
9 references
Acknowledgments
the OpenSSL project
Google
David Benjamin
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat JBoss Web Server 3.1, for RHEL 7 and Windows.\n\nRed Hat Product Security has rated this release as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 3.1 Service Pack 11 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:0491",
"url": "https://access.redhat.com/errata/RHSA-2021:0491"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#low",
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "1903409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903409"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0491.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 11 security update",
"tracking": {
"current_release_date": "2024-11-22T15:56:43+00:00",
"generator": {
"date": "2024-11-22T15:56:43+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2021:0491",
"initial_release_date": "2021-02-11T13:39:36+00:00",
"revision_history": [
{
"date": "2021-02-11T13:39:36+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-02-11T13:39:36+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T15:56:43+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 3.1",
"product": {
"name": "Red Hat JBoss Web Server 3.1",
"product_id": "Red Hat JBoss Web Server 3.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the OpenSSL project"
]
},
{
"names": [
"David Benjamin"
],
"organization": "Google",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-1971",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2020-12-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1903409"
}
],
"notes": [
{
"category": "description",
"text": "A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: EDIPARTYNAME NULL pointer de-reference",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a flaw in the GENERAL_NAME_cmp function of openssl which can be triggered when both its arguments are of the same type i.e. EDIPARTYNAME. \n\n1. Red Hat does not ship any applications compiled with openssl, which used the above function in a vulnerable way.\n\n2. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes, when comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate and when verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token). If an attacker can control both items being compared then that attacker could trigger a crash. For example, if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then a crash may be triggered.\n\nThird party applications compiled with openssl using the function GENERAL_NAME_cmp in a vulnerable way are affected by this flaw.\n\nGENERAL_NAME_cmp was added in 0.9.8k, therefore older versions of openssl are not affected by this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1971"
},
{
"category": "external",
"summary": "RHBZ#1903409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1971",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1971"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971"
},
{
"category": "external",
"summary": "https://www.openssl.org/news/secadv/20201208.txt",
"url": "https://www.openssl.org/news/secadv/20201208.txt"
}
],
"release_date": "2020-12-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-11T13:39:36+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.",
"product_ids": [
"Red Hat JBoss Web Server 3.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0491"
},
{
"category": "workaround",
"details": "Applications not using the GENERAL_NAME_cmp of openssl are not vulnerable to this flaw. Even when this function is used, if the attacker can control both the arguments of this function, only then the attacker could trigger a crash.",
"product_ids": [
"Red Hat JBoss Web Server 3.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Web Server 3.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openssl: EDIPARTYNAME NULL pointer de-reference"
}
]
}
RHSA-2021_0494
Vulnerability from csaf_redhat - Published: 2021-02-11 13:51 - Updated: 2024-11-22 15:56Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 5.4.1 Security Update
Severity
Moderate
Notes
Topic: Updated Red Hat JBoss Web Server 5.4.1 packages are now available for Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 5.4.1 serves as a replacement for Red Hat JBoss Web Server 5.4.0, and includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes, linked to in the References.
Security Fix(es):
* tomcat: Apache Tomcat HTTP/2 Request mix-up (CVE-2020-13943)
* tomcat: HTTP/2 request header mix-up (CVE-2020-17527)
* tomcat: Information disclosure when using NTFS file system (CVE-2021-24122)
* openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.
5.9 (Medium)
Affected products
Fixed
28 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
A flaw was found in Apache Tomcat. If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it is possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources. The highest threat from this vulnerability is to data confidentiality.
5.3 (Medium)
Affected products
Fixed
28 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
7.5 (High)
Affected products
Fixed
28 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Apache Tomcat. When serving resources from a network location using the NTFS file system, it was possible to bypass security constraints and view the source code for JSPs in some configurations. The root cause was the unexpected behavior of the JRE API File.getCanonicalPath(), which was caused by the inconsistent behavior of the Windows API (FindFirstFileW) in some circumstances. The highest threat from this vulnerability is to confidentiality.
