RHSA-2023:7622
Vulnerability from csaf_redhat
Published
2023-12-07 12:21
Modified
2025-03-15 03:06
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.7 release and security update
Notes
Topic
An update is now available for Red Hat JBoss Web Server 5.7.7 on Red Hat Enterprise Linux versions 7, 8, and 9.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 5.7.7 serves as a replacement for Red Hat JBoss Web Server 5.7.6. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes linked to in the References section.
Security Fix(es):
* jbcs-httpd24-openssl: OpenSSL: Excessive time spent checking DH q parameter value (CVE-2023-3817)
* openssl: Excessive time spent checking DH keys and parameters (CVE-2023-3446)
* openssl: Certificate policy check not enabled (CVE-2023-0466)
* openssl: Invalid certificate policies in leaf certificates are silently ignored (CVE-2023-0465)
* openssl: Denial of service by excessive resource usage in verifying X509 policy constraints (CVE-2023-0464)
* openssl: Possible DoS translating ASN.1 object identifiers (CVE-2023-2650)
* tomcat: Open Redirect vulnerability in FORM authentication (CVE-2023-41080)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update is now available for Red Hat JBoss Web Server 5.7.7 on Red Hat Enterprise Linux versions 7, 8, and 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 5.7.7 serves as a replacement for Red Hat JBoss Web Server 5.7.6. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes linked to in the References section.\n\nSecurity Fix(es):\n\n* jbcs-httpd24-openssl: OpenSSL: Excessive time spent checking DH q parameter value (CVE-2023-3817)\n* openssl: Excessive time spent checking DH keys and parameters (CVE-2023-3446)\n* openssl: Certificate policy check not enabled (CVE-2023-0466)\n* openssl: Invalid certificate policies in leaf certificates are silently ignored (CVE-2023-0465)\n* openssl: Denial of service by excessive resource usage in verifying X509 policy constraints (CVE-2023-0464)\n* openssl: Possible DoS translating ASN.1 object identifiers (CVE-2023-2650)\n* tomcat: Open Redirect vulnerability in FORM authentication (CVE-2023-41080)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2023:7622", url: "https://access.redhat.com/errata/RHSA-2023:7622", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "2181082", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2181082", }, { category: "external", summary: "2182561", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2182561", }, { category: "external", summary: "2182565", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2182565", }, { category: "external", summary: "2207947", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2207947", }, { category: "external", summary: "2224962", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2224962", }, { category: "external", summary: "2227852", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2227852", }, { category: "external", summary: "2235370", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2235370", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7622.json", }, ], title: "Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.7 release and security update", tracking: { current_release_date: "2025-03-15T03:06:15+00:00", generator: { date: "2025-03-15T03:06:15+00:00", engine: { name: "Red Hat SDEngine", version: "4.4.1", }, }, id: "RHSA-2023:7622", initial_release_date: "2023-12-07T12:21:12+00:00", revision_history: [ { date: "2023-12-07T12:21:12+00:00", number: "1", summary: "Initial version", }, { date: "2023-12-07T12:21:12+00:00", number: "2", summary: "Last updated version", }, { date: "2025-03-15T03:06:15+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat JBoss Web Server 5.7 for RHEL 7 Server", product: { name: "Red Hat JBoss Web Server 5.7 for RHEL 7 Server", product_id: "7Server-JWS-5.7", product_identification_helper: { cpe: "cpe:/a:redhat:jboss_enterprise_web_server:5.7::el7", }, }, }, { category: "product_name", name: "Red Hat JBoss Web Server 5.7 for RHEL 8", product: { name: "Red Hat JBoss Web Server 5.7 for RHEL 8", product_id: "8Base-JWS-5.7", product_identification_helper: { cpe: "cpe:/a:redhat:jboss_enterprise_web_server:5.7::el8", }, }, }, { category: "product_name", name: "Red Hat JBoss Web Server 5.7 for RHEL 9", product: { name: "Red Hat JBoss Web Server 5.7 for RHEL 9", product_id: "9Base-JWS-5.7", product_identification_helper: { cpe: "cpe:/a:redhat:jboss_enterprise_web_server:5.7::el9", }, }, }, ], category: "product_family", name: "Red Hat JBoss Web Server", }, { branches: [ { category: "product_version", name: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", product: { name: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", product_id: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.31-16.redhat_16.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", product: { name: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", product_id: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.62-19.redhat_00017.1.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", product: { name: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", product_id: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.31-16.redhat_16.el8jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", product: { name: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", product_id: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.62-19.redhat_00017.1.el8jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", product: { name: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", product_id: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.31-16.redhat_16.el9jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", product: { name: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", product_id: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.62-19.redhat_00017.1.el9jws?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", product: { name: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", product_id: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.31-16.redhat_16.el7jws?arch=x86_64", }, }, }, { category: "product_version", name: "jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", product: { name: "jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", product_id: "jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.31-16.redhat_16.el7jws?arch=x86_64", }, }, }, { category: "product_version", name: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", product: { name: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", product_id: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.31-16.redhat_16.el8jws?arch=x86_64", }, }, }, { category: "product_version", name: "jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", product: { name: "jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", product_id: "jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.31-16.redhat_16.el8jws?arch=x86_64", }, }, }, { category: "product_version", name: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", product: { name: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", product_id: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.31-16.redhat_16.el9jws?arch=x86_64", }, }, }, { category: "product_version", name: "jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", product: { name: "jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", product_id: "jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.31-16.redhat_16.el9jws?