Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 Service Pack 1 security update
🔗 CVE IDs covered (3)
📋 Description
CVE-2015-4000 — LOGJAM: TLS connections which support export grade DHE key-exchange are vulnerable to MITM attacks CVE-2016-5387 — HTTPD: sets environmental variable based on user supplied Proxy request header CVE-2016-5388 — Tomcat: CGI sets environmental variable based on user supplied Proxy request header
🎯 Affected products1
- Red Hat JBoss Web Server 3.0
✅ Remediation
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). After installing the updated packages, the httpd daemon will be restarted automatically. After installing the updated packages, follow the instructions in this knowledgebase article to configure Tomcat: https://access.redhat.com/solutions/2435491
🔗 References (10)
- selfhttps://access.redhat.com/errata/RHSA-2016:1624
- externalhttps://access.redhat.com/security/updates/classification/#important
- externalhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver&downloadType=securityPatches&version=3.0.3
- externalhttps://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/3/html-single/3.0.3_Release_Notes/index.html
- externalhttps://access.redhat.com/security/vulnerabilities/httpoxy
- externalhttps://access.redhat.com/solutions/2435491
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1353755
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1353809
- externalhttps://issues.redhat.com/browse/JWS-483
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1624.json