RHSA-2020:4384MediumCVSS 9.8

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP5 security update

Published
October 28, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (5)

CVE-2019-1551 →CVE-2019-5435 →CVE-2020-11984 →CVE-2020-11993 →CVE-2020-25680 →

📋 Description

CVE-2019-1551 — openssl: Integer overflow in RSAZ modular exponentiation on x86_64 CVE-2019-5435 — curl: Integer overflows in curl_url_set() function CVE-2020-11984 — httpd: mod_proxy_uwsgi buffer overflow CVE-2020-11993 — httpd: mod_http2 concurrent pool usage CVE-2020-25680 — httpd: allow connecting via SSL to a backend worker when the backend keystore file's ID is 'unknown'

🎯 Affected products189

  • Red Hat JBoss Core Services on RHEL 6 Server
  • Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-apr-0:1.6.3-104.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-apr-0:1.6.3-104.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-apr-0:1.6.3-104.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-apr-0:1.6.3-104.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-apr-0:1.6.3-104.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-apr-debuginfo-0:1.6.3-104.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-apr-debuginfo-0:1.6.3-104.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-apr-debuginfo-0:1.6.3-104.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-apr-devel-0:1.6.3-104.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-apr-devel-0:1.6.3-104.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-apr-devel-0:1.6.3-104.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-apr-util-0:1.6.1-75.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-apr-util-0:1.6.1-75.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-apr-util-0:1.6.1-75.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-apr-util-0:1.6.1-75.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-apr-util-0:1.6.1-75.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-apr-util-debuginfo-0:1.6.1-75.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-apr-util-debuginfo-0:1.6.1-75.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-apr-util-debuginfo-0:1.6.1-75.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-apr-util-devel-0:1.6.1-75.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-apr-util-devel-0:1.6.1-75.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-apr-util-devel-0:1.6.1-75.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-apr-util-ldap-0:1.6.1-75.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-apr-util-ldap-0:1.6.1-75.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-apr-util-ldap-0:1.6.1-75.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-apr-util-mysql-0:1.6.1-75.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-apr-util-mysql-0:1.6.1-75.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server
  • jbcs-httpd24-apr-util-mysql-0:1.6.1-75.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • +159 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: For Red Hat Enterprise Linux 7, 512 bit DH is already disabled. As this bug is about leakage of the private key to the attacker, it should be fully sufficient to just not use 1024 bit RSA keys or 1024 bit DSA keys. These keys are not secure enough anyway. 3-prime RSA keys are not supported on RHEL-7. For Red Hat Enterprise 8, The DEFAULT crypto policy already disables all these key sizes. Also applications compiled with openssl which use the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME, other users of this API are not affected by this flaw. Workaround: This flaw only affects specific httpd configurations which use the uwsgi protocol. It does not manifest itself when uwsgi protocol is not used. Commenting out "LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so" in /etc/httpd/conf.modules.d/00-proxy.conf will disable the loading of the vulnerable module.

🔗 References (8)