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product: { name: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_id: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.62-19.redhat_00017.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product: { name: "jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_id: "jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.62-19.redhat_00017.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product: { name: "jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_id: "jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.62-19.redhat_00017.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product: { name: "jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_id: "jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.62-19.redhat_00017.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product: { name: "jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_id: "jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-java-jdk11@9.0.62-19.redhat_00017.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product: { name: "jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_id: "jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-java-jdk8@9.0.62-19.redhat_00017.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product: { name: "jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_id: "jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.62-19.redhat_00017.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_id: "jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.62-19.redhat_00017.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product: { name: "jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_id: "jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-lib@9.0.62-19.redhat_00017.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product: { name: "jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_id: "jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.62-19.redhat_00017.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_id: "jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.62-19.redhat_00017.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product: { name: "jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_id: "jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.62-19.redhat_00017.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product: { name: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product_id: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.62-19.redhat_00017.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product: { name: "jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product_id: "jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.62-19.redhat_00017.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product: { name: "jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product_id: "jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.62-19.redhat_00017.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product: { name: "jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product_id: "jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.62-19.redhat_00017.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product: { name: "jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product_id: "jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.62-19.redhat_00017.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product_id: "jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.62-19.redhat_00017.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product: { name: "jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product_id: "jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-lib@9.0.62-19.redhat_00017.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product: { name: "jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product_id: "jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.62-19.redhat_00017.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product_id: "jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.62-19.redhat_00017.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product: { name: "jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product_id: "jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.62-19.redhat_00017.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product: { name: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product_id: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.62-19.redhat_00017.1.el9jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product: { name: "jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product_id: "jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.62-19.redhat_00017.1.el9jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product: { name: "jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product_id: "jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.62-19.redhat_00017.1.el9jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product: { name: "jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product_id: "jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.62-19.redhat_00017.1.el9jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product: { name: "jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product_id: "jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.62-19.redhat_00017.1.el9jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product_id: "jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.62-19.redhat_00017.1.el9jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product: { name: "jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product_id: "jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-lib@9.0.62-19.redhat_00017.1.el9jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product: { name: "jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product_id: "jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.62-19.redhat_00017.1.el9jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product_id: "jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.62-19.redhat_00017.1.el9jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product: { name: "jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product_id: "jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.62-19.redhat_00017.1.el9jws?