5.9 (Medium)
Affected products
Fixed
28 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
33 references
Acknowledgments
the OpenSSL project
Google
David Benjamin
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated Red Hat JBoss Web Server 5.4.1 packages are now available for Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 5.4.1 serves as a replacement for Red Hat JBoss Web Server 5.4.0, and includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes, linked to in the References.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat HTTP/2 Request mix-up (CVE-2020-13943)\n* tomcat: HTTP/2 request header mix-up (CVE-2020-17527)\n* tomcat: Information disclosure when using NTFS file system (CVE-2021-24122)\n* openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:0494",
"url": "https://access.redhat.com/errata/RHSA-2021:0494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1887648",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1887648"
},
{
"category": "external",
"summary": "1903409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903409"
},
{
"category": "external",
"summary": "1904221",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1904221"
},
{
"category": "external",
"summary": "1917209",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1917209"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0494.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 5.4.1 Security Update",
"tracking": {
"current_release_date": "2024-11-22T15:56:20+00:00",
"generator": {
"date": "2024-11-22T15:56:20+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2021:0494",
"initial_release_date": "2021-02-11T13:51:48+00:00",
"revision_history": [
{
"date": "2021-02-11T13:51:48+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-02-11T13:51:48+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T15:56:20+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product": {
"name": "Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.4::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 5.4 for RHEL 8",
"product": {
"name": "Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.4::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
},
{
"branches": [
{
"category": "product_version",
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"product": {
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"product_id": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native@1.2.25-3.redhat_3.el7jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"product": {
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"product_id": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat@9.0.36-9.redhat_8.1.el7jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"product": {
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"product_id": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native@1.2.25-3.redhat_3.el8jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"product": {
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"product_id": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat@9.0.36-9.redhat_8.1.el8jws?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"product": {
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"product_id": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native@1.2.25-3.redhat_3.el7jws?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"product": {
"name": "jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"product_id": "jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.25-3.redhat_3.el7jws?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"product": {
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"product_id": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native@1.2.25-3.redhat_3.el8jws?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"product": {
"name": "jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"product_id": "jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.25-3.redhat_3.el8jws?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_id": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat@9.0.36-9.redhat_8.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_id": "jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.36-9.redhat_8.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_id": "jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.36-9.redhat_8.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_id": "jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.36-9.redhat_8.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_id": "jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.36-9.redhat_8.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_id": "jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.36-9.redhat_8.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_id": "jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-lib@9.0.36-9.redhat_8.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_id": "jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.36-9.redhat_8.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_id": "jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.36-9.redhat_8.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_id": "jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.36-9.redhat_8.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_id": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat@9.0.36-9.redhat_8.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_id": "jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.36-9.redhat_8.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_id": "jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.36-9.redhat_8.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_id": "jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.36-9.redhat_8.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_id": "jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.36-9.redhat_8.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_id": "jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.36-9.redhat_8.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_id": "jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-lib@9.0.36-9.redhat_8.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_id": "jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.36-9.redhat_8.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_id": "jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.36-9.redhat_8.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_id": "jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.36-9.redhat_8.1.el8jws?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src"
},
"product_reference": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src"
},
"product_reference": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64 as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64"
},
"product_reference": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64 as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64"
},
"product_reference": "jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 7 Server",
"product_id": "7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src"
},
"product_reference": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src"
},
"product_reference": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64 as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64"
},
"product_reference": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64 as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64"
},
"product_reference": "jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.4 for RHEL 8",
"product_id": "8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.4"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the OpenSSL project"
]
},
{
"names": [
"David Benjamin"
],
"organization": "Google",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2020-1971",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2020-12-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1903409"
}
],
"notes": [
{
"category": "description",
"text": "A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: EDIPARTYNAME NULL pointer de-reference",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a flaw in the GENERAL_NAME_cmp function of openssl which can be triggered when both its arguments are of the same type i.e. EDIPARTYNAME. \n\n1. Red Hat does not ship any applications compiled with openssl, which used the above function in a vulnerable way.\n\n2. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes, when comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate and when verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token). If an attacker can control both items being compared then that attacker could trigger a crash. For example, if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then a crash may be triggered.\n\nThird party applications compiled with openssl using the function GENERAL_NAME_cmp in a vulnerable way are affected by this flaw.\n\nGENERAL_NAME_cmp was added in 0.9.8k, therefore older versions of openssl are not affected by this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1971"
