RedHat: RHSA-2018-2486:01 Important: Red Hat JBoss Core Services Apache
Summary
This release adds the new Apache HTTP Server 2.4.29 packages that are part
of the JBoss Core Services offering.
This release serves as a replacement for Red Hat JBoss Core Services
Apache HTTP Server 2.4.23, and includes bug fixes and enhancements. Refer
to the Release Notes for information on the most significant bug fixes,
enhancements and component upgrades included in this release.
Security Fix(es):
* expat: Out-of-bounds heap read on crafted input causing crash
(CVE-2016-0718)
* curl: escape and unescape integer overflows (CVE-2016-7167)
* curl: Cookie injection for other servers (CVE-2016-8615)
* curl: Case insensitive password comparison (CVE-2016-8616)
* curl: Out-of-bounds write via unchecked multiplication (CVE-2016-8617)
* curl: Double-free in curl_maprintf (CVE-2016-8618)
* curl: Double-free in krb5 code (CVE-2016-8619)
* curl: curl_getdate out-of-bounds read (CVE-2016-8621)
* curl: URL unescape heap overflow via integer truncation (CVE-2016-8622)
* curl: Use-after-free via shared cookies (CVE-2016-8623)
* curl: Invalid URL parsing with '#' (CVE-2016-8624)
* curl: IDNA 2003 makes curl use wrong host (CVE-2016-8625)
* libxml2: out-of-bounds read (unfixed CVE-2016-4483 in JBCS)
(CVE-2016-9598)
* pcre: Out-of-bounds read in compile_bracket_matchingpath function
(8.41/3) (CVE-2017-6004)
* pcre: Invalid Unicode property lookup (8.41/7, 10.24/2) (CVE-2017-7186)
* pcre: invalid memory read in_pcre32_xclass (pcre_xclass.c)
(CVE-2017-7244)
* pcre: stack-based buffer overflow write in pcre32_copy_substring
(CVE-2017-7245)
* pcre: stack-based buffer overflow write in pcre32_copy_substring
(CVE-2017-7246)
* curl: FTP PWD response parser out of bounds read (CVE-2017-1000254)
* curl: IMAP FETCH response out of bounds read (CVE-2017-1000257)
* curl: Heap-based buffer overflow in Curl_smtp_escape_eob() when uploading
data over SMTP (CVE-2018-0500)
Details around this issue, including information about the CVE, severity of
the issue, and the CVSS score can be found on the CVE page listed in the
Reference section below.
The following packages have been upgraded to a newer upstream version:
* Curl (7.57.0)
* OpenSSL (1.0.2n)
* Expat (2.2.5)
* PCRE (8.41)
* libxml2 (2.9.7)
Acknowledgements:
CVE-2017-1000254: Red Hat would like to thank Daniel Stenberg for reporting
this issue.
Upstream acknowledges Max Dymond as the original reporter.
CVE-2017-1000257: Red Hat would like to thank the Curl project for
reporting this issue. Upstream acknowledges Brian Carpenter, (the OSS-Fuzz
project) as the original reporter.
CVE-2018-0500: Red Hat would like to thank the Curl project for reporting
this issue.
Summary
Solution
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing Red Hat JBoss Core Services installation (including all
applications and configuration files).
References
https://access.redhat.com/security/cve/CVE-2016-0718 https://access.redhat.com/security/cve/CVE-2016-7167 https://access.redhat.com/security/cve/CVE-2016-8615 https://access.redhat.com/security/cve/CVE-2016-8616 https://access.redhat.com/security/cve/CVE-2016-8617 https://access.redhat.com/security/cve/CVE-2016-8618 https://access.redhat.com/security/cve/CVE-2016-8619 https://access.redhat.com/security/cve/CVE-2016-8621 https://access.redhat.com/security/cve/CVE-2016-8622 https://access.redhat.com/security/cve/CVE-2016-8623 https://access.redhat.com/security/cve/CVE-2016-8624 https://access.redhat.com/security/cve/CVE-2016-8625 https://access.redhat.com/security/cve/CVE-2016-9598 https://access.redhat.com/security/cve/CVE-2017-6004 https://access.redhat.com/security/cve/CVE-2017-7186 https://access.redhat.com/security/cve/CVE-2017-7244 https://access.redhat.com/security/cve/CVE-2017-7245 https://access.redhat.com/security/cve/CVE-2017-7246 https://access.redhat.com/security/cve/CVE-2017-1000254 https://access.redhat.com/security/cve/CVE-2017-1000257 https://access.redhat.com/security/cve/CVE-2018-0500 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.29/html-single/red_hat_jboss_core_services_apache_http_server_2.4.29_release_notes/
Package List
Topic
Red Hat JBoss Core Services Pack Apache Server 2.4.29 packages forMicrosoft Windows and Oracle Solaris are now available.Red Hat Product Security has rated this release as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Bugs Fixed
1296102 - CVE-2016-0718 expat: Out-of-bounds heap read on crafted input causing crash
1375906 - CVE-2016-7167 curl: escape and unescape integer overflows
1388370 - CVE-2016-8615 curl: Cookie injection for other servers1388371 - CVE-2016-8616 curl: Case insensitive password comparison
1388377 - CVE-2016-8617 curl: Out-of-bounds write via unchecked multiplication
1388378 - CVE-2016-8618 curl: Double-free in curl_maprintf
1388379 - CVE-2016-8619 curl: Double-free in krb5 code
1388385 - CVE-2016-8621 curl: curl_getdate out-of-bounds read
1388386 - CVE-2016-8622 curl: URL unescape heap overflow via integer truncation
1388388 - CVE-2016-8623 curl: Use-after-free via shared cookies
1388390 - CVE-2016-8624 curl: Invalid URL parsing with '#'
1388392 - CVE-2016-8625 curl: IDNA 2003 makes curl use wrong host
1408306 - CVE-2016-9598 libxml2: out-of-bounds read (unfixed CVE-2016-4483 in JBCS)
1425365 - CVE-2017-6004 pcre: Out-of-bounds read in compile_bracket_matchingpath function (8.41/3)
1434504 - CVE-2017-7186 pcre: Invalid Unicode property lookup (8.41/7, 10.24/2)
1437364 - CVE-2017-7244 pcre: invalid memory read in _pcre32_xclass (pcre_xclass.c)
1437367 - CVE-2017-7245 pcre: stack-based buffer overflow write in pcre32_copy_substring
1437369 - CVE-2017-7246 pcre: stack-based buffer overflow write in pcre32_copy_substring
1495541 - CVE-2017-1000254 curl: FTP PWD response parser out of bounds read
1503705 - CVE-2017-1000257 curl: IMAP FETCH response out of bounds read
1597101 - CVE-2018-0500 curl: Heap-based buffer overflow in Curl_smtp_escape_eob() when uploading data over SMTP