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 7 Server", product_id: "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", }, product_reference: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src as a component of Red Hat JBoss Web Server 5.7 for RHEL 7 Server", product_id: "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", }, product_reference: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", relates_to_product_reference: "7Server-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 7 Server", product_id: "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", }, product_reference: "jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 7 Server", product_id: "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", }, product_reference: "jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 7 Server", product_id: "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", }, product_reference: "jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 7 Server", product_id: "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", }, product_reference: "jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 7 Server", product_id: "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", }, product_reference: "jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 7 Server", product_id: "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", }, product_reference: "jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 7 Server", product_id: "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", }, product_reference: "jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 7 Server", product_id: "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", }, product_reference: "jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src as a component of Red Hat JBoss Web Server 5.7 for RHEL 7 Server", product_id: "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", }, product_reference: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", relates_to_product_reference: "7Server-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64 as a component of Red Hat JBoss Web Server 5.7 for RHEL 7 Server", product_id: "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", }, product_reference: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", relates_to_product_reference: "7Server-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64 as a component of Red Hat JBoss Web Server 5.7 for RHEL 7 Server", product_id: "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", }, product_reference: "jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", relates_to_product_reference: "7Server-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 7 Server", product_id: "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", }, product_reference: "jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 7 Server", product_id: "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", }, product_reference: "jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 7 Server", product_id: "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", }, product_reference: "jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 8", product_id: "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", }, product_reference: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src as a component of Red Hat JBoss Web Server 5.7 for RHEL 8", product_id: "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", }, product_reference: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", relates_to_product_reference: "8Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 8", product_id: "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", }, product_reference: "jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 8", product_id: "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", }, product_reference: "jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 8", product_id: "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", }, product_reference: "jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 8", product_id: "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", }, product_reference: "jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 8", product_id: "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", }, product_reference: "jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 8", product_id: "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", }, product_reference: "jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src as a component of Red Hat JBoss Web Server 5.7 for RHEL 8", product_id: "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", }, product_reference: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", relates_to_product_reference: "8Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64 as a component of Red Hat JBoss Web Server 5.7 for RHEL 8", product_id: "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", }, product_reference: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", relates_to_product_reference: "8Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64 as a component of Red Hat JBoss Web Server 5.7 for RHEL 8", product_id: "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", }, product_reference: "jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", relates_to_product_reference: "8Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 8", product_id: "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", }, product_reference: "jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 8", product_id: "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", }, product_reference: "jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 8", product_id: "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", }, product_reference: "jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 9", product_id: "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", }, product_reference: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", relates_to_product_reference: "9Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src as a component of Red Hat JBoss Web Server 5.7 for RHEL 9", product_id: "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", }, product_reference: "jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", relates_to_product_reference: "9Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 9", product_id: "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", }, product_reference: "jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", relates_to_product_reference: "9Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 9", product_id: "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", }, product_reference: "jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", relates_to_product_reference: "9Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 9", product_id: "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", }, product_reference: "jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", relates_to_product_reference: "9Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 9", product_id: "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", }, product_reference: "jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", relates_to_product_reference: "9Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 9", product_id: "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", }, product_reference: "jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", relates_to_product_reference: "9Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 9", product_id: "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", }, product_reference: "jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", relates_to_product_reference: "9Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src as a component of Red Hat JBoss Web Server 5.7 for RHEL 9", product_id: "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", }, product_reference: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", relates_to_product_reference: "9Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64 as a component of Red Hat JBoss Web Server 5.7 for RHEL 9", product_id: "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", }, product_reference: "jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", relates_to_product_reference: "9Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64 as a component of Red Hat JBoss Web Server 5.7 for RHEL 9", product_id: "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", }, product_reference: "jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", relates_to_product_reference: "9Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 9", product_id: "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", }, product_reference: "jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", relates_to_product_reference: "9Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 9", product_id: "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", }, product_reference: "jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", relates_to_product_reference: "9Base-JWS-5.7", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch as a component of Red Hat JBoss Web Server 5.7 for RHEL 9", product_id: "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", }, product_reference: "jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", relates_to_product_reference: "9Base-JWS-5.7", }, ], }, vulnerabilities: [ { cve: "CVE-2023-0464", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-03-23T00:00:00+00:00", flags: [ { label: "vulnerable_code_not_present", product_ids: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], }, ], ids: [ { system_name: "Red Hat Bugzilla ID", text: "2181082", }, ], notes: [ { category: "description", text: "A security vulnerability has been identified in all supported OpenSSL versions related to verifying X.509 certificate chains that include policy constraints. This flaw allows attackers to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial of service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the -policy' argument to the command line utilities or calling the X509_VERIFY_PARAM_set1_policies()' function.", title: "Vulnerability description", }, { category: "summary", text: "openssl: Denial of service by excessive resource usage in verifying X509 policy constraints", title: "Vulnerability summary", }, { category: "other", text: "This vulnerability is classified as low severity because policy processing in OpenSSL is disabled by default, meaning that most deployments are unaffected unless explicitly configured to enable policy checks. Additionally, while the flaw can cause exponential computational resource consumption, it does not allow for remote code execution, memory corruption, or data exfiltration—limiting its impact to a denial-of-service (DoS) condition. Exploiting this issue also requires an attacker to supply a specifically crafted X.509 certificate chain, which is only feasible in scenarios where certificate validation of untrusted chains is performed, further reducing the practical risk.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", ], known_not_affected: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0464", }, { category: "external", summary: "RHBZ#2181082", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2181082", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0464", url: "https://www.cve.org/CVERecord?id=CVE-2023-0464", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0464", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0464", }, { category: "external", summary: "https://www.openssl.org/news/secadv/20230322.txt", url: "https://www.openssl.org/news/secadv/20230322.txt", }, ], release_date: "2023-03-22T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-12-07T12:21:12+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:7622", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "openssl: Denial of service by excessive resource usage in verifying X509 policy constraints", }, { cve: "CVE-2023-0465", discovery_date: "2023-03-29T00:00:00+00:00", flags: [ { label: "vulnerable_code_not_present", product_ids: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], }, ], ids: [ { system_name: "Red Hat Bugzilla ID", text: "2182561", }, ], notes: [ { category: "description", text: "A flaw was found in OpenSSL. Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. OpenSSL and other certificate policy checks silently ignore invalid certificate policies in leaf certificates that are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function.", title: "Vulnerability description", }, { category: "summary", text: "openssl: Invalid certificate policies in leaf certificates are silently ignored", title: "Vulnerability summary", }, { category: "other", text: "Red Hat has determined that this flaw is of low impact because it only affects applications that use a non-default configuration (enabling policy processing), requires a malicious CA, and does not compromise cryptographic integrity or directly enable system exploitation.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", ], known_not_affected: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0465", }, { category: "external", summary: "RHBZ#2182561", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2182561", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0465", url: "https://www.cve.org/CVERecord?id=CVE-2023-0465", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0465", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0465", }, { category: "external", summary: "https://www.openssl.org/news/secadv/20230328.txt", url: "https://www.openssl.org/news/secadv/20230328.txt", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-12-07T12:21:12+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:7622", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.3, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", version: "3.1", }, products: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "openssl: Invalid certificate policies in leaf certificates are silently ignored", }, { cve: "CVE-2023-0466", discovery_date: "2023-03-29T00:00:00+00:00", flags: [ { label: "vulnerable_code_not_present", product_ids: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], }, ], ids: [ { system_name: "Red Hat Bugzilla ID", text: "2182565", }, ], notes: [ { category: "description", text: "A flaw was found in OpenSSL. The X509_VERIFY_PARAM_add0_policy() function is documented to enable the certificate policy check when doing certificate verification implicitly. However, implementing the function does not enable the check, allowing certificates with invalid or incorrect policies to pass the certificate verification. Suddenly enabling the policy check could break existing deployments, so it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. The applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications.", title: "Vulnerability description", }, { category: "summary", text: "openssl: Certificate policy check not enabled", title: "Vulnerability summary", }, { category: "other", text: "This vulnerability is rated as moderate because OpenSSL's X509_VERIFY_PARAM_add0_policy() function does not properly enable certificate policy checks as documented. As a result, certificates with invalid or incorrect policies may pass verification, it could lead to policy enforcement issues in applications that rely on this function without explicitly enabling policy checks.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", ], known_not_affected: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-0466", }, { category: "external", summary: "RHBZ#2182565", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2182565", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-0466", url: "https://www.cve.org/CVERecord?id=CVE-2023-0466", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-0466", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-0466", }, { category: "external", summary: "https://www.openssl.org/news/secadv/20230328.txt", url: "https://www.openssl.org/news/secadv/20230328.txt", }, ], release_date: "2023-03-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-12-07T12:21:12+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:7622", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.3, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", version: "3.1", }, products: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openssl: Certificate policy check not enabled", }, { cve: "CVE-2023-2650", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-05-17T00:00:00+00:00", flags: [ { label: "vulnerable_code_not_present", product_ids: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], }, ], ids: [ { system_name: "Red Hat Bugzilla ID", text: "2207947", }, ], notes: [ { category: "description", text: "A flaw was found in OpenSSL resulting in a possible denial of service while translating ASN.1 object identifiers. Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience long delays when processing messages, which may lead to a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "openssl: Possible DoS translating ASN.1 object identifiers", title: "Vulnerability summary", }, { category: "other", text: "CVE-2023-2650 can't cause DoS on machines with OpenSSL 1.1.1 and so is considered LOW for RHEL 8.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", ], known_not_affected: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-2650", }, { category: "external", summary: "RHBZ#2207947", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2207947", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-2650", url: "https://www.cve.org/CVERecord?id=CVE-2023-2650", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-2650", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-2650", }, { category: "external", summary: "https://www.openssl.org/news/secadv/20230530.txt", url: "https://www.openssl.org/news/secadv/20230530.txt", }, ], release_date: "2023-05-30T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-12-07T12:21:12+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:7622", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openssl: Possible DoS translating ASN.1 object identifiers", }, { cve: "CVE-2023-3446", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2023-07-24T00:00:00+00:00", flags: [ { label: "vulnerable_code_not_present", product_ids: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], }, ], ids: [ { system_name: "Red Hat Bugzilla ID", text: "2224962", }, ], notes: [ { category: "description", text: "A vulnerability was found in OpenSSL. This security flaw occurs because the applications that use the DH_check(), DH_check_ex(), or EVP_PKEY_param_check() functions to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source may lead to a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "openssl: Excessive time spent checking DH keys and parameters", title: "Vulnerability summary", }, { category: "other", text: "The CVE-2023-3446 vulnerability in OpenSSL has been classified as having a low impact due to several factors. Firstly, while the potential for a Denial of Service (DoS) attack exists, it requires specific conditions to be met, notably the use of DH_check(), DH_check_ex(), or EVP_PKEY_param_check() functions with DH keys or parameters obtained from untrusted sources. Secondly, the issue primarily affects the efficiency of key and parameter checks, rather than directly compromising the security or integrity of cryptographic operations. Given these considerations and the absence of widespread exploitation or significant consequences beyond performance degradation, the overall impact of this vulnerability is deemed low rather than moderate.