},
{
"category": "external",
"summary": "RHBZ#1903409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1971",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1971"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971"
},
{
"category": "external",
"summary": "https://www.openssl.org/news/secadv/20201208.txt",
"url": "https://www.openssl.org/news/secadv/20201208.txt"
}
],
"release_date": "2020-12-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-11T13:51:48+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0494"
},
{
"category": "workaround",
"details": "Applications not using the GENERAL_NAME_cmp of openssl are not vulnerable to this flaw. Even when this function is used, if the attacker can control both the arguments of this function, only then the attacker could trigger a crash.",
"product_ids": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openssl: EDIPARTYNAME NULL pointer de-reference"
},
{
"cve": "CVE-2020-13943",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-10-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1887648"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it is possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources. The highest threat from this vulnerability is to data confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat HTTP/2 Request mix-up",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Enterprise Linux 8\u0027s Identity Management is using an affected version of Tomcat bundled within PKI servlet engine, however HTTP/2 protocol is not supported by this component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-13943"
},
{
"category": "external",
"summary": "RHBZ#1887648",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1887648"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-13943",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-13943"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-13943",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13943"
},
{
"category": "external",
"summary": "http://mail-archives.apache.org/mod_mbox/tomcat-announce/202010.mbox/%3C2b767c6e-dcb9-5816-bd69-a3bc0771fef3%40apache.org%3E",
"url": "http://mail-archives.apache.org/mod_mbox/tomcat-announce/202010.mbox/%3C2b767c6e-dcb9-5816-bd69-a3bc0771fef3%40apache.org%3E"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M8",
"url": "http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M8"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.58",
"url": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.58"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.38",
"url": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.38"
}
],
"release_date": "2020-10-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-11T13:51:48+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0494"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Apache Tomcat HTTP/2 Request mix-up"
},
{
"cve": "CVE-2020-17527",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-12-03T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1904221"
}
],
"notes": [
{
"category": "description",
"text": "While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: HTTP/2 request header mix-up",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Enterprise Linux 8\u0027s Identity Management and Certificate System are using a vulnerable version of Tomcat that is bundled into the pki-servlet-engine component. However, HTTP/2 is not enabled in such a configuration, and it is not possible to trigger the flaw in a supported setup. A future update may fix the code.\n\nRed Hat Enterprise Linux 7\u0027s tomcat package, Identity Management, and Certificate System are all not affected by this flaw because HTTP/2 is not supported in the shipped version of tomcat in those packages.\n\ntomcat5 and tomcat6 in Red Hat Enterprise Linux 5 and 6 (respectively) are not affected by this flaw because HTTP/2 is not supported in the shipped versions of those packages.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-17527"
},
{
"category": "external",
"summary": "RHBZ#1904221",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1904221"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-17527",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-17527"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-17527",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-17527"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M10",
"url": "http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M10"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60",
"url": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40",
"url": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40"
}
],
"release_date": "2020-12-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-11T13:51:48+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0494"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: HTTP/2 request header mix-up"
},
{
"cve": "CVE-2021-24122",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2021-01-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1917209"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. When serving resources from a network location using the NTFS file system, it was possible to bypass security constraints and view the source code for JSPs in some configurations. The root cause was the unexpected behavior of the JRE API File.getCanonicalPath(), which was caused by the inconsistent behavior of the Windows API (FindFirstFileW) in some circumstances. The highest threat from this vulnerability is to confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Information disclosure when using NTFS file system",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In Red Hat OpenStack Platform\u0027s OpenDaylight, tomcat is disabled by default. Further, ODL deployments are not supported on untrusted administrator networks; even if tomcat is enabled, if random users can access it, this would be in an unsupported configuration. For this reason, the RHOSP impact has been reduced and no update will be provided at this time for the ODL tomcat package.\n\nThis flaw does not affect tomcat or pki-servlet-engine as shipped with Red Hat Enterprise Linux 6, 7, or 8 because the functionality involving FindFirstFileW() is specific to the Windows native code. Additionally, RHEL is not shipped with NTFS support.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-24122"
},
{
"category": "external",
"summary": "RHBZ#1917209",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1917209"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-24122",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-24122"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-24122",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24122"
},
{
"category": "external",
"summary": "http://mail-archives.apache.org/mod_mbox/tomcat-announce/202101.mbox/%3Cf3765f21-969d-7f21-e34a-efc106175373%40apache.org%3E",
"url": "http://mail-archives.apache.org/mod_mbox/tomcat-announce/202101.mbox/%3Cf3765f21-969d-7f21-e34a-efc106175373%40apache.org%3E"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.107",
"url": "http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.107"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60",
"url": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40",
"url": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40"
}
],
"release_date": "2021-01-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-11T13:51:48+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0494"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.src",
"7Server-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el7jws.x86_64",
"7Server-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"7Server-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el7jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-admin-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-docs-webapp-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-el-3.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-javadoc-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-jsp-2.3-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-lib-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.src",
"8Base-JWS-5.4:jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-native-debuginfo-0:1.2.25-3.redhat_3.el8jws.x86_64",
"8Base-JWS-5.4:jws5-tomcat-selinux-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-servlet-4.0-api-0:9.0.36-9.redhat_8.1.el8jws.noarch",
"8Base-JWS-5.4:jws5-tomcat-webapps-0:9.0.36-9.redhat_8.1.el8jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Information disclosure when using NTFS file system"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…