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", ], known_not_affected: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-3446", }, { category: "external", summary: "RHBZ#2224962", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2224962", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-3446", url: "https://www.cve.org/CVERecord?id=CVE-2023-3446", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-3446", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-3446", }, { category: "external", summary: "https://www.openssl.org/news/secadv/20230719.txt", url: "https://www.openssl.org/news/secadv/20230719.txt", }, ], release_date: "2023-07-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-12-07T12:21:12+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:7622", }, { category: "workaround", details: "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", product_ids: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 5.3, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.1", }, products: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "openssl: Excessive time spent checking DH keys and parameters", }, { cve: "CVE-2023-3817", discovery_date: "2023-07-31T00:00:00+00:00", flags: [ { label: "vulnerable_code_not_present", product_ids: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], }, ], ids: [ { system_name: "Red Hat Bugzilla ID", text: "2227852", }, ], notes: [ { category: "description", text: "A vulnerability was found in OpenSSL. This security issue occurs because the applications that use the DH_check(), DH_check_ex(), or EVP_PKEY_param_check() functions to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source may lead to a denial of service.", title: "Vulnerability description", }, { category: "summary", text: "OpenSSL: Excessive time spent checking DH q parameter value", title: "Vulnerability summary", }, { category: "other", text: "This vulnerability in OpenSSL is considered low severity primarily because it requires specific conditions to be exploited and has limited impact. While excessive computation time during DH parameter checks could potentially lead to denial of service (DoS) attacks, the likelihood of successful exploitation is relatively low. Additionally, the vulnerability mainly affects applications that use certain OpenSSL functions for DH parameter validation, rather than the broader SSL/TLS implementation.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", ], known_not_affected: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-3817", }, { category: "external", summary: "RHBZ#2227852", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2227852", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-3817", url: "https://www.cve.org/CVERecord?id=CVE-2023-3817", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-3817", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-3817", }, { category: "external", summary: "https://www.openssl.org/news/secadv/20230731.txt", url: "https://www.openssl.org/news/secadv/20230731.txt", }, ], release_date: "2023-07-31T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-12-07T12:21:12+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:7622", }, { category: "workaround", details: "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", product_ids: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 5.3, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.1", }, products: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "OpenSSL: Excessive time spent checking DH q parameter value", }, { cve: "CVE-2023-41080", cwe: { id: "CWE-601", name: "URL Redirection to Untrusted Site ('Open Redirect')", }, discovery_date: "2023-08-28T00:00:00+00:00", flags: [ { label: "vulnerable_code_not_present", product_ids: [ "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", ], }, ], ids: [ { system_name: "Red Hat Bugzilla ID", text: "2235370", }, ], notes: [ { category: "description", text: "A flaw was found in Apache Tomcat if the default web application is configured with FormAuthenticator. This issue allows a specially crafted URL to trigger a redirect to an arbitrary URL.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: Open Redirect vulnerability in FORM authentication", title: "Vulnerability summary", }, { category: "other", text: "The pki-servlet-engine package has been obsoleted by the Tomcat package. Therefore, this issue will be fixed in the Tomcat package rather than the pki-serlvet-engine package. Please follow the RHEL Tomcat trackers instead for the updates.\n\nRed Hat Satellite is not directly impacted by this issue, since it does not embed the dependency on their offer deliveries. However, end users of Red Hat Satellite are using Tomcat via RHEL channels, which provides Tomcat dependency needed by candlepin to function in Satellite.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], known_not_affected: [ "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2023-41080", }, { category: "external", summary: "RHBZ#2235370", url: "https://bugzilla.redhat.com/show_bug.cgi?id=2235370", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2023-41080", url: "https://www.cve.org/CVERecord?id=CVE-2023-41080", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-41080", url: "https://nvd.nist.gov/vuln/detail/CVE-2023-41080", }, { category: "external", summary: "https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f", url: "https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f", }, ], release_date: "2023-08-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2023-12-07T12:21:12+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2023:7622", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, products: [ "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk11-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-java-jdk8-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.src", "7Server-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el7jws.x86_64", "7Server-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "7Server-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el7jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.src", "8Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el8jws.x86_64", "8Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "8Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el8jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-0:9.0.62-19.redhat_00017.1.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-admin-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-docs-webapp-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-el-3.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-javadoc-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-jsp-2.3-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-lib-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.src", "9Base-JWS-5.7:jws5-tomcat-native-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-native-debuginfo-0:1.2.31-16.redhat_16.el9jws.x86_64", "9Base-JWS-5.7:jws5-tomcat-selinux-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-servlet-4.0-api-0:9.0.62-19.redhat_00017.1.el9jws.noarch", "9Base-JWS-5.7:jws5-tomcat-webapps-0:9.0.62-19.redhat_00017.1.el9jws.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat: Open Redirect vulnerability in FORM authentication", }